@geeks, Some questions about the Pegasus spyware scandal.

This is my understanding in general. Experts, feel free to correct me if I’m mistaken.

Pegasus is a type of sypware. Either one can install without taking any alternative approach or have it installed via other methods. Clicking a URL can give consent to install spyware. Although it is easy to target this way, everyone may not do the same.

There are other methods like binders, or disguising the spyware in form of an image/document etc.

Binders are software which can bind two different files. So a spyware can be binded to an image/document/audio/video, and when the file is opened for accessing the content, the spyware can do its job(taking control) in the background.

Disguising is nothing but plain change of extension from .exe to .pdf so that it looks like an pdf document. When opened, it will not render any useful content, but the spyware can get executed in the background.

Usually spyware take advantage of the loopholes in the system(os). This is where OS makers patch the system from time to time, ie to close those backdoors (may be unintentional). Depending on the sophistication of spyware, either they can be removed upon reset or they can never be removed. This again depends on the access to the system(OS).

Even for that matter, the xl sheet we download for income tax returns has scripts in it, and xl always asks if we wish to run the script (Enable Content). Many things can be done via this method.

When it comes to ITR xl sheet, one damage it does is to disable drag and drop, and other nifty features which we use in day-to-day life after we enable the content in the xlsheet. I have another script handy to run to enable those features which are disabled. Likewise, many things can be done in the background.

PS: I havent read much about pegasus.

No need to click, Pegasus is an example of a top grade spyware developed by a state actor(Israel in this case) & such spywares exploit vulnerabilities which don’t depend on any user action(like clicking/viewing etc by user) & need to just be send by the attacker to target system(pc/mobile). That is why there is no 100% online security in the world & most important security infrastructure is usually situated in underground bunkers with no net access/completely independent offline systems.

“The victim receives an unsuspecting URL through an email or message when clicked the Pegasus spyware gets installed and opens a backdoor inside the mobile phone’s OS”

To install an executable file we don’t have to click on a URL, it can be an image as well. In a simple way, a good morning coffee cup/beautiful girl image is enough!!

Pegasus doesn’t need anyone to click on a link, it can be done by just giving you a missed call on whatsapp or a imessage on IOS.
That is why so much hype for this. Facebook has even sued NSO in America as whatsapp promises end to end encryption and Pegasus breaks it.
Also this doesn’t go away even if you do factory reset. It is that sophisticated.

I have no idea about this but a software guy said on news that this can be installed by giving a missed call on WhatsApp.

Let me tell you a small story:

In the 2005-2010 era, US wanted to take down Iran’s nuclear programs without even bombing or using any military attacks; so what they did was that they loaded a computer worm in thousands of USB-flash drives and just dropped them around those nuclear sites, laying there on the dusty ground.
Now human’s have an ingenious curiosity and so most of them ignored those pendrives lying on the street while couple of them got curious and picked them and inserted into the system to check what was there… and bam, the worm went through it’s way all to the main power systems and what it did was just a small thing: It just removed the rpm threshold of the centrifuges and this caused the whole facility to tear down from within. The whole nuclear centrifuges blasted and went kaput killing all those involved on the site.

Just a good read… now it’s up to you to get the gist of it

I think they are using open listening ports of system, or vulnerabilities of system applications.
Click links like hacking is used by entry level hackers. If you see their turn over, they might be even directly deploying spyware even with pre installed OS and apps.

I dont think a whatsapp call can install anything. Unless you give permission to a link or a file or a pic nothing get executed. Spyware always get installed when they are disguised as a url/file/pic. And if spyware cant be removed then it can be removed via factory reset unless the mobile is rooted/jai broken.

If there are real people who got pegasus on their phone, then they are the ones who didnt care of clicking/taping on something unknown.

Even if they got an unknown message or a call or a whatsapp call, what was the need to get attracted to it ?

Nope most people click on links that they receive, curosity gets the better of them. Yes they are aware of not entering any personal details or installing apks from random links. Common understanding is you dont suddenly get hacked for just clicking some link and doing nothing else. This is a case of targeted attack (or atleast what it is being called).

May be thru fake whatsapp update, so some vulnerability in WA than OS

Its a hoax.

…Google and apple gave consent to US authorities and US secret service actively uses these back doors to interact ( steal info ) from the users.

….IT big companies and capitalist govt. are working in tandem to increase their authority….

This Government has been striving hard to steer the nation through its most difficult times. Don’t fall prey for the enemy conspirators. They nation is in trusted hands.

It could also have been added to an App update in Google Playstore or Apple or even sneaked in as an OS/Software update of Android/Apple phones. I mean, who knows what all “security updates” we keep receiving in windows/phones

While you follow the Pegasus spygate stories, remember that it costs $7-8 Million per license, and one license can be used on 50 phones.

It throws off ALL data – calls, messages, keystrokes, remote activation of camera + microphone… complete access. What this means is that a significantly large team is required to sift through it all.

It isn’t mass surveillance automatically looking for keywords in conversations, it’s targeted and total surveillance of a small group of individuals… Someone is manually going through it all.

This raises an important question that won’t be answered today… who are these people doing the snooping?

We know it’s the govt, but who in it? It’s likely it’s under MHA, but someone must follow up exactly who… the potential for misuse and blackmail is tremendous.

The answers might be shocking to say the least. It’ll be headed by someone trusted and someone whom the duo have absolute control over, but the individuals actually sifting through data are important.

Are they govt staff, or did it all get outsourced? What are the safeguards?

It’s illegal government surveillance, but what makes it worse is that there is no guarantee the data even stays with the govt… what if it’s sold to private business interests who now have leverage over judges, ministers and officials? What if it’s leaking to foreign nations?

They’ll try to cover up all details with the national security bogey, but their illegal surveillance for political control is actually a threat to national security.

They want to break encryption, but if it goes, all our top leaders will be easy targets for foreign surveillance. And for unscrupulous business interests. We already know a major Indian company has a huge surveillance apparatus that it uses!

Encryption and privacy actually protects national security, by weakening it, they get politically stronger but weaken the security of India.

The nation deserves answers, and silence by claiming national security should not be accepted!

The process followed, permissions obtained (or not) are important aspects!

I expect this to be raised in Parliament, but friends in the media who care, please stress in your reportage why this is so important for the future of India.

https://twitter.com/ShivamShankarS/status/14167...

Vulnerabilities exists and OSes keep coming with the fixes.

Question is not about vulnerabilities but the exploit that can get installed on phone without any actuon/event.

If you can prove that you can exploit the vulnerabilities without anyone doing anything, you will get multi-billion dollar paychecks by any developed nations of the world.

BTW, amnesty is known for their leftist acts. Anarchy is its motto. Shoot and scoot is its policy. It doesn’t have any credibility.