Category Archives: Spying

image_pdfimage_print

Ivanti Zero-Day Flaws: Comprehensive Guide to Secure Your Systems Now

Digital representation of Ivanti Zero-Day Flaws threatening cybersecurity in a futuristic cityscape

Ivanti Patches Two Critical Zero-Day Vulnerabilities, One Under Active Attack

Ivanti, a leader in endpoint and network management solutions, has patched two critical zero-day vulnerabilities, one of which was actively exploited by cybercriminals. Learn more about these vulnerabilities and how to protect your organization.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

This sentence is under a slider that shows similar topics on the zero day.

The Ivanti zero-day flaws, written by Jacques Gascuel, inventor of cybersecurity solutions, of cyber-safety of sensitive data and of counter-espionage, deal with the subject of the Ivanti Zero Day 2024 vulnerabilities.

What are Zero-Day Flaws and Why are They Dangerous?

A zero-day flaw is a previously unknown vulnerability in software that hackers can exploit before the vendor becomes aware and devises a patch. These vulnerabilities are particularly perilous because there is no existing defense against their exploitation. Cybercriminals can use zero-day flaws to launch sophisticated cyberattacks, leading to unauthorized data access, system damage, and widespread security breaches.

Ivanti’s Two Zero-Day Vulnerabilities: CVE-2024-21888 and CVE-2024-21893

Ivanti’s announcement highlights two specific vulnerabilities:

  • CVE-2024-21888: This is a critical privilege escalation vulnerability found in the web components of Ivanti Connect Secure and Policy Secure (versions 9.x, 22.x). It allows malicious users to gain administrator privileges, thereby obtaining the ability to alter system configurations, access restricted data, and potentially introduce further malicious code into the network infrastructure.
  • CVE-2024-21893: Identified as a server-side request forgery (SSRF) flaw within the SAML component of Ivanti Connect Secure, Policy Secure (versions 9.x, 22.x), and Ivanti Neurons for ZTA, this vulnerability enables attackers to bypass authentication mechanisms to access restricted resources. This flaw is particularly concerning due to its active exploitation, which suggests a targeted approach by cybercriminals to leverage this vulnerability for malicious purposes.

Ivanti has acknowledged the targeted exploitation of CVE-2024-21893 and expressed concerns over the potential for increased malicious activities following the public disclosure of these vulnerabilities.

How to Protect Your Organization from Ivanti’s Zero-Day Flaws

In response to the discovery of these vulnerabilities, Ivanti has taken swift action by releasing patches for the affected products, including specific versions of Connect Secure and ZTA. The company strongly advises a precautionary factory reset of devices before applying the patches to eliminate any lingering threats from the system. Additionally, Ivanti recommends importing a mitigation file named “mitigation.release.20240126.5.xml” as a temporary countermeasure against these vulnerabilities.

To safeguard against these vulnerabilities, organizations are urged to apply Ivanti’s patches immediately, conduct a factory reset of devices prior to patching, and adopt a proactive cybersecurity posture. This includes regular software updates, comprehensive user education on cybersecurity best practices, and the implementation of robust security measures such as firewalls, intrusion detection systems, and regular security audits.

The Impact of Ivanti’s Zero-Day Flaws on the Cybersecurity Landscape

Since the beginning of 2024, the cybersecurity community has witnessed the disclosure of six zero-day vulnerabilities within Ivanti’s product lineup, with half of them being actively exploited. A study conducted by Volexity found that more than 1,700 Ivanti devices have been compromised worldwide, including nearly 100 in France. These attacks have affected organizations from all sectors, including government agencies, Fortune 500 companies and cloud service providers .

CISA Issues Emergency Directive for Federal Agencies

The US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive. It requires all federal agencies to apply Ivanti’s patches and mitigations, and report any compromise to the CISA. This directive is important because it shows the urgency and the severity of the situation, and its implications for the national and international security.

Mandiant Identifies Bypass Technique and Webshell Deployment

Mandiant, a cybersecurity firm, has identified a technique that bypasses the mitigation file and allows the deployment of a custom webshell named BUSHWALK. This webshell works by injecting malicious code into the legitimate web pages of Ivanti devices, and allows the attackers to execute commands and access files on the compromised systems. Mandiant has provided a detailed description of how this webshell works, how to detect it, and how to remove it. Mandiant has also clarified that this technique is distinct from the mass exploitation that followed the disclosure of the vulnerabilities.

UNC5221: The Threat Group Behind the Targeted Exploitation

Mandiant has also attributed the exploitation of the Ivanti zero-day flaws to a threat group named UNC5221, suspected to be linked to China. This group has targeted organizations from various sectors, including government agencies, Fortune 500 companies and cloud service providers . Mandiant has also revealed the tools and the malware used by this group, such as BUSHWALK, BLOODHOUND, CHOPSTICK and SLIGHTPULSE. These tools and malware are designed to perform reconnaissance, lateral movement, credential theft and data exfiltration on the compromised networks.

The Number of Victims and the Potential Consequences

According to the latest reports from Volexity and Mandiant, more than 1,700 Ivanti devices have been compromised worldwide, including nearly 100 in France. The sectors most affected by these intrusions include government, finance, healthcare, education, and technology. The potential consequences of these intrusions include unauthorized data access, system encryption by ransomware, installation of backdoors for persistent access, and execution of malicious code. Such incidents can lead to significant financial losses, reputational damage, operational disruptions, and legal implications for the affected organizations.

EviCypher and EviPass: Innovative Technologies to Protect Yourself from the Zero-Day Flaws

Facing the threat of the Ivanti zero-day flaws, there are innovative solutions to protect yourself effectively. These are the EviCypher and EviPass technologies, developed by Freemindtronic, a company specialized in pocket cybersecurity.

EviCypher is a NFC device that allows you to encrypt and decrypt messages securely and anonymously. You just need to slide your EviCypher card behind your smartphone for the message to be encrypted or decrypted. The system uses individual encryption keys, stored offline, in a non-volatile and physically secure memory. Thus, even if the message is intercepted by an attacker who exploits an Ivanti zero-day flaw, he will not be able to read it without the corresponding key.

EviPass is a mobile application that allows you to manage your passwords and credentials securely and conveniently. You just need to scan your EviPass card with your smartphone to access your online accounts. The application uses an OpenPGP encryption algorithm, based on public and private keys. The private keys are stored offline, in a non-volatile and physically secure memory. Thus, even if an attacker manages to access a compromised Ivanti device, he will not be able to steal the passwords and credentials without the EviPass card.

These two solutions offer a high level of security, based on the principle of “Air Gap”, which consists of creating a physical and digital barrier between the data and the attackers. They are also easy to use, without requiring any specific knowledge in cybersecurity. They are compatible with all digital communication systems, including those that use Ivanti products. They are protected by international patents, and manufactured in Andorra by Freemindtronic.

EviPass NFC NFC and EviPass HSM PGP: Freemindtronic’s Technologies for Password Management

EviPass NFC NFC and EviPass HSM PGP are two technologies developed by Freemindtronic for password management. EviPass NFC NFC is a technology that uses NFC cards to store and access passwords and credentials. EviPass HSM PGP is a technology that uses hardware security modules (HSM) to store and access passwords and credentials using the OpenPGP encryption algorithm. Both technologies are integrated into the EviPass mobile application, which allows users to manage their passwords and credentials securely and conveniently.

