Alright, let's add some substance to this Pegasus discussion. Contrary to what you might read, research into NSO has been going on for years and has involved a lot of great research groups (@citizenlab, @kaspersky, @Lookout, to name a few). It has also included leaks.
Folks are speculating about how we might know about the targets of Pegasus customers. NSO simultaneously claims that they don't know their customers targets but at the same time they know that none of the @AmnestyTech infections are real. Two obviously incompatible statements.
Assuming NSO doesn't have access to their customers targets, a list of targets of interest would have to come from a structural fault in the agent/exploit delivery infrastructure that NSO uses. We have a high-level view of how that system is architected.
A quick overview of how the solution works. The system is deployed on a customer site (usually one standing rack of servers) and provides multiple ways to infect targets (remote, local WAN, physical, etc). The customer-operator puts in a phone number and 'voila'.
NSO is selling the point-and-click outcome of what's actually a complex process. What the operator doesn't see is the testing of the phone number to see that it's valid(#1), fingerprinting the phone type/OS version(#2),generating a one-time delivery mechanism for exploit (#3)...
The one-click or zero-click exploit depends on what the cellular service provider allows (OTA vs SMS push) and what valid exploit NSO has on hand. These three points are important because that's where NSO most likely to (a)coincidentally see targets / (b)accidentally leak targets
For the visual learners in the back, the answer is somewhere in this red box.
What should we expect to see for these different scenarios (numbered above)?
(#1): One or more third-party HLR lookup service(s) used to validate phone numbers at time of being nominated for targeting (MOST LIKELY SOURCE OF THE LIST)
Note that NSO has basically said as much in their own early response–…
What would that (#1) list look like? Timestamped requests to check a broad swath of phone numbers for targeting including real victims, potential victims, incompatible phones, outdated numbers, old infections, etc. It would explain inflated numbers, broad base of customers, etc.
(#2): Depends on implementation specifics not spelled out by NSO. Likely an iframe/JS landing page hosted somewhere (AWS?)that serves as a precursor for attacks. If it's all the same for all customers, this is a second possible source but more likely to include IPs, not numbers.
(#3): NSO's own exploit delivery infrastructure. As I've mentioned before, offensive tooling providers have learned not to let their (not very bright)customers play with valuable exploits themselves. They host infrastructure/portals that do the exploit weaponizing for them.
At (#3) is where NSO is likely to have an opportunity to validate if the targets are real. They would also have the opportunity to make sure they purge that information on their end. While it's possible that targeting info could leak from here, I consider it less likely.
Alternatively, if you want to lend credence to NSO's rebuttals, remember that there are years of publications and forensic investigations on Pegasus infections in UAE and Mexico (to name a few) that can't be waved away.
I really hope this quells some of the uncertainty around this issue and allows folks to focus on the real issues happening with the for-profit sale of unregulated surveillance technologies to countries with no legal framework nor good track record for human rights.
(Source: Leaked Pegasus Marketing Material circa 2019-… )

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with J. A. Guerrero-Saade

J. A. Guerrero-Saade Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @juanandres_gs

22 Jul
The new cybertruthers have come out the play.
Please beware the false parity of 'experts'. Random technical ppl aren't sources on difficult threat intel topics. Open speculation isn't substantiation for denials ('More details plz'). And neither is technical solipsism ('Everything can be faked! I'd do better than this!').
This uncoordinated flailing is being used to substantiate state interests that would rather not have the spotlight shined on them. We'll all do well to display sound judgement.
Read 4 tweets
18 Jul
As to NSO’s blanket denial of having any access to how their customers use their software, that’s not entirely true by design —they manage the exploit delivery infrastructure for their clients. This is a hard-earned lesson from the HackingTeam days—
HT had a lot of woes attempting to idiotproof their payload building and exploit delivery process. The former was characterized by a prompt urging operators NOT to upload to VT (aimed primarily at dim Saudi operators). Exploits were handled more carefully via support portal—
The support portal required a backdoor created with the HT masternode and a lure document of the customer’s choosing. HT would create the exploit-laced file and host it via a one-time link that the operators could deliver in the method of their choosing.
Read 5 tweets
18 Jul
Unbelievable work by @AmnestyTech, done in spite of @Apple’s reticence to provide means to verify the integrity of iOS devices. What’s it going to take for Apple to stop burying its head in the sand?
These remarks on the limitations when inspecting iOS devices should give us pause… there’s a mistaken belief that privacy is protected by limiting checks on system integrity and correlation of anomalies. What privacy is protected in these cases? (@tim_cook @radian)
I love Apple products. Wonderful things are regularly done under the hood to increase the cost of attack. But it’s clearly not enough to tinker with security engineering alone. Plenty of unscrupulous actors are finding it affordable and we can’t even tell how big that iceberg is.
Read 5 tweets
31 Dec 19
Ok, I have to admit this @Apple vs. @CorelliumHQ business just doesn’t sit right with me. Let me @ @tim_cook and pretend to have some meaningful engagement regarding Apple’s larger security dilemma. #Thread
Everyone knows I’m a huge Apple fanboy. Until the cheese grater Mac Pro came out, I more or less had one of every apple product in my house (with some wiggle room). While I may gripe about missing function keys, there’s no system I’d rather use than MacOS and iOS.
I’ve also, at diverse points in my career, had the privilege to report ongoing APT campaigns directly to Apple alongside colleagues (h/t @craiu) and was treated kindly by folks invested in securing the Apple ecosystem within the means available to them.
Read 14 tweets
29 Oct 19
Now that we’ve had some time to reflect, let’s break down the @NCSC & @NSAGov Turla advisory #thread…
1st point is that we (private sector threat intel researchers) mistook the provenance of Neuron and Nautilus. NCSC’s previous advisory denounced the use of both tools alongside Turla’s staple rootkit and we assumed new tools from the Turla devs but it seems they’d been stolen. Image
Keep in mind that the advisory is hinting at some dev access, some infrastructure access, but perhaps not complete access to Iran’s full operational stack. Turla first deploys the tool to their rootkit victims for testing and further functionality. Image
Read 17 tweets
26 Mar 19
Those non-existent norms were originally shattered by Flame subverting the actual Windows Update mechanism via an unheard of md5 collision to impersonate signing certs (implemented in its GADGET module).
For the curious:
@alexsotirov 's slides on the MD5 collision in Flame:…
And Kaspersky's analysis of the GADGET module:…
Flame really doesn't get the credit it deserves as the first public harbinger of so many trends we'd come to know all too well in cyberespionage over the following 7 years.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!