Thread by @iam_anandv

Irreversible pawning of the device. That is what Pegasus does. And also potential write access to your sensitive accounts.

Another story I co-wrote with @saikatd on @asiatimesonline on Pegasus.

asiatimes.com/2019/11/articl…

(Also some more interesting stuff. Thread follows)

@saikatd @asiatimesonline Link to the full WA petition which contains fascinating technical details and operational, financial details can be found here.

archive.org/details/NSO_Gr…

@saikatd @asiatimesonline The capabilities of pegasus particularly keylogging makes planting evidence on sensitive accounts a very simple process.

(In short, fully pawned)

@saikatd @asiatimesonline It can also survive a full factory reset. That means the device is infected for ever.

And the OS upgrades are also blocked but it looks like they happened. So are you sure that you are still running the patched version of WA?

@saikatd @asiatimesonline Operational details - Govt approved Fake Identity for the phone numbers and SIMs purchased 😃

@saikatd @asiatimesonline Tripartite agreement - NSO and Reseller (Ghana Contract)

And Reseller with Govt agency.

If this is the model, then there are more parties who have access to the extracted data.

@saikatd @asiatimesonline As to why the reseller is required, just look at the amount of hardware that needs to be assembled and maintained. For easier (and standard) to offload this to a local provider.

@saikatd @asiatimesonline There is a reason why I think CERT is useless. The operating cost of Pegasus is around $1.6M an year and Cert buys forensic equipment worth $8,000 (not a typo) an year. See
cert-in.org.in/PDF/Tender_Doc…

How will this even match up?

@saikatd @asiatimesonline All in all, we have a situation where, we just pretend that we have cyber security, but in reality, none exists.

#