adsatinder
Peace
Kaspersky cybersecurity expert explains Pegasus, shares tips to beat such spyware
A cybersecurity expert at Kaspersky has shared tips on how spyware like Pegasus can be beaten collectively by patching zero-day vulnerabilities as soon as they are found.
Sarthak Dogra Noida
July 20, 2021
UPDATED: July 20, 2021 14:01 IST
HIGHLIGHTS
The case of the notorious spyware Pegasus has taken the world by storm, as various reports reveal its unauthorised use compromising the basic human rights of many. With such remote surveillance possible through an infected device, the question of cybersecurity has become more persistent than ever.
A cybersecurity researcher now sheds some light on the potential harm of the spyware and how the cyberspace can be safeguarded against it. The key, it seems, is a collective sharing of knowledge of such attacks and their impacts.
Dmitry Galov, security researcher at GReAT, Kaspersky, explains the origins of the Pegasus spyware and how it should not be confused with vulnerabilities. “Pegasus is a spyware with versions for both iOS and Android devices,” he explains. Even in 2017, the perpetrator could “read the victim's SMS and emails, listen to calls, take screenshots, record keystrokes, and access contacts and browser history. And that’s not all of its functionality.”
As has been revealed in recent forensic reports of infected devices, Pegasus has been used for exactly the same sort of spying on individuals including journalists, lawyers, and human rights activists from across countries. So how does a regular smartphone user be wary of it?
To clear this, Galov explains that Pegasus is a rather complex and expensive malware. It has been specifically designed to spy on individuals of particular interest. Therefore, the average user is unlikely to be a target for it.
That being said, the complexity of the spyware makes it one of the most potent tools out there to spy on one’s smartphone. Pegasus has constantly evolved over the years to exploit several zero-day vulnerabilities in both Android and iOS. Moreover, it attempts to clear its own traces from an infected device, though some of it are still visible under a forensic investigation.
Galov says that both the spyware and zero-day vulnerabilities can be sold and bought by various groups on the darknet. The price of vulnerabilities can reach $2.5 million - this is how much was offered in 2019 for the full chain of vulnerabilities in Android. Interestingly, that year, for the first time, an Android vulnerability turned out to be more expensive than an iOS vulnerability.
But if these vulnerabilities can be accessed by practically anyone on the dark corners of the internet, how do regular smartphone users stay protected?
The only sure shot way is to remove the vulnerability as and when it is spotted in any service. For this, the developers of a software or a service need to be on top of the situation at all times. They will need data from the users and such targeted attacks to rectify the security loopholes. The best way for this, as per Galov, is for the general users to provide as much information on these cases as possible, to related software and security vendors.
Kaspersky cybersecurity expert explains Pegasus, shares tips to beat such spyware
A cybersecurity expert at Kaspersky has shared tips on how spyware like Pegasus can be beaten collectively by patching zero-day vulnerabilities as soon as they are found.
Sarthak Dogra Noida
July 20, 2021
UPDATED: July 20, 2021 14:01 IST
HIGHLIGHTS
- Pegasus has been used to target several high profile individuals with unlawful surveillance.
- The spyware exploits zero-day vulnerabilities in the iOS and Android.
- A cybersecurity expert explains how we can be on top of such security lapses by proactively sharing this information with the developers.
The case of the notorious spyware Pegasus has taken the world by storm, as various reports reveal its unauthorised use compromising the basic human rights of many. With such remote surveillance possible through an infected device, the question of cybersecurity has become more persistent than ever.
A cybersecurity researcher now sheds some light on the potential harm of the spyware and how the cyberspace can be safeguarded against it. The key, it seems, is a collective sharing of knowledge of such attacks and their impacts.
Dmitry Galov, security researcher at GReAT, Kaspersky, explains the origins of the Pegasus spyware and how it should not be confused with vulnerabilities. “Pegasus is a spyware with versions for both iOS and Android devices,” he explains. Even in 2017, the perpetrator could “read the victim's SMS and emails, listen to calls, take screenshots, record keystrokes, and access contacts and browser history. And that’s not all of its functionality.”
As has been revealed in recent forensic reports of infected devices, Pegasus has been used for exactly the same sort of spying on individuals including journalists, lawyers, and human rights activists from across countries. So how does a regular smartphone user be wary of it?
To clear this, Galov explains that Pegasus is a rather complex and expensive malware. It has been specifically designed to spy on individuals of particular interest. Therefore, the average user is unlikely to be a target for it.
That being said, the complexity of the spyware makes it one of the most potent tools out there to spy on one’s smartphone. Pegasus has constantly evolved over the years to exploit several zero-day vulnerabilities in both Android and iOS. Moreover, it attempts to clear its own traces from an infected device, though some of it are still visible under a forensic investigation.
Galov says that both the spyware and zero-day vulnerabilities can be sold and bought by various groups on the darknet. The price of vulnerabilities can reach $2.5 million - this is how much was offered in 2019 for the full chain of vulnerabilities in Android. Interestingly, that year, for the first time, an Android vulnerability turned out to be more expensive than an iOS vulnerability.
But if these vulnerabilities can be accessed by practically anyone on the dark corners of the internet, how do regular smartphone users stay protected?
The only sure shot way is to remove the vulnerability as and when it is spotted in any service. For this, the developers of a software or a service need to be on top of the situation at all times. They will need data from the users and such targeted attacks to rectify the security loopholes. The best way for this, as per Galov, is for the general users to provide as much information on these cases as possible, to related software and security vendors.
Kaspersky cybersecurity expert explains Pegasus, shares tips to beat such spyware
