The Israeli spyware, revealed to have been used to target hundreds of phones in India, has grown less reliant on clicks. Pegasus can infect a device without the target’s engagement or knowledge.
|| Nishica Choudhary
As per reports of some national and international news agencies there appeared on a leaked list of “potential” or actual targets for spying by the Israeli company NSO’s Pegasus spyware.
Recently, it has been reported that Pegasus, the malicious software, has allegedly been used to secretly monitor and spy on an extensive host of public figures in India.
As per claims, at least a 1,000 Indian phone numbers are in a list of potential targets of surveillance using the Pegasus spyware sold by Israeli company the NSO Group to “vetted governments” with the approval of the Israeli government.
What is Pegasus?
Built and marketed by Israeli company NSO, Pegasus is a spyware that infects device and spies on the victim by transferring data to a master server in an unauthorised manner. The company claims to sell it only to “vetted foreign government” worldwide.
Pegasus works by sending an exploit link, and if the target user clicks on the link, the malware or the code that allows the surveillance is installed on the user’s phone. A presumably newer version of the malware does not even require a target user to click a link. Once Pegasus is installed, the attacker has complete access to the target user’s phone.
Pegasus can “send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps”. The target’s phone camera and microphone can be turned on to capture all activity in the phone’s vicinity, expanding the scope of the surveillance.
What information can be compromised?
Once infected, a phone becomes a digital spy under the attacker’s complete control. Upon installation, Pegasus contacts the attacker’s command and control (C&C) servers to receive and execute instructions and send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls (even those via end-to-end-encrypted messaging apps).
The attacker can control the phone’s camera and microphone, and use the GPS function to track a target. To avoid extensive bandwidth consumption that may alert a target, Pegasus sends only scheduled updates to a C&C server.
The spyware is designed to evade forensic analysis, avoid detection by anti-virus software, and can be deactivated and removed by the attacker, when and if necessary.
Is Surveillance having legal backing?
There are legal provisions for intercepting communication and accessing digitally stored information in the interests of national security and public safety. The capture of a handheld machine by Pegasus turns that into a real-time spy on the target who can be watched over and followed every step. This surveillance is total, into their private and intimate lives, which have no bearing on any public interest.
Information obtained illegally may have been used to compromise institutions, to steal elections, sabotage Opposition campaigns, and even dislodge an Opposition government. Indian citizens were indeed targets of a vicious, abominable and uncivil surveillance campaign by a government entity, Indian or foreign.
Lack of awareness and specialists in digital security makes this a vulnerable sector. Terrorists and other anti-social elements have started using more of cyberspace which provides them with more getaways.
Cyber Security Framework in India:
Cyber security has become an integral aspect of national security. Moreover, its area of influence extends far beyond military domains to cover all aspects of a nation’s governance, economy and welfare.
With countries resorting to digital warfare and hackers targeting business organisations and government processes, India has to create awareness that not a single person or institution is immune to it. While the government and the corporate world are better placed perhaps to create their own programs, it is the civil society who needs to bring into this ambit.
Educational institutions including central universities, private universities, industry associations, Industrial Training Institutes (ITIs) must incorporate courses on cybersecurity. Given the future of technology under Industrial Revolution 4.0, India requires a strong cybersecurity framework based on the 4D principles i.e. Deter, Detect, Destroy and Document, so that it can sub verse all attempts towards any cyber challenges.
Given increasing dominance of mobile and telecommunication, both National cyber security policy and National Telecom Policy will have to effectively coalesce to make a comprehensive policy for 2030.
Conclusion:
The whole incident brought forward the issue of digital security and the ways to achieve it with minimum loopholes.
It is necessary to be self-aware about digital security because compromise in that could lead to a situation of total surveillance.
Setting stringent cybersecurity standards to protect individuals and institutions of national importance, to make sure that the unity of the nation and the integrity of the individuals stay safe and secure.
The largest democracy in the world cannot be at the mercy of a shady, private company.
[penci_related_posts dis_pview=”no” dis_pdate=”no” title=”Related Posts” background=”” border=”” thumbright=”no” number=”6″ style=”list” align=”none” withids=”” displayby=”cat” orderby=”date”]