EviCypher NFC HSM and EviCypher HSM PGP: Freemindtronic’s Technologies for Message Encryption

EviCypher NFC HSM and EviCypher HSM PGP are two technologies developed by Freemindtronic for message encryption. EviCypher NFC HSM is a technology that uses NFC cards and hardware security modules (HSM) to encrypt and decrypt messages. EviCypher HSM PGP is a technology that uses hardware security modules (HSM) to encrypt and decrypt messages using the OpenPGP encryption algorithm. Both technologies are integrated into the EviCypher NFC device, which allows users to encrypt and decrypt messages securely and anonymously.

PassCypher and DataShielder: Freemindtronic’s Products that Incorporate EviCypher and EviPass Technologies

PassCypher and DataShielder are two products designed and manufactured by Freemindtronic that incorporate the EviCypher and EviPass technologies. PassCypher is a NFC device that connects to your smartphone or computer and allows you to access your online accounts using the EviPass technology. DataShielder is a NFC device that connects to your smartphone or computer and allows you to encrypt and decrypt messages using the EviCypher technology. With these products, you can benefit from the EviCypher and EviPass technology to protect your passwords, credentials and messages.

To learn more about these solutions, you can visit the Freemindtronic website or the Codeur blog, which present the features and benefits of EviCypher and EviPass.

Conclusion

In conclusion, the Ivanti zero-day flaws are dangerous vulnerabilities that can compromise the security and confidentiality of the users’ data. It is therefore important to protect yourself effectively against these flaws, by applying the patches provided by Ivanti, following the cybersecurity recommendations, and using innovative solutions like EviCypher and EviPass, developed by Freemindtronic. These solutions are integrated into innovative products, designed and manufactured in Andorra. Don’t wait any longer to protect yourself from the Ivanti zero-day flaws, and discover the EviCypher and EviPass solutions from Freemindtronic. What are your impressions on these products? Let us know in the comments below.

How to protect yourself from stalkerware on any phone

Woman holding a smartphone with a padlock icon on the screen, promoting protection from stalkerware.

How to Protect Yourself from Stalkerware

How to protect yourself from stalkerware: In today’s digital landscape, being mindful of stalkerware’s escalating threat is crucial. Take proactive measures to safeguard your privacy. Stalkerware, a malware type, lets unauthorized individuals stealthily monitor and control your smartphone.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

To learn more about the potential dangers of stalkerware spyware.” Stay informed by browsing our constantly updated topics

How to Protect Yourself from Stalkerware written by Jacques Gascuel, the innovator behind advanced sensitive data security and safety systems, provides priceless knowledge on the topic of data encryption and decryption. Are you prepared to enhance your comprehension of data protection?

What is Stalkerware and Why is it Dangerous?

Stalkerware, including known programs like FlexiSpy, mSpy, and Spyera, tracks your location and accesses calls, messages, and photos. These programs can secretly activate your camera or microphone. To counter these invasions, safeguard your digital privacy from stalkerware. Physical access or being tricked into clicking malicious links; often in phishing emails, leads to stalkerware installation.

Who Uses Stalkerware?

Furthermore, abusive partners, stalkers, employers, or governments often use stalkerware. They exploit tools like FlexiSpy or Spyera to gain unauthorized access to personal information, track whereabouts, or monitor online activities.

How to Detect and Remove Stalkerware from Your Phone

To detect stalkerware, check for unusual apps or files. Monitor your phone bill for spikes in data usage or unexpected charges. Be cautious about what you click on, and keep your phone and apps updated. Consider well-known antivirus or security apps like Malwarebytes; Kaspersky Internet Security for added protection.

Signs of Stalkerware Infection

To detect stalkerware, you can follow these steps:

  • Check for unusual apps or files: If you notice any unfamiliar apps or files on your phone, it could be a sign that stalkerware is installed. Be sure to check the permissions for any apps you don’t recognize and uninstall any that seem suspicious.
  • Monitor your phone bill: Unusual spikes in data usage or unexpected charges could signal stalkerware installation. Contact your phone carrier to investigate.
  • Be cautious about what you click on: Don’t click on links or open attachments from unknown senders, as these could be used to install stalkerware on your phone.
  • Keep your phone and apps updated: Make sure your phone’s operating system and apps are up to date with the latest security patches. These updates often include fixes for vulnerabilities that could be exploited by stalkerware or other malware.
  • Use a reputable antivirus or security app: Antivirus and security apps can help to detect and remove stalkerware, as well as protect you from other types of malware.

In case you suspect the presence of stalkerware on your phone, you may attempt to remove it using one of the aforementioned methods. However, if you are not comfortable doing this yourself, you can take your phone to a professional for help.

Steps to Remove Stalkerware

  • Backup your data first
  • Perform a factory reset on your device
  • Change all your passwords post-reset

Protecting Sensitive Data from Stalkerware

Fortifying Sensitive Data with Freemindtronic’s Solutions

In the battle against stalkerware, safeguarding your sensitive data is paramount. Freemindtronic, an innovative Andorran cybersecurity company, offers cutting-edge solutions that not only protect your privacy but also fortify your data against prying eyes. Leveraging contactless encryption through an NFC hardware security module (HSM) and other secure storage media, these solutions make your secrets virtually inaccessible to tracking software.

EviCypher NFC HSM This module secures encryption keys from an externalized source, ensuring the protection of data on NFC devices. Its robust security shields against stalkerware and other cyber threats.

EviCypher HSM OpenPGP: Versatile and adaptable, it creates an HSM across various storage types, supporting keychains, keystores, SD, and USB OTG keys. Compliant with encryption standards and the OpenPGP encryption standard, it safeguards a wide array of sensitive data, including emails, documents, and photos.

EviPass: A hardware password manager that securely stores your passwords within a tamper-proof device, making it exceedingly difficult, if not impossible, for tracking software to pilfer your passwords from an NFC HSM or HSM PGP.

EviOTP: This OTP token manager, housed within an NFC HSM or HSM PGP, generates one-time passwords (TOTP or HOTP) for two-factor authentication. This additional layer of physical security thwarts token exploitation, fortifying the protection of your online accounts.

Seamless Integration Across Product Lines

Freemindtronic solutions provide an additional layer of defense against spyware and seamlessly integrate into various products.

Integration of Password Manager Technology

For instance, EviPasse HSM HSP, an advanced password manager technology, integrates seamlessly into the PassCypher HSM PGP product. It ensures the security of identification and authentication secrets in computer systems.

Enhanced NFC Security

Similarly, EviPass NFC HSM technology seamlessly embeds into the PassCypher NFC HSM product, securing NFC Android phones via NFC HSM.

Strengthening Authentication Security

Moreover, PassCypher NFC HSM takes it a step further by incorporating EviOTP technology to bolster the security of 2FA double authentication tokens on phones and computers.

Data Encryption Without Contact

EviCypher NFC HSM technology plays a vital role as an encryption key manager in DataShielder NFC HSM products. It enables users to encrypt sensitive email, SMS, MMS, and RCS data without contact. This offers effective protection against spyware like Stalkerware. Users physically outsource secrets from their phones or computers, ensuring data security against cyber threats.

Cornerstone of Data Security

As for EviCypher HSM PGP technology, it serves as the cornerstone of the DataShielder HSM PGP product on computer systems. It is also compatible with DataShielder NFC HSM. This simultaneous security ensures sensitive information on both phones and computers.

Comprehensive Security Suite

Finally, for ultimate versatility and mobility, DataShielder Defense, designed for civil and military use, encompasses these technologies and many others. This comprehensive suite strengthens data protection against physical and software espionage, identity theft, corruption of sensitive data, illicit extraction of secrets, and other threats. Thanks to its interoperability and backward compatibility, it works on all existing computer and telephone systems, with or without NFC.

