4 Tips to Safeguard from Pegasus Like Spyware

Kumar Sourav | Updated 17 Aug 2021 | 3 min read

The Pegasus expose is a revelation that has taken the world by storm lately. Governments around the world were using the software to spy on journalists, activists, leaders of the opposition, and other people in important constitutional roles. The scale of the spyware program is now laid bare, along with how client governments used the Israeli software.

The Flying Horse

Pegasus is spyware or malware created by the NSO Group, an Israeli firm founded in 2010. The spyware is designed to access your device and collect any data that the spyware handler wants from your smartphone. Pegasus was first discovered when a UAE-based human rights activist received several suspicious texts tainted with malicious links, later confirmed by the cybersecurity firm Citizen Lab.[ii] The links infected his iOS device with malware, and the attack was a very precise spear-phishing attack.

Pegasus is touted as the ultimate spyware that is effective on both iOS and Android devices, despite the claim that Apple devices provide the best possible data security. It does leave behind traces of its presence when a device is put under forensic investigation.

The software uses zero-day vulnerabilities in the OS, which are often sold for millions on the dark web or in the cybersecurity market, and developers often rush to fix such vulnerabilities. However, there are still some that are either never brought to light or discovered too late by the developers.

How to Keep Yourself SAFE

Keep your device updated. OS developers ship continuous patches and security updates to patch up vulnerabilities and bugs. These vulnerabilities and bugs are used by spyware and malware to get access to your device and collect sensitive and private data. By continuously updating your device, you keep the probability of spyware exploiting a vulnerability close to zero.
Be wary of phishing and spear-phishing attacks. While phishing attacks are generally recognizable because they are sent to a wider group of people and display some telltale signs, spear-phishing is much more targeted and personalized. Spear-phishing attacks are designed based on your preferences, work, and life and can seem like a regular text message, whether via SMS or any other text platform and contain a link you might be expecting. Such links can be malicious and can lead to the infection of your device. Always vet a link you receive from an unknown or untrusted source and if possible, avoid them all.
Switch to a different device. Once your device is infected it's not easy to get rid of it, so if possible, switch to a different SIM too. You can also use a cloned sim provided by your telecom service provider for your new device. A new device then gives you the possibility of keeping all your data and personal communication safe.
Use third-party toolkits to check your device. These can be used to inspect whether its security has been breached or not. It is also important for users, antivirus companies, and OS as well as software creators to share information regarding various bugs and vulnerabilities in the OS and apps that people use.

Post-COVID19, conversations around what governments must do to prevent cybercrimes are gaining momentum. However when governments themselves are alleged to perpetrate such acts, one must be extra cautious. While NSO claims that it vets the needs of clients before selling them software, they admitted that their clients had used the software for "other purposes" as well.

While a regular person may not be susceptible to state-sponsored surveillance like Pegasus, we are vulnerable to malicious actors who use other, more malicious software to collect sensitive and personal data. This can be used to cause financial loss or theft of identity. Spyware can take control of your device and cause considerable damage without you even noticing, and as such, it is a smart choice to take all precautionary steps you can to defend against malware and spyware alike.