A Wakeup Call for Internet Security Leaders | #cybersecurity | #cyberattack


The attacks using spyware to hack data of influential people and businesses may soon become a trend. A report by The Wire reveals on Sunday night that spyware Pegasus has targeted at least 40 Indian journalists, from well-known media organizations. Indian ministers, government officials and opposition leaders also figure in the list of people whose phones may have been compromised by the spyware, it said.

Pegasus, a product of Israeli cyber weapons company NSO Group is a spyware that can log your keystrokes, screenshot your screen and take control of your apps. It first made headlines in 2016 when it was revealed that it unsuccessfully attempted an attack on the device of UAE human rights activist Ahmed Mansoor. He received text messages on his iPhone promising ‘new secrets’ about tortured prisoners in the country if he opened a link in the SMS. Instead of following the instructions, Mansoor sent the messages to researchers at Citizen Lab, who traced the origin of the links back to infrastructure belonging to the NSO Group.

In May 2019, WhatsApp brought the matter to light when it sued Israeli spyware maker NSO Group for its Pegasus spyware that was allegedly used to snoop on journalists, activists, lawyers and senior government officials in 20 countries around the world, hacking into phones of roughly 1,400 users around the world, including 121 Indians.

Calling it as an attack of freedom to India, Nikhil Pahwa is an Indian journalist and digital rights activist says that surveillance by governments using Pegasus is not uncommon. “We’ve known about Pegasus since 2016. First known use in India that we know about was in Bhima Koregoan, allegedly by the Indian government,” he tweets.

Pegasus exploits the vulnerabilities of your mobile device operating system which makes it so powerful that it can extract information from all apps on your phone including iMessage, WhatsApp, Gmail, Viber, Facebook, Skype and locations. The NSO Group has categorically denied all allegations of wrongdoing and said that it sold Pegasus only to “vetted and legitimate government agencies”.

Pahwa alleges that the Indian government has used Pegasus to spy on noted people, as the company only sells to vetted governments. However, the Ministry of Electronics and Information Technology has called the snooping allegations ‘false and malicious’ and said that there has been no unauthorized interception by government agencies.

Condemning it as a strong case of human rights abuse, WhatsApp head Will Cathcart mentions on Twitter, “NSO’s dangerous spyware is used to commit horrible human rights abuses all around the world and it must be stopped”.

NSO allegedly first created fake WhatsApp accounts, which were then used to make video calls. When an unsuspecting user’s phone rang, the attacker transmitted the malicious code and the spyware got auto-installed in the phone even if the user did not answer the call.

Through Pegasus, the attacker then took over the phone’s systems, gaining access to the user’s WhatsApp messages and calls, regular voice calls, passwords, contact lists, calendar events, phone’s microphone, and even the camera.

“They rely on unknown vulnerabilities in mobile OS, which is one of the reasons why we felt it was so important to raise awareness of what we’d found,” he says.

Pegasus can be installed on a target’s phone in many ways, in some cases by sending infected links to targets (spear phishing), social engineering, believe experts. The key question can such software be used in future by terrorist organisations, to attack individuals, businesses and nations? Also are we prepared for any such attacks?

As Pahwa notes, “Cybersecurity threats and cyber surveillance are here to stay. There is a weaponization of cyberspace that is taking place at an alarming pace. We need the UN to step in. We need disarmament of the cyberspace. No one will ever feel secure to have trusted communications.

In this context, L Subramanyan, noted journalist and Founder and CEO of Trivone discusses the implications of such attacks in a corporate structure.

According to him, “While the NSO group may claim today that it only sells to Governments, there is no system that can actually verify the claim, not just for NSO but for every creator of spyware or malware. Consequently, how do we hold the spyware creators accountable when they have the overt and covert support of governments across the world?”

Quoting a Microsoft data, he explains that IT companies are targeted around 44% of the time as compared to Governments which account for only 18% of the cyberattacks. This raises the stakes for the purveyors of technology as they continue to remain the most vulnerable from the Private Sector Offensive Actors (PSOA) who are the creators of the spyware in the first place. This also means that the tech they sell, be it Cloud solution, Enterprise applications, Collaboration solutions et al are the primary targets of the spyware.

“This also means that customers of these tech companies should be a worried lot as their technology provider could be hacked anytime which will impact their (the enterprise customer’s) businesses. And this could be from the Government agencies, private hackers, lone-wolf cyber punks or in some cases, even their own competitors,” Subramanyan says.

“This is a wakeup call for security on the internet. The mobile phone is the primary computer for billions of people. Governments and companies must do everything they can to make it as secure as possible. Our security and freedom depend on it,” Cathcart adds.

It is time the government and corporate entities take spyware and other cyber attack seriously and gets ready for a ‘surveillance reform’ soon.





Original Source link

Leave a Reply

Your email address will not be published. Required fields are marked *

+ twenty three = thirty two