Pegasus – how does it work? The victim doesn’t have to click on anything. All you need is an invisible notification

Despite many important topics in recent days, the eavesdropping case of prosecutor Ewa Wrzosek, lawyer Roman Giertych and politician of the Civic Platform Krzysztof Brejza does not come off the top of the (private) media. We informed many times that all three of them were to be eavesdropped on the Pegasus program. This time, we explain in detail what Pegasus is, how it works and what opportunities it gives to the services that use it.

How does Pegasus work?

Pegasus is an advanced spyware developed by the Israeli company NSO Group Technologies, created in 2010 by former members of the Israel Intelligence Corps. In theory, it works like many amateur pests that steal information from phones or computers. Pegasus, however, is definitely more effective – it has almost unlimited possibilities and is very difficult to detect.

There are many ways to infect someone’s phone with Pegasus. This can be done, for example, by sending a message with a link to the victim’s phone, an e-mail with a forged document or a push notification. Inattentive clicking on a link, file or notification may end up infecting the phone and then gaining access to it by services using Pegasus. Until 2016, giving a potential victim a suspicious message was the only way to fire up a spy machine on his phone, but this option is still used today.

The phishing method, however, is not always effective, because not everyone is fooled by the classic scam, which is why the newer version of Pegasus may already have knowledge on its part. An example of a method reported by the media, is sending the notification invisible to the recipient. Before 2019, Pegasus also exploited a vulnerability in the WhatsApp messenger, which allowed to “enter the device” by making a call (so that it was not answered) and then deleting the call missed notification from the phone. In July 2021, it was revealed that Pegasus could also get to the latest iPhones via. The newest methods are, of course, kept top secret.

Of course, in a more classic – at least for secret service agents – way. By taking over someone’s device for a period of time or by physically tracking the victim with a special device used at close range. Probably there are or were more methods, but not all of them are known. The NSO Group is still looking for new, more and more sophisticated ways.

What can services using Pegasus have access to?

What happens when a device is infected? Pegasus (undiscovered) vulnerabilities in the victim’s phone software and tries to access all possible modules and smartphone data. He does it “in the clothes” so that the person being followed does not find out about this fact. Pegasus certainly works on devices with iOS and Android operating systems, although there are many indications that it may or could also spy on Symbian (Nokia) phones and BlackBerry devices. What’s more, it can also deal with smartphones that have the latest security patches installed.

When hijacking access to the phone is successful, the services can turn the victim’s smartphone into a real spy machine. Pegasus gives services access to all information stored in the device’s memory (photos, videos, call history, SMSs, etc.), phone status, and allows you to turn on the microphone or camera at any time, listen to the conversation, track the location or transmit live image and sound 24 hours a day.

And without any information that could raise the suspicion of the owner of the phone (maybe apart from a slightly faster energy consumption) or even the telecommunications company whose customer is the victim. This is one of the main advantages of Pegasus – it allows you to steal very valuable information and overhear even technologically aware citizens, so that this fact does not come to light long after the attack (or at all).

Detecting Pegasus for the average smartphone user is a rather impossible task. However, specialists from private companies – for example Apple (the iPhone manufacturer) – can do it and notify their client about it. This is how the public prosecutor Ewa Wrzosek was supposed to have broken into the phone. Traces of attacks are also detected by, for example, Citizen Lab, a special research unit of the University of Toronto, after handing over the phone for expertise. This is how the attacks on Roman Giertych and Krzysztof Brejza were to come to light.

Pegasus is a weapon against terrorism and crime?

The NSO Group declares that Pegasus was created to “help government agencies investigate and prevent terrorism and crime, to save thousands of lives worldwide.” Among the groups the companies believe should be targeted by authorities using Pegasus are “terrorists, drug dealers, pedophiles and other criminals.” we can also read that intelligence and security agencies have problems fighting crime and finding evidence, because members of such groups “use technologies that ensure their privacy”.

“NSO products are only used by government intelligence and law enforcement agencies to fight crime and terrorism,” reports the NSO Group. The problem is that – as indicated by organizations that care for human rights, – sometimes Pegasus is also used to surveillance, inter alia, journalists, politicians, opponents and human rights defenders. It can be said that in some, less democratic countries, it has quickly become a remedy for the most unruly citizens.

Can you protect yourself from Pegasus?

Can the average citizen somehow protect himself from eavesdropping? Probably not, although there is not much to be afraid of either. Spying using Pegasus costs a fortune, because the NSO Group is paying dearly for using the best software of this type today. According to various unofficial information, each burglary costs around 25,000. dollars. If you want to hack different devices of the same person (or the same phone again, if necessary), you will probably have to pay again.

For this reason, the services of individual countries do not want to spy on the average Kowalski in this way, who does not have any valuable data. Moreover, power has other, easier and cheaper ways to reach such a person. Pegasus attacks, on the other hand, may be feared by people such as opposition politicians, journalists, social activists and other citizens performing functions that do not please the services of authoritarian countries with Pegasus. An exemplary regime can therefore check, for example, where, when and with whom a given politician, lawyer or journalist met and record his entire conversation.

The best protection against Pegasus is to give up the use of consumer electronics, and above all consumer smartphones, which most of us use every day. It is not without reason that the most important people in many countries use specially secured telephones, and important conversations are held in isolated rooms after removing the telephone from their pockets. However, using the phone is inevitable, so it is best to equip yourself with a simple device (e.g. without a camera), use multiple phones interchangeably, turn them off frequently (apparently Pegasus sometimes works in the cache to remain undetectable) and restore the device to factory settings .