Such abilities can fetch millions of dollars on the underground market for hacking tools, where governments are not regulators but are clients and are among the most lucrative spenders.
APPLE SECURITY UPDATE CLOSES SPYWARE IWATCHES FULL
But NSO’s zero-click capability meant victims received no such prompt, and the flaw enabled full access to a person’s digital life. In the past, victims learned their devices were infected by spyware only after receiving a suspicious link texted to their phone or email, and sharing the link with journalists or cybersecurity experts. It signals a serious escalation in the cybersecurity arms race, with governments willing to pay whatever it takes to spy on digital communications en masse, and with tech companies, human rights activists and others racing to uncover and fix the latest vulnerabilities that enable such surveillance.Īlso read | Smart glasses made google look dumb. The discovery means that more than 1.65 billion Apple products in use worldwide have been vulnerable to NSO’s spyware since at least March.
“This spyware can do everything an iPhone user can do on their device and more,” said John Scott-Railton, a senior researcher at Citizen Lab, who teamed up with Bill Marczak, a senior research fellow at Citizen Lab, on the finding. Using the zero-click infection method, Pegasus can turn on a user’s camera and microphone, record messages, texts, emails, calls - even those sent via encrypted messaging and phone apps like Signal - and send them back to NSO’s clients at governments around the world.