How to Prevent Stalkerware from Infecting Your Phone

To prevent stalkerware from infecting your phone, you can follow these steps:

  • Be cautious about who has access to your phone: Don’t let people borrow your phone or have physical access to it if you don’t trust them.
  • Use strong passwords and security settings: Use a strong password, PIN, or biometric authentication to lock your phone and enable features like Find My Device or Find My iPhone in case your phone is lost or stolen.
  • Be careful what you click on: Be cautious of links or attachments that come from unknown or suspicious sources. Only download apps or files from trusted or official sources.
  • Keep your phone and apps updated: Make sure your phone’s operating system and apps are up to date with the latest security patches. These updates often include fixes for vulnerabilities that could be exploited by stalkerware or other malware.
  • Install a reputable antivirus or security app: Antivirus and security apps can help to protect your phone from stalkerware and other types of malware.

Consequently, following these steps helps protect against stalkerware.

If you suspect that you may have stalkerware installed on your device, look for these signs:

  • Sudden battery drain or overheating
  • Device turning on or off by itself or behaving strangely
  • Unusual spikes in data usage or unexpected charges on your phone bill
  • Unrecognized apps or files appearing on your device
  • Strange or unwanted messages, calls, or emails from unknown numbers or addresses
  • A sense that someone knows too much about your activities, location, or conversations

Detecting and Eliminating Stalkerware

Suspecting stalkerware’s presence calls for swift action to safeguard your privacy and security. Implement these steps:

  • Rely on Reputable Antivirus or Security Apps: Utilize antivirus or security apps like Malwarebytes, Kaspersky Internet Security, or Avast Mobile Security to detect and remove stalkerware.

  • Unmask Anomalous Apps or Files: If unfamiliar apps or files appear, suspect stalkerware’s presence. Scrutinize permissions for unrecognizable apps and uninstall those deemed suspicious.

  • Monitor Phone Bill for Unusual Activity: Detecting spikes in data usage or unexpected charges on your phone bill might indicate stalkerware. Investigate with your phone carrier.

  • Practice Caution with Clicks: Avoid clicking on links or opening attachments from unknown senders, as these might harbor stalkerware.

  • Stay Updated: Regularly update your device’s operating system and apps. Updates often include security patches that shield you from stalkerware.

  • Empower Yourself and Others: Educate yourself about stalkerware

Prevention is Crucial

To safeguard against stalkerware, focus on prevention. Here are some key tips:

  • Be cautious about who has access to your device: Don’t let people borrow your device or have physical access to it if you don’t trust them.
  • Use strong passwords and security settings: Use a strong password, PIN, or biometric authentication to lock your device and enable features like Find My Device or Find My iPhone in case your device is lost or stolen.
  • Be careful what you click on: Be cautious of links or attachments that come from unknown or suspicious sources. Only download apps or files from trusted or official sources.
  • Keep your device and apps updated: Make sure your device and all of your apps are up to date with the latest security patches and updates. This will help to protect against vulnerabilities that could be exploited by stalkerware or other malware.
  • Install a reputable antivirus or security app: Antivirus and security apps can help to detect and remove stalkerware, as well as protect you from other types of malware.

Resources for Stalkerware Victims

  • The Coalition Against Stalkerware: https://stopstalkerware.org/: The Coalition Against Stalkerware is an international organization that works to combat stalkerware. The coalition provides resources for victims of stalkerware, as well as advocates for stronger laws and regulations to protect people from stalkerware.
  • The National Network to End Domestic Violence: https://www.thehotline.org/: The National Network to End Domestic Violence is a US-based organization that provides resources for victims of domestic violence, including information on stalkerware. The organization also has a hotline that victims can call for support.
  • The Cyber Civil Rights Initiative: https://cybercivilrights.org/: The Cyber Civil Rights Initiative is a US-based organization that works to protect people from online abuse, including stalkerware. The organization provides resources for victims of online abuse, as well as advocates for stronger laws and regulations to protect people from online abuse.

Latest Research

In recent years, researchers have discovered several new methods for using stalkerware. For example, a new variant of stalkerware called Cerberus is capable of infecting devices over Bluetooth. Cerberus can then be used to track the victim’s location, record their calls and conversations, and even take photos and videos of them without their knowledge.

New Laws and Regulations

Subsequently, governments worldwide are enacting new laws. For example, the European Union has adopted a new directive that criminalizes the use of stalkerware in the EU. The United States has also taken steps to combat stalkerware, such as creating a new task force to investigate the use of stalkerware.

New Resources Available for Stalkerware Victims

In addition to the steps you can take to protect yourself from stalkerware, there are also a number of resources available to help victims of stalkerware. These resources offer support, advice, and legal assistance.

Stalkerware Survivors Share Stories of Trauma and Resilience

Sarah, a victim of stalking by her ex-boyfriend, shares her story:

I discovered the stalkerware only after noticing unusual patterns like battery drain and phone restarts. My ex-boyfriend was tracking my location, reading my messages, and even listening to my phone calls, causing me fear and distress. After reporting the stalkerware to the company’s IT department, they removed it and took action against my former partner.

John, a victim of workplace surveillance, reveals his experience:

My boss installed stalkerware to monitor my work hours, emails, and phone calls, making me feel controlled and distrustful. Discovering the stalkerware led me to report it to the company’s IT department, which removed it and disciplined my boss. While still employed, I’m now more cautious about who I trust.

Maria, a victim of government surveillance, describes her ordeal:

Similarly, the government tracked my activities using stalkerware.Seeking help from a human rights organization, I filed a complaint, received legal assistance, and had the stalkerware removed. Continuing my fight for justice, I’m now empowered to speak up.

How to Protect Yourself from Stalkerware: A Summary

Stalkerware is a serious threat to privacy and safety. By being aware of the risks and taking steps to protect yourself, you can help to prevent yourself from becoming a victim.

Here are some additional tips to help you stay safe from stalkerware:

  • Be aware of the latest stalkerware trends: Stalkerware developers are constantly finding new ways to infect devices. It’s important to stay up-to-date on the latest trends so that you can protect yourself.
  • Talk to your friends and family about stalkerware: The more people who are aware of the risks, the less likely it is that you will become a victim.
  • Support legislation to combat stalkerware: There are a number of laws and regulations being proposed to combat stalkerware. By supporting these laws, you can help make using stalkerware more difficult.

Follow these guidelines to effectively protect yourself from stalkerware and potential harm.

The American Intelligence: How It Works

The American Intelligence How It Works : Section 702
Learn more about the American Intelligence written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

The American intelligence: a paradox

The American intelligence is powerful and influential, but also faces limits and challenges. Discover how it works, what are its consequences, and how to protect yourself from it.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board

Andorran law

Llei 26/2014 del 30 d’octubre de patents

Articles Crypto Currency Cryptocurrency Digital Security EviPass Technology NFC HSM technology Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

The American Intelligence: How It Works, Its Limits and Consequences

The American intelligence is one of the most powerful and influential in the world. It has a vast network of agencies, resources, and allies that enable it to collect, analyze, and act on information of strategic interest. However, the American intelligence also faces challenges and criticisms, both internally and externally. In this article, we will explore how the American intelligence works, what are its limits, and what are the consequences of its actions for the global security and privacy.

How the American Intelligence Works

The American intelligence is composed of 18 agencies that form the Intelligence Community (IC). These agencies are divided into two categories: the civilian agencies, which are under the supervision of the Director of National Intelligence (DNI), and the military agencies, which are under the supervision of the Secretary of Defense.

