Incident: Government Spyware Pegasus Exploits Zero-Day Vulnerability on Smartphones

Published Date: 2017-06-19

Postmortem Analysis
Timeline 1. The software failure incident involving the Pegasus spyware, as reported in Article 60347, happened around August 2016. - Step 1: The article mentions that in August 2016, researchers at Citizen Lab conducted tests on an iPhone 5 to confirm the presence of the Pegasus software. - Step 2: The article was published on June 19, 2017. - Step 3: Based on the information provided, the incident occurred in August 2016.
System 1. Pegasus spyware software created by NSO Group [60347]
Responsible Organization 1. The software failure incident was caused by the NSO Group, the Israeli company that created the Pegasus spyware program [60347].
Impacted Organization 1. Activists, journalists, and human rights defenders were impacted by the software failure incident involving the Pegasus spyware created by NSO Group [60347].
Software Causes 1. The software failure incident was caused by the creation and distribution of the spyware program Pegasus by the Israeli company NSO Group, which was intended for spying on criminals and terrorists but was allegedly misused by the Mexican government or corrupt internal groups to spy on activists, journalists, and human rights defenders [60347]. 2. Pegasus exploited a zero-day exploit in the iOS operating system, named Trident, to infect devices and gain unauthorized access to personal data, including messages, emails, contacts, and even control over the microphone and camera of the targeted devices [60347]. 3. The software incident was triggered by the deceptive SMS messages containing malicious links that, when clicked by the target, installed the Pegasus software on their devices, allowing the attackers to access files, record calls, and monitor various applications like Gmail, WhatsApp, Skype, Facebook, and more [60347].
Non-software Causes 1. The misuse of the software Pegasus by the Mexican government or corrupt groups within the federal administration to spy on activists, journalists, and human rights defenders [60347]. 2. The unethical selling of the spyware Pegasus by the Israeli company NSO Group to governments with the condition that it should only be used to combat terrorists or criminal groups [60347]. 3. The exploitation of a zero-day exploit named Trident in the iOS operating system by Pegasus to infect devices and install malicious software [60347]. 4. The deceptive tactics used by attackers to persuade targets to click on infected links through SMS messages impersonating news, alerts, or messages from acquaintances [60347]. 5. The significant financial costs associated with using Pegasus for spying, with charges of around $650,000 for monitoring 10 iPhone users [60347]. 6. The lack of traceability of the hackers using Pegasus, making it difficult to determine the exact entities behind specific hacking attempts [60347].
Impacts 1. The software failure incident led to the unauthorized surveillance and monitoring of individuals' personal lives, including their calls, messages, emails, passwords, contacts, and calendars [60347]. 2. The incident resulted in the exploitation of a zero-day vulnerability in the iOS operating system, allowing attackers to jailbreak devices and install sophisticated spyware [60347]. 3. The software failure incident enabled attackers to access and control the camera and microphone of the targeted devices, compromising the privacy and security of the affected individuals [60347]. 4. The incident impacted various individuals and groups, including journalists, activists, lawyers, and organizations advocating for social causes, leading to concerns about privacy violations and potential misuse of surveillance technology [60347].
Preventions 1. Implementing strict ethical guidelines and oversight mechanisms within the NSO Group to ensure that their software is only sold to legitimate government entities for lawful purposes [60347]. 2. Conducting thorough background checks on potential buyers of the Pegasus software to prevent it from falling into the hands of corrupt or unauthorized entities [60347]. 3. Regularly updating and patching software vulnerabilities to prevent zero-day exploits like Trident from being used to infiltrate devices [60347]. 4. Enhancing user awareness and education on cybersecurity best practices to prevent falling for phishing attempts and malicious links sent through SMS messages [60347]. 5. Strengthening legal frameworks and regulations around the use of surveillance software to hold governments and companies accountable for misuse and unauthorized surveillance activities [60347].
Fixes 1. Implementing stricter controls and regulations on the sale and usage of spyware like Pegasus to prevent misuse by governments or malicious actors [60347]. 2. Conducting thorough security audits and testing on mobile devices to identify and patch vulnerabilities like the zero-day exploit used by Pegasus to infiltrate iOS and Android systems [60347]. 3. Enhancing user awareness and education on cybersecurity best practices to prevent falling for phishing attempts like the SMS messages containing malicious links used to infect devices with Pegasus [60347]. 4. Holding accountable the manufacturers and sellers of spyware like NSO Group for enabling human rights violations and illegal surveillance activities [60347].
References 1. Red en Defensa de los Derechos Digitales (R3D) and the New York Times [60347] 2. Citizen Lab at the University of Toronto 3. Kaspersky Lab

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization <Article 60347> provides information about a software failure incident related to the Pegasus spyware created by the NSO Group. This incident involves the Mexican government or a corrupt group within the federal administration using the software to spy on activists, journalists, and human rights defenders. The spyware infiltrates smartphones to monitor various aspects of a person's life, including calls, messages, emails, passwords, contacts, and calendars. It can also access the microphone and camera of the targeted devices for surveillance purposes. Regarding the options provided: (a) The incident involving the Pegasus spyware has happened again within the same organization, as mentioned in the article. The software was reportedly used by the Mexican government or a corrupt internal group for espionage activities. (b) The Pegasus spyware incident has also affected multiple organizations and individuals, including journalists, activists, and advocacy groups in Mexico. The spyware has been used to target various individuals and organizations beyond the initial reports, indicating a broader impact [60347].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the case of the Pegasus software developed by the NSO Group. The software was designed to be a spyware for governments to monitor individuals by infiltrating their smartphones and other devices, allowing access to various personal information such as calls, messages, emails, passwords, contacts, and calendars [60347]. The software was intended to be used exclusively by governments to combat terrorists or criminal groups. However, the software was misused to spy on activists, journalists, and human rights defenders, indicating a failure in the design phase where the intended purpose was not adhered to [60347]. (b) The software failure incident related to the operation phase is evident in how the Pegasus software was used to infiltrate individuals' devices through deceptive SMS messages containing malicious links. When the target clicked on the link, the software was inadvertently installed on their device, allowing the attacker to access files, control the camera and microphone, and monitor various applications like Gmail, WhatsApp, and Facebook [60347]. This operation failure occurred due to the successful execution of the deceptive operation tactics employed by the attackers, leading to the compromise of individuals' devices and privacy.
Boundary (Internal/External) within_system, outside_system (a) The software failure incident related to the Pegasus program can be categorized as within_system. The incident involved the exploitation of a zero-day vulnerability in the iOS operating system by the Pegasus spyware, allowing unauthorized access to smartphones and surveillance of individuals [60347]. The software itself was designed to infiltrate devices and monitor various aspects of a person's life through their smartphones, including calls, messages, emails, passwords, contacts, and calendars. Additionally, Pegasus could utilize the microphone and camera of the phones for surveillance purposes, turning the targeted phone into a hidden microphone [60347]. The software was specifically created by the NSO Group to be used by governments for monitoring purposes, but it was misused to target activists, journalists, and human rights defenders [60347].
Nature (Human/Non-human) human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident related to the Pegasus spyware was not due to non-human actions but rather due to intentional design and implementation by the NSO Group. The spyware was created to infiltrate smartphones and monitor various aspects of a person's life through their device, including calls, messages, emails, passwords, contacts, and calendars. The software was designed to exploit vulnerabilities in operating systems like iOS and Android to gain unauthorized access to devices and extract sensitive information [60347]. (b) The software failure incident occurring due to human actions: The software failure incident related to the Pegasus spyware can be attributed to human actions, specifically the actions of the NSO Group in creating and selling the spyware to governments. The NSO Group developed Pegasus with the intention of selling it exclusively to governments for the purpose of combating terrorism and criminal activities. However, the spyware was reportedly used by the Mexican government or corrupt entities within the federal administration to spy on activists, journalists, and human rights defenders, indicating misuse of the software by humans [60347].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The software Pegasus was designed to infiltrate smartphones and other devices to monitor various aspects of a person's daily life through their cell phone, including using the microphone and camera for surveillance [60347]. - Pegasus exploits a zero-day exploit in the iOS operating system called Trident, which allows the software to jailbreak the device and install itself [60347]. (b) The software failure incident related to software: - Pegasus is a spyware program created by the NSO Group for governments to monitor individuals, but it has been used to spy on activists, journalists, and human rights defenders [60347]. - The software Pegasus is delivered to targets through SMS messages containing malicious links that, when clicked, install the spyware on the device, allowing access to files, camera, microphone, and various applications [60347]. - Pegasus exploits security vulnerabilities in both iOS and Android devices to gain unauthorized access and control over the target's device [60347].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. The software Pegasus, created by the NSO Group, is a spyware designed to infiltrate smartphones and other devices to monitor individuals, including activists, journalists, and human rights defenders, without their consent. The software is used for espionage purposes by governments or corrupt groups within federal administrations to spy on individuals' daily lives, including calls, messages, emails, passwords, contacts, and calendars. It can even activate the microphone and camera of the targeted devices for surveillance [60347]. The software is distributed in a deceptive manner through SMS messages containing infectious links that, when clicked, install malicious software on the victim's device, granting the attacker access to sensitive information and control over the device's functionalities [60347]. (b) The software failure incident is not non-malicious as it involves intentional actions to infiltrate and spy on individuals, violating their privacy and security without their knowledge or consent.
Intent (Poor/Accidental Decisions) unknown The software failure incident described in the articles is not related to poor decisions or accidental decisions. Instead, it involves intentional actions by the NSO Group to create and sell spyware software, Pegasus, to governments for the purpose of surveillance on specific targets such as activists, journalists, and human rights defenders. The incident is more about intentional misuse of technology for espionage purposes rather than failure due to poor or accidental decisions [60347].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not applicable in this case as the incident described in the article is not due to lack of professional competence by humans or the development organization. (b) The software failure incident described in the article is more related to accidental factors. The incident involves the use of spyware called Pegasus, which was created by the NSO Group for surveillance purposes but was allegedly misused by the Mexican government or a corrupt group within the federal administration to spy on activists, journalists, and human rights defenders [60347]. The misuse of the software to target individuals beyond its intended purpose of combating terrorism or criminal groups can be considered an accidental failure in terms of the software being used inappropriately.
Duration permanent The software failure incident described in the articles is more of a permanent nature. The incident involves the intentional use of the Pegasus software by the Mexican government or a corrupt group within the federal administration to spy on activists, journalists, and human rights defenders [60347]. The software, created by the NSO Group, is designed to infiltrate smartphones and other devices to monitor various aspects of a person's daily life, including calls, messages, emails, passwords, contacts, and calendars. It can even utilize the microphone and camera of the devices for surveillance, turning the targeted phone into a hidden microphone [60347]. Furthermore, the software operates by sending SMS messages containing malicious links to targets, which when clicked, infect the mobile device with malware allowing the attacker to access files, control the camera and microphone, and gather data from various applications like Gmail, WhatsApp, Skype, Facebook, and more [60347]. The software exploits security vulnerabilities in operating systems like iOS and Android, allowing for sophisticated surveillance without leaving traces of the hacker behind [60347]. Given the intentional and ongoing nature of the software's use for surveillance purposes, the software failure incident can be considered permanent as it is sustained by the deliberate actions of the entities using the software.
Behaviour value, other (a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and does not perform any of its intended functions [60347]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s) [60347]. (c) timing: The software failure incident does not involve the system performing its intended functions correctly, but too late or too early [60347]. (d) value: The software failure incident does involve the system performing its intended functions incorrectly, as it infiltrates smartphones to monitor personal details and allows unauthorized access to files, camera, and microphone [60347]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions [60347]. (f) other: The software failure incident involves the system behaving in a way not described in the options (a to e) as it is related to unauthorized surveillance and espionage activities conducted through the software [60347].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) People's data and privacy were impacted due to the software failure incident involving the Pegasus spyware created by NSO Group. The software allowed attackers to access all files stored on the device, control the camera and microphone of the phone, and gather data from various applications like Gmail, WhatsApp, Skype, Facebook, and Telegram [60347]. (e) unknown (f) unknown (g) unknown (h) The software failure incident had potential consequences discussed, such as the impact on activists, journalists, and human rights defenders who were targeted for surveillance using the Pegasus spyware. The software was designed to be used by governments to monitor individuals, but there were concerns about its misuse for spying on innocent individuals [60347]. (i) unknown
Domain government The software failure incident described in the article is related to the government industry. The failed system, Pegasus, was intended to support government entities, specifically the Mexican government or corrupt groups within the federal administration, for the purpose of espionage on activists, journalists, and human rights defenders [60347]. The software was designed to infiltrate smartphones and other devices to monitor various aspects of individuals' daily lives, including calls, messages, emails, passwords, contacts, and calendars. It could also access the microphone and camera of the targeted devices for surveillance purposes [60347]. The company behind the software, NSO Group, sells it exclusively to governments with the condition that it is used to combat terrorism, criminal groups, and drug cartels [60347]. The software was used to exploit security vulnerabilities in operating systems like iOS and Android to gain unauthorized access to devices and extract sensitive information [60347]. The incident involved significant financial transactions, with the manufacturer charging substantial fees for the use of the software [60347]. The software was used to target various individuals and organizations, including journalists, activists, and advocacy groups, indicating its primary focus on government-related surveillance activities [60347].

Sources

Back to List