Pegasus Spyware Targets Jordanian Civil Society in Wide-Ranging Attacks

By Robert Lemos for Dark Reading
Monday, February 5, 2024

• 843
• 1
• More

The individuals are the latest to be targeted by governments with the NSO Group's surveillance software. In September, for example, Pegasus spyware was detected on the phone of an exiled Russian journalist, apparently installed with a zero-click exploit (one that requires no action by the user). In December 2022, a group of nearly two dozen journalists in El Salvador sued the NSO Group for its part in surveillance of the reporters.

Governments are using the software to target critics and activists without due process, says Ilia Kolochenko, founder of ImmuniWeb, a penetration testing service provider.

"Journalists and lawyers are commonly protected from overly intrusive investigations by the virtue of criminal procedure or another legislation that was not specifically designed to offer robust protection from cyber investigations," he says, adding: "The Middle East traditionally had less privacy related legislation; however, now the situation [is] rapidly changing."

Policy Needed, But Technology Can Help

The NSO Group spokesperson points to its 2023 Transparency and Responsibility Report to highlight its criteria in allowing sales of software to the governments of specific nations.

"We help government intelligence and law enforcement agencies lawfully address their most pressing national security and public safety issues," the report stated, pointing to the terrorist attacks on Israel by Hamas as an example of the type of incident the company is trying to prevent. "Cyber intelligence technology is a critical tool for preventing and investigating terrorism and serious crimes, and for thereby protecting individuals' fundamental rights to life, liberty, and security."

For the most part, better policy is needed to rein in the use of spyware and exploits against individual users. The targeting of journalists, lawyers, and activists for exercising free speech shows that additional protections need to be put in place, says ImmuniWeb's Kolochenko.

"It's a cat-and-mouse game — privacy technologies will continually improve but cybersecurity experts or hackers will continually bypass them," he says. "I would rather implement protection on the legislative layer, ensuring a transparent and efficient supervision of cyber operations by law enforcement agencies that would both protect confidential information about investigations and ensure due process."

While the NSO Group has found ways — and bought exploits on secondary markets — to get around smartphone and computer defenses, keeping devices up-to-date and remaining vigilant of links and attachments can make the devices much harder to compromise, he says. Read Full Article