The main civilian agencies are:

  • The Central Intelligence Agency (CIA), which is responsible for collecting, analyzing, and disseminating foreign intelligence, as well as conducting covert operations and paramilitary activities.
  • The National Security Agency (NSA), which is responsible for collecting, processing, and disseminating signals intelligence (SIGINT), as well as conducting cyber operations and protecting the US government’s communications and information systems.
  • The Federal Bureau of Investigation (FBI), which is responsible for collecting, analyzing, and disseminating domestic intelligence, as well as conducting counterintelligence, counterterrorism, and law enforcement activities.
  • The National Geospatial-Intelligence Agency (NGA), which is responsible for collecting, analyzing, and disseminating geospatial intelligence (GEOINT), which includes imagery, maps, and other geographic information.
  • The National Reconnaissance Office (NRO), which is responsible for designing, launching, and operating reconnaissance satellites and other space-based systems that provide intelligence to the IC and the Department of Defense (DoD).
  • The Office of the Director of National Intelligence (ODNI), which is responsible for overseeing, coordinating, and integrating the activities of the IC, as well as providing strategic guidance and support to the DNI.

The main military agencies are:

  • The Defense Intelligence Agency (DIA), which is responsible for providing military intelligence to the DoD and the IC, as well as conducting human intelligence (HUMINT), counterintelligence, and defense attaché activities.
  • The National Security Agency/Central Security Service (NSA/CSS), which is responsible for providing SIGINT and cyber support to the DoD and the IC, as well as conducting information assurance and cryptologic activities.
  • The National Geospatial-Intelligence Agency (NGA), which is responsible for providing GEOINT support to the DoD and the IC, as well as conducting geospatial analysis and mapping activities.
  • The National Reconnaissance Office (NRO), which is responsible for providing space-based intelligence support to the DoD and the IC, as well as conducting satellite reconnaissance and surveillance activities.
  • The Military Intelligence Corps (MI), which is responsible for providing tactical and operational intelligence to the Army and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
  • The Office of Naval Intelligence (ONI), which is responsible for providing maritime intelligence to the Navy and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
  • The Marine Corps Intelligence Activity (MCIA), which is responsible for providing intelligence to the Marine Corps and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
  • The Air Force Intelligence, Surveillance, and Reconnaissance Agency (AFISRA), which is responsible for providing intelligence to the Air Force and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.

The American intelligence works by collecting information from various sources, such as human sources, signals, images, open sources, and others. It then analyzes this information to produce intelligence products, such as reports, assessments, briefings, and forecasts. These products are then disseminated to the relevant consumers, such as the President, the Congress, the military, the policy makers, and the allies. The American intelligence also acts on the information it collects, by conducting operations, such as covert actions, cyber attacks, drone strikes, and special operations.

The Limits of the American Intelligence

The American intelligence, despite its capabilities and resources, is not omnipotent or infallible. It faces several limits and challenges, such as:

  • Legal and ethical limits: The American intelligence is bound by the laws and regulations of the US and the international community, as well as by the values and principles of the American democracy. It must respect the rights and liberties of the American citizens and the foreign nationals, as well as the sovereignty and interests of the other countries. It must also abide by the oversight and accountability mechanisms of the executive, the legislative, and the judicial branches, as well as the public opinion and the media. The American intelligence must balance its need for secrecy and effectiveness with its duty for transparency and legitimacy.
  • Technical and operational limits: The American intelligence is limited by the availability and reliability of the information it collects, as well as by the accuracy and timeliness of the analysis it produces. It must deal with the challenges of information overload, data quality, data security, data privacy, and data sharing. It must also cope with the threats and risks of cyber attacks, counterintelligence, deception, and denial. The American intelligence must balance its need for innovation and adaptation with its need for standardization and coordination.
  • Strategic and political limits: The American intelligence is limited by the complexity and uncertainty of the global environment, as well as by the diversity and dynamism of the actors and issues it faces. It must deal with the challenges of globalization, multipolarity, regionalization, and fragmentation. It must also cope with the threats and opportunities of terrorism, proliferation, rogue states, failed states, and emerging powers. The American intelligence must balance its need for anticipation and prevention with its need for reaction and intervention.

The Consequences of the American Intelligence

The American intelligence has significant consequences for the global security and privacy, both positive and negative, such as:

  • Positive consequences: The American intelligence contributes to the protection and promotion of the national security and interests of the US and its allies, as well as to the maintenance and enhancement of the international peace and stability. It provides valuable information and insights to the decision makers and the operators, as well as to the public and the media. It also conducts effective operations and actions to deter, disrupt, or defeat the adversaries and the threats. The American intelligence plays a key role in the global intelligence cooperation and coordination, as well as in the global governance and leadership.
  • Negative consequences: The American intelligence also poses risks and challenges to the security and privacy of the US and its allies, as well as to the international order and norms. It may collect, analyze, or disseminate information that is inaccurate, incomplete, or biased, leading to errors, failures, or controversies. It may also conduct operations or actions that are illegal, unethical, or counterproductive, leading to violations, scandals, or backlashes. The American intelligence may face competition or conflict with the other intelligence services or actors, as well as with the other stakeholders or interests.

Section 702 of FISA: A Surveillance Without Control

  • On July 17, 2008, the US Congress passed section 702 of the FISA (Foreign Intelligence Surveillance Act), which authorizes the US intelligence agencies to collect the electronic communications of non-Americans located abroad, without a warrant from the FISA judge.
  • On January 19, 2018, the US Congress extended section 702 of FISA until December 31, 2023, without making any substantial changes.
  • On March 22, 2023, the US Congress extended section 702 of FISA again until April 19, 2024, without making any significant changes.
  • On December 16, 2023, the US Congress approved the National Defense Authorization Act (NDAA), which included a four-month extension of section 702 of FISA, avoiding its expiration at the end of the year.

The Violation of the Right to Privacy

  • On June 5, 2013, the whistleblower Edward Snowden revealed the existence of the PRISM program, which allowed the US intelligence agencies to access the data of the users of the main electronic service providers, such as Google, Facebook, Microsoft or Apple.
  • On October 6, 2015, the Court of Justice of the European Union (CJEU) invalidated the Safe Harbor, an agreement that allowed the transfer of personal data between the European Union and the United States, considering that it did not offer an adequate level of protection.
  • On July 16, 2020, the CJEU invalidated the Privacy Shield, the successor of the Safe Harbor, for the same reasons, considering that the risk of interference by the US intelligence services in the transferred data was incompatible with the respect of the fundamental rights of the persons concerned.
  • On July 31, 2023, the CJEU issued a ruling that confirmed the invalidity of the Privacy Shield and imposed strict conditions for the transfer of personal data to third countries, especially the United States, under the standard contractual clauses (SCCs) or the binding corporate rules (BCRs).

The Legal and Political Consequences

  • On October 24, 2013, the European Parliament adopted a resolution that condemned the massive surveillance activities of the US intelligence services and called for the suspension of the cooperation agreements on security and counter-terrorism.
  • On October 23, 2015, the European Parliament adopted another resolution that requested the creation of an independent international tribunal to examine the complaints of the European citizens regarding the surveillance of the US intelligence services.
  • On September 14, 2018, the European Parliament adopted a third resolution that called for the suspension of the Privacy Shield, due to the non-compliance of the commitments made by the United States on the protection of personal data.
  • On August 31, 2023, the European Parliament adopted a fourth resolution that asked the European Commission to propose a new legislation on the protection of personal data in the context of cross-border data flows, which would guarantee a level of protection equivalent to that of the general data protection regulation (GDPR).

Sources:

Congress passes temporary extension of FISA Section 702 surveillance program – Axios:

The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield:

FISA Section 702: What it is and why Congress is debating it – NBC News

New technologies and products that limit the possibilities of intelligence

Facing the capabilities of collection and analysis of the American intelligence, which threaten the privacy and sovereignty of individuals and countries, there are new technologies and products that allow to limit the possibilities of intelligence. These technologies and products use techniques of encryption, cryptography, blockchain or NFC to protect personal data and electronic communications. They offer an alternative to traditional solutions, which are often vulnerable to attacks or interceptions by the American intelligence. Among these technologies and products, we can mention:

  • EviCypher NFC HSM and EviCypher HSM OpenPGP, which are patented technologies in the United States in the field of cybersecurity developed by Freemindtronic SL Andorra, used in counter-espionage products such as DataShielder Defense. They allow to encrypt and decrypt data without contact, thanks to hardware security modules that use NFC technology. They offer compatibility with OpenPGP standards, operating without server, without database, with a very high level of flexibility from different removable, fixed and online and offline storage media including NFC HSM.
  • DataShielder DefenseDataShielder Defense, which is a counter-espionage product developed by Freemindtronic SL Andorra, which uses EviCore NFC HSM and EviCore HSM OpenPGP technologies to encrypt and decrypt all types of data and communication services. This product protects sovereign communications, by preventing the American intelligence from accessing personal, professional or state secrets. It also guarantees the sovereignty of users, by making their data anonymous and inviolable.
  • Signal, which is an instant messaging application that uses the Signal protocol, which is an end-to-end encryption protocol that ensures the confidentiality and integrity of messages. This application allows to communicate anonymously and securely, by avoiding the surveillance or censorship of the American intelligence.
  • Tor, which is a decentralized network that uses volunteer relays to route Internet traffic anonymously and encrypted. This network allows to browse the web without leaving traces, by hiding the IP address and location of users. It also allows to access hidden websites, which are not indexed by search engines.

These technologies and products represent examples of innovative solutions that limit the possibilities of the American intelligence and preserve the individual and collective sovereignty. They also illustrate the issues and challenges related to the use of digital technologies in the field of intelligence.

Conclusion

The American intelligence is a complex and dynamic phenomenon that has a significant impact on the world. It has many strengths and weaknesses, as well as many opportunities and threats. It has many achievements and failures, as well as many benefits and costs. It is a source of both security and insecurity, both privacy and surveillance. It is a subject of both admiration and criticism, both cooperation and confrontation. The American intelligence is a paradox that requires a careful and balanced approach.

Are fingerprint systems really secure? How to protect your data and identity against BrutePrint

Fingerprint Systems Really Secure - How to Protect Your Data and Identity
Fingerprint Systems Really Secure by Jacques Gascuel: This article will be updated with any new information on the topic.

Fingerprint Security

You will surely be amazed by our discoveries! These systems verify your identity on smartphones and other devices by using the unique patterns of your finger. But is their security level? In this study, we explore the weaknesses of these systems and how various actors, from cybercriminals to sovereign entities, can exploit them. We looked at 25 techniques for corrupting fingerprint authentication systems. We will also introduce an effective dual-use defense solution: DataShielder HSM solutions to protect your secrets and sensitive data even if this biometric authentication system becomes compromised.

Fingerprint Biometrics: An In-Depth Exploration of Security Mechanisms and Vulnerabilities

It is a widely recognized biometric authentication system for identity verification. In this overview of fingerprint authentication systems, we will explore comprehensively to understand the complex world of fingerprint biometrics. Our goal is to provide a detailed exploration of these systems, their inner workings, vulnerabilities, and countermeasures.

Demystifying Fingerprint Systems: A Thorough Examination

Two fundamental components make up these systems: the fingerprint sensor and the comparison algorithm.:

The Fingerprint Sensor: Where Biometric Data Begins

These systems rely on an essential component: the fingerprint sensor. It captures the finger image and converts it into a digital format. Different types of sensors exist, each with their advantages and disadvantages:

  1. Optical sensors: They use light and a camera to create a high-resolution image.
  2. Capacitive sensors: They use an array of small capacitors to measure the differences in electrical charge between the ridges and valleys.
  3. Ultrasonic sensors: They use sound waves to create a three-dimensional image.
  4. Thermal sensors: They detect the heat emitted by the finger to generate an image.

The Comparison Algorithm: The Gatekeeper of Access

The comparison algorithm is a critical software component that analyzes the captured fingerprint image. Its role is vital:

  • Image Analysis: The algorithm scrutinizes the fingerprint image, extracting its unique features.
  • Template Comparison: It then compares these features to one or more stored templates, serving as reference fingerprints for authorized users.
  • Threshold Criteria: Access is granted if the algorithm determines a significant similarity between the captured image and a stored template, surpassing a predefined threshold. If not, the system considers the fingerprint invalid and denies access.

Fingerprint System Vulnerabilities and Attack Techniques

First, before evaluating attack techniques against fingerprinting systems, let’s explore different attack types, techniques, motivations, and strategies. In our thorough analysis of fingerprint system vulnerabilities, we must acknowledge numerous attack techniques employed by various actors. These techniques, driven by diverse motivations ranging from personal gain to malicious intent, illuminate the complexities of fingerprint system security. We’ve identified a total of twenty-five (25) distinct attack types, categorized into five groups in this study: “Electronic Devices for Biometric Attacks,” “Additional Fingerprint Attacks,” “Advanced Attacks,” “Attacks on Lock Patterns,” and “Attacks on Fingerprint Sensors.”

Attacks on Fingerprint Sensors

Fingerprint sensors, a common biometric authentication method, are vulnerable to several attack types and techniques update 23 february 2024:

ATTACK TYPETECHNIQUEMOTIVATIONSSTRATEGIES
Residual Fingerprint AttackRecovers the smartphone owner’s fingerprint left on surfaces, reproducing it.Identity theft, unauthorized access, or malicious purposes.Exploits traces of fingerprints on surfaces using materials like gelatin, silicone.
Code Injection AttackInjects malicious code to bypass fingerprint sensor security.Compromises device security for data theft or illicit activities.Exploits software vulnerabilities for unauthorized access to biometric data.
False Acceptance AttackThe system accepts a fingerprint that doesn’t belong to the authorized user.Identity theft, unauthorized access, or malicious intentions.Can occur due to poor sensor quality, a high tolerance threshold, or similarity between different individuals’ fingerprints.
False Rejection AttackThe system rejects a fingerprint that belongs to the authorized user.Identity theft, unauthorized access.Can occur due to poor sensor quality, a low tolerance threshold, environmental changes, or alterations to the user’s fingerprint.
Substitution AttackTricks the system with an artificial fingerprint.Identity theft or unauthorized access.Can be done using materials like gelatin, silicone, latex, or wax.
Modification AttackTricks the system with a modified fingerprint.Identity theft or to conceal the user’s identity.Can be done using techniques like gluing, cutting, scraping, or burning.
Impersonation AttackTricks the system with another user’s fingerprint, either with their consent or by force.Identity theft using force, threats, bribery, or seduction.Uses the fingerprint of another user who has given consent or has been coerced into doing so.
Adversarial Generation AttackTricks the system with images of fingerprints generated by an adversarial generative adversarial network (GAN).Bypasses liveness detection methods based on deep learning.Mimics the appearance of real fingerprints.
Acoustic Analysis AttackTricks the system by listening to the sounds emitted by the fingerprint sensor during fingerprint capture.Can reconstruct the fingerprint image from acoustic signals.Use noise cancellation techniques, encrypt acoustic signals, or use liveness detection methods
Partial Print AttackTricks the system with a partial fingerprint from the registered fingerprint.Increases the false acceptance rate by exploiting the similarity between partial prints of different users.Can use a portion of the registered fingerprint.
Privilege Escalation AttackExploits vulnerabilities in the operating system or application to obtain higher privileges than those granted by fingerprint authenticationCan access sensitive data, manipulate system files, perform unauthorized actions, or bypass security measuresUse strong passwords, enforce multi-factor authentication, limit user privileges, patch system vulnerabilities, monitor user activities, and audit logs
Spoofing AttackImitates a legitimate fingerprint or identity to deceive the system or the userCan gain access, steal information, spread malware, or impersonate someone.Use liveness detection methods, verify the authenticity, avoid trusting unknown sources, and report spoofing attempts
PrintListener: Side-channel AttackUtilizes acoustic signals from finger friction on touchscreens to replicate fingerprintsGain unauthorized access to devices and services protected by fingerprint authenticationImplement noise interference, use advanced fingerprint sensors resistant to acoustic analysis, enable multifactor authentication, regularly update security protocols

For more information on new attack type “PrintListener” (a specific acoustic analysis attack), readers are encouraged to explore the detailed article at https://freemindtronic.com/printlistener-technology-fingerprints/.
These attacks expose vulnerabilities in fingerprint sensor technology and underline the need for robust security measures.

Attacks on Lock Patterns (For Lock Screen Authentication)

Lock patterns, often used on mobile devices for screen unlocking, are susceptible to various attack techniques:

ATTACK TYPETECHNIQUEMOTIVATIONSSTRATEGIES
Brute Force AttackAttempts all possible lock pattern combinations.Gains unauthorized device access.Systematically tests different pattern combinations.
Replica Fingerprint AttackUses a 3D printer to create a replica fingerprint.Unauthorized access or identity theft.Produces a replica for sensor authentication.
Sensor VulnerabilitiesExploits sensor technology vulnerabilities.Compromises device security for malicious purposes.Identifies and exploits sensor technology weaknesses.
BrutePrint AttackIntercepts messages, emulating the fingerprint sensor.Gains unauthorized access, often with hardware components.Exploits communication protocol vulnerabilities.

These attacks target the vulnerabilities in lock pattern authentication and underscore the importance of strong security practices.

Advanced Attacks

Advanced attacks employ sophisticated techniques and technologies to compromise fingerprint systems:

ATTACK TYPETECHNIQUEMOTIVATIONSSTRATEGIES
Presentation AttackPresents manipulated images or counterfeit fingerprints.Espionage, identity theft, or malicious purposes.Crafts counterfeit fingerprints or images to deceive sensors.
Rapid Identification AttackUses advanced algorithms to swiftly identify fingerprints.Corporate espionage, financial gain, or enhanced security.Quickly identifies fingerprints from extensive datasets.
Digital Footprint AttackCollects and analyzes the online data and activity of the target, using open source intelligence tools or data brokersCan obtain personal information, preferences, habits, or vulnerabilities of the target.Use privacy settings, delete unwanted data, avoid oversharing, and monitor online reputation

These advanced attacks leverage technology and data to compromise fingerprint-based security.

Network-Based Attacks

Network-based attacks are those that target the communication or data transmission between the device and the fingerprint authentication system. These attacks can compromise the integrity, confidentiality, or availability of the biometric data or the user session. In this section, we will discuss four types of network-based attacks: phishing, session hijacking, privilege escalation, and spyware.

ATTACK TYPETECHNIQUEMOTIVATIONSSTRATEGIES
Phishing AttackTechnique: Phishing attacks involve sending fraudulent messages to victims, enticing them to click on a link or download an attachment. These malicious payloads may contain code designed to steal their fingerprints or redirect them to a fake website requesting authentication.Motivations: Phishing attacks are motivated by the desire to deceive and manipulate users into revealing their fingerprint data or login credentials.Strategies: Phishing attackers employ various tactics, such as crafting convincing emails, spoofing legitimate websites, and using social engineering to trick users.
Session Hijacking AttackTechnique: Session hijacking attacks aim to intercept or impersonate an authenticated user’s session, exploiting communication protocol vulnerabilities or using spyware.Motivations: Session hijacking is typically carried out to gain unauthorized access to sensitive information or systems, often for financial gain or espionage.Strategies: Attackers employ packet sniffing, session token theft, or malware like spyware to compromise and take control of active user sessions.
Spyware AttackTechnique: Spyware attacks infect the device with spyware to capture fingerprint data.Motivations: Spyware attacks are driven by the objective of illicitly obtaining biometric data for malicious purposes, such as identity theft or unauthorized access.Strategies: Attackers use spyware to secretly record and transmit fingerprint information, often through backdoors or covert channels, without the victim’s knowledge.
Predator FilesInfects Android phones with a spyware application that can access their data, including fingerprint information.Sold to multiple governments for targeting political opponents, journalists, activists, and human rights defenders in over 50 countries.Use spyware detection and removal tools, update system software, avoid downloading untrusted applications, and scan devices regularly

As we can see from the table above, network-based attacks pose a serious threat to fingerprint authentication systems and users’ privacy and security. Therefore, it is essential to implement effective countermeasures and best practices to prevent or mitigate these attacks. In the next section, we will explore another category of attacks: physical attacks.

Electronic Devices for Biometric Attacks

Some electronic devices are designed to target and compromise fingerprint authentication systems. Here are some notable examples:

DeviceDescriptionUsageSTRATEGIES
Cellebrite UFEDA portable device capable of extracting, decrypting, and analyzing data from mobile phones, including fingerprint data. Used by law enforcement agencies worldwide.Used by law enforcement agencies to access digital evidence on mobile phones.Applies substances to damage or obscure sensor surfaces.
GrayKeyA black box device designed to unlock iPhones protected by passcodes or fingerprints using a “brute force” technique. Sold to law enforcement and government agencies for investigative purposes.Sold to law enforcement and government agencies for investigative purposes to unlock iPhones.Use strong passwords, enable encryption, disable USB access, and update system software.
Chemical AttacksAlters or erases fingerprints on sensors.Prevents identification or creates false identities.Use fingerprint enhancement techniques, verify the authenticity, and use liveness detection methods

These devices pose a high risk to biometric systems because they can allow malicious actors to access sensitive information or bypass security measures. They are moderate to high in ease of execution because they require physical access to the target devices and the use of costly or scarce devices. Their historical success is variable because it depends on the quality of the devices and the security of the biometric systems. They are currently relevant because they are used by various actors, such as government agencies, law enforcement, or hackers, to access biometric data stored on mobile phones or other devices. This comprehensive overview of attack types, techniques, motivations, and strategies is crucial for improving biometric authentication system security.

BrutePrint: A Novel Attack on Fingerprint Systems on Phones

Fingerprint systems on phones are not only vulnerable to spoofing or data breach attacks; they are also exposed to a novel attack called BrutePrint. This attack exploits two zero-day vulnerabilities in the smartphone fingerprint authentication (SFA) framework. BrutePrint allows attackers to bypass the attempt limit and liveness detection mechanisms of fingerprint systems on phones. It also enables them to perform unlimited brute force attacks until finding a matching fingerprint.

How BrutePrint Works

Fingerprint Systems Really Secure : BrutePrint

BrutePrint works by hijacking the fingerprint images captured by the sensor. It applies neural style transfer (NST) to generate valid brute-forcing inputs from arbitrary fingerprint images. BrutePrint also exploits two vulnerabilities in the SFA framework:

  • Cancel-After-Match-Fail (CAMF): this vulnerability allows attackers to cancel the authentication process after a failed attempt. It prevents the system from counting the failed attempts and locking the device.
  • Match-After-Lock (MAL): this vulnerability allows attackers to infer the authentication results even when the device is in “lock mode”. It guides the brute force attack.To perform a BrutePrint attack, attackers need physical access to the phone, a database of fingerprints, and a custom-made circuit board that costs about 15 dollars. The circuit board acts as a middleman between the sensor and the application. It intercepts and manipulates the fingerprint images.

How to Prevent BrutePrint

BrutePrint is a serious threat to phone users who rely on fingerprint systems to protect their devices and data. It shows that fingerprint systems on phones are not as secure as they seem. They need more robust protection mechanisms against brute force attacks. Some of the possible ways to prevent BrutePrint are:

  • Updating the phone’s software: this can help fix the vulnerabilities exploited by BrutePrint and improve the security of the SFA framework.
  • Using multifactor authentication: this can increase the level of security and reduce the risks of spoofing or brute force attacks. It combines fingerprint authentication with another factor, such as a password, a PIN code, a pattern lock screen ,or other trust criteria that allows patented segmented key authentication technology developed by Freemindtronic in Andorra .
  • Use of DataShielder HSM solutions: these are solutions developed by Freemindtronic in Andorra that allow you to create HSM (Hardware Security Module) on any device, without a server or database, to encrypt any type of data. DataShielder HSM solutions also include EviSign technology, which enables advanced electronic signing of documents. DataShielder HSM solutions are notably available in Defense versions, which offer a high level of protection for civil and/or military applications.

Assessing Attack Techniques: Ease of Execution and Current Relevance

In our pursuit of understanding fingerprint system vulnerabilities, it is crucial to assess not only the types and forms of attacks but also their practicality and current relevance. This section provides an in-depth evaluation of each attack technique, considering factors such as the ease of execution, historical success rates, and their present-day applicability.

Attack Techniques Overview

Let’s analyze the spectrum of attack techniques, considering their potential danger, execution simplicity, historical performance, and present-day relevance.

Attack TypeLevel of DangerEase of ExecutionHistorical SuccessCurrent Relevance
Residual Fingerprint AttackMediumModerateVariableOngoing
Code Injection AttackHighModerateVariableStill Relevant
Acoustic Analysis AttackMediumLowFluctuatingOngoing Concerns
Brute Force AttackHighLowVariableContemporary
Replica Fingerprint AttackMediumModerateFluctuatingStill Relevant
Sensor VulnerabilitiesHighModerateVariableOngoing Significance
BrutePrint AttackHighHighVariableContinues to Pose Concerns
Presentation AttackHighModerateDiverseStill Pertinent
Rapid Identification AttackHighLowVariableOngoing Relevance
Digital Footprint AttackHighLowFluctuatingCurrently Pertinent
Chemical AttacksHighLowVariableOngoing Relevance
Phishing AttackHighModerateVariableModern Threat
Session Hijacking AttackHighLowVariableOngoing Relevance
Privilege Escalation AttackHighLowVariableRemains Significant
Adversarial Generation AttackHighModerateVariableStill in Use
Acoustic Analysis Attack (Revisited)MediumLowFluctuatingOngoing Concerns
Partial Print AttackMediumLowVariableCurrently Relevant
Electronic Devices for Biometric AttacksHighModerate to HighVariableCurrently Relevant
PrintListener (Specific Acoustic Analysis Attack)HighModerateEmergingHighly Relevant

Understanding the Evaluation:

  • Level of Danger categorizes potential harm as Low, Moderate, or High.
  • Ease of Execution is categorized as Low, Medium, or High.
  • Historical Success highlights fluctuating effectiveness.
  • Current Relevance signifies ongoing concerns in contemporary security landscapes.

By assessing these attack techniques meticulously, we can gauge their practicality, historical significance, and continued relevance.

The type of attack by electronic devices for biometric systems is very dangerous because it can allow malicious actors to access sensitive information or bypass the protections of biometric systems. Its ease of execution is moderate to high, as it requires physical access to target devices and the use of expensive or difficult-to-obtain devices. Its historical success is variable because it depends on the quality of the devices used and the security measures implemented by the biometric systems. It is currently relevant because it is used by government agencies, law enforcement or hackers to access biometric data stored on mobile phones or other devices.

Statistical Insights into Fingerprint Systems

Fingerprint systems have found wide-ranging applications, from law enforcement and border control to banking, healthcare, and education. They are equally popular among consumers who use them to unlock devices or access online services. However, questions linger regarding their reliability and security. Let’s delve into some pertinent statistics:

According to Acuity Market Intelligence, 2018 saw more than 1.5 billion smartphones equipped with fingerprint sensors, constituting 60% of the global market.

The IAFIS Annual Report of 2020 revealed that more than 1.3 billion fingerprint records were stored in national and international databases in 2019.

According to the National Institute of Standards and Technology (NIST), the average false acceptance rate of fingerprint systems in 2018 was 0.08%, marking an 86% decrease compared to 2013.

These statistics shed light on the widespread adoption of fingerprint systems and their improved accuracy over time. Nevertheless, they also underline that these systems, while valuable, are not without their imperfections and can still be susceptible to errors or manipulation.

Real-World Cases of Fingerprint System Corruption: Phone Cases

Fingerprint system corruption can also affect phone users, who rely on fingerprint sensors to unlock their devices or access online services. However, these sensors are not foolproof and can be bypassed or exploited by skilled adversaries. These attacks can result in device theft, data breaches, or other security issues.

Here are some examples of fingerprint system corruption that involve phones:

  • German hacker Jan Krissler, alias Starbug, remarkably unlocked the smartphone of the German Defense Minister Ursula von der Leyen in 2014 using a high-resolution photo of her thumb taken during a press conference. He employed image processing software to enhance the photo’s quality and created a counterfeit fingerprint printed on paper.
  • A terrorist attack at the Istanbul airport killed 45 people and injured more than 200 in 2016. The investigators found that the three suicide bombers used fake fingerprints to enter Turkey and avoid security checks. They copied the fingerprints of other people from stolen or forged documents.
  • Researchers from Tencent Labs and Zhejiang University discovered in 2020 that they could bypass a fingerprint lock on Android smartphones using a brute force attack, that is when a large number of attempts are made to discover a password, code or any other form of security protection.
  • Experts from Cisco Talos created fake fingerprints capable of fooling the sensors of smartphones, tablets and laptops as well as smart locks in 2020, but it took them a lot of effort.
  • A case of identity theft was discovered in France in 2021, involving the use of fake fingerprints to obtain identity cards and driving licenses. The suspects used silicone molds to reproduce the fingerprints of real people, and then glued them on their fingers to fool the biometric sensors.
  • Researchers from the University of Buffalo developed a method in 2021 to create artificial fingerprints from images of fingers. These fingerprints can fool the sensors of smartphones, but also more advanced biometric systems, such as those used by police or airports.
  • A report by Kaspersky revealed in 2021 that banking apps on smartphones are vulnerable to attacks by falsified fingerprints. Attackers can use malware to intercept biometric data from users and use them to access their accounts.

These cases highlight the significant threats posed by fingerprint system corruption to phone users. Therefore, it is important to protect these systems against external and internal threats while integrating advanced technologies to enhance security and reliability.

DataShielder HSM: A Counter-Espionage Solution for Fingerprint System Security

You have learned in the previous sections that fingerprint systems are not foolproof. They can be corrupted by attacks that expose your secrets and sensitive data. To prevent malicious actors from capturing them, you need an effective and reliable encryption solution, even if your phone is compromised.

Freemindtronic, the leader in NFC HSM technologies, designed, developed, published and manufactured DataShielder HSM in Andorra. It is a range of solutions that you need. You can use either EviCore NFC HSM or EviCore HSM OpenPGP technology with DataShielder HSM. It lets you encrypt your data with segmented keys that you generate randomly yourself. The key segments are securely encrypted and stored in different locations. To access your secrets and your sensitive data encrypted in AES 256 quantum, you need to bring all segments together for authentication.

DataShielder HSM has two versions: DataShielder NFC HSM for civil and military use, and DataShielder NFC HSM Defense for sovereign use. DataShielder NFC HSM Defense integrates two technologies: EviCore NFC HSM and EviCore HSM OpenPGP. They allow you to create a hardware security module (HSM) without contact on any medium, without server, without database, totally anonymous, untraceable and undetectable.

DataShielder HSM is a user-friendly and compatible solution with all types of phone, with or without NFC, Android or Apple. It can be used for various purposes, such as securing messaging services, encrypting files or emails, signing documents or transactions, or generating robust passwords.

DataShielder HSM is a counter-espionage solution that enhances the security of fingerprint systems. It protects your data and secrets from unauthorized access, even if your fingerprint is compromised.

Current Trends and Developments in Fingerprint Biometrics

Fingerprint biometrics is a constantly evolving field. It seeks to improve the performance, reliability and security of existing systems. But it also develops new technologies and applications. Here are some current or expected trends and developments in this field.

  • Multimodality: it consists of combining several biometric modalities (fingerprint, face, iris, voice, etc.) to increase the level of security and reduce the risks of error or fraud. For example, some smartphones already offer authentication by fingerprint and facial recognition.
  • Contactless biometrics: it consists of capturing fingerprints without the need to touch a sensor. This technique avoids the problems related to the quality or contamination of fingerprints. And it improves the comfort and hygiene of users. For example, some airports already use contactless scanners to verify the identity of travelers.
  • Behavioral biometrics: it consists of analyzing the behavior of users when they interact with a biometric system. For instance, the way they place their finger on the sensor or the pressure they exert. This technique adds a dynamic factor to identification. And it detects attempts of impersonation or coercion. For example, some banking systems already use behavioral biometrics to reinforce the security of transactions.

Standards and Regulations for Fingerprint Systems

The use of fingerprint systems is subject to standards and regulations. They aim to ensure the quality, compatibility and security of biometric data. These standards and regulations can be established by international, national or sectoral organizations. Here are some examples of standards and regulations applicable to fingerprint systems.

  • The ISO/IEC 19794-2 standard: it defines the format of fingerprint data. It allows to store, exchange and compare fingerprints between different biometric systems. It specifies the technical characteristics, parameters and procedures to be respected to ensure the interoperability of systems.
  • The (EU) 2019/1157 regulation: it concerns the strengthening of the security of identity cards and residence permits issued to citizens of the European Union and their relatives. It provides for the mandatory introduction of two fingerprints in a digital medium integrated into the card. It aims to prevent document fraud and identity theft.
  • The Data Protection Act: it regulates the collection, processing and storage of personal data, including biometric data. It imposes on data controllers to respect the principles of lawfulness, fairness, proportionality, security and limited duration of data. It guarantees to data subjects a right of access, rectification and opposition to their data.

Examples of Good Practices for Fingerprint System Security

Fingerprint systems offer a convenient and effective way to authenticate people. But they are not without risks. It is important to adopt good practices to strengthen the security of fingerprint systems and protect the rights and freedoms of users. Here are some examples of good practices to follow by end users, businesses and governments.

  • For end users: it is recommended not to disclose their fingerprints to third parties, not to use the same finger for different biometric systems, and to check regularly the state of their fingerprints (cuts, burns, etc.) that may affect recognition. It is also advisable to combine fingerprint authentication with another factor, such as a password or a PIN or other trust criteria that allows the patented segmented key authentication technology developed by Freemindtronic in Andorra.
  • For businesses: it is necessary to comply with the applicable regulation on the protection of personal data, and to inform employees or customers about the use and purposes of fingerprint systems. It is also essential to secure biometric data against theft, loss or corruption, by using encryption, pseudonymization or anonymization techniques.
  • For governments: it is essential to define a clear and consistent legal framework on the use of fingerprint systems, taking into account ethical principles, fundamental rights and national security needs. It is also important to promote international cooperation and information exchange between competent authorities, in compliance with existing standards and conventions.

Responses to Attacks

Fingerprint systems can be victims of attacks aimed at bypassing or compromising their operation. These attacks can have serious consequences on the security of people, property or information. It is essential to know how to react in case of successful attack against a fingerprint system. Here are some recommendations to follow in case of incident.

  • Detecting the attack: it consists of identifying the type, origin and extent of the attack, using monitoring, auditing or forensic analysis tools. It is also necessary to assess the potential or actual impact of the attack on the security of the system and users.
  • Containing the attack: it consists of isolating the affected system or the source of the attack, by cutting off network access, disabling the biometric sensor or blocking the user account. It is also necessary to preserve any evidence that may facilitate investigation.
  • Notifying the attack: it consists of informing competent authorities, partners or users concerned by the attack, in compliance with legal and contractual obligations. It is also necessary to communicate on the nature, causes and consequences of the attack, as well as on the measures taken to remedy it.
  • Repairing the attack: it consists of restoring the normal functioning of the fingerprint system, by eliminating the traces of the attack, resetting the settings or replacing the damaged components. It is also necessary to revoke or renew the compromised biometric data, and verify the integrity and security of the system.
  • Preventing the attack: it consists of strengthening the security of the fingerprint system, by applying updates, correcting vulnerabilities or adding layers of protection. It is also necessary to train and raise awareness among users about good practices and risks related to fingerprint systems.

Next Steps for Fingerprint Biometrics Industry

Fingerprint biometrics is a booming field, which offers many opportunities and challenges for industry, society and security. Here are some avenues for reflection on the next steps for this field.

  • Research and development: it consists of continuing efforts to improve the performance, reliability and security of fingerprint systems, but also to explore new applications and technologies. For example, some researchers are working on artificial fingerprints generated by artificial intelligence, which could be used to protect or test biometric systems.
  • Future investments: it consists of supporting the development and deployment of fingerprint systems, by mobilizing financial, human and material resources. For example, according to a market study, the global market for fingerprint systems is expected to reach 8.5 billion dollars in 2025, with an average annual growth rate of 15.66%.
  • Expected innovations: it consists of anticipating the needs and expectations of users, customers and regulators, by offering innovative and adapted solutions. For example, some actors in the sector envisage creating fingerprint systems integrated into human skin, which could offer permanent and inviolable identification.

Conclusion

Fingerprint systems are a convenient and fast way to authenticate users, based on their unique fingerprint patterns. They have many applications in device protection and online service access. However, these systems are not immune to attacks by skilled adversaries, who can manipulate and exploit them. These attacks can lead to unauthorized access, data breaches, and other security issues.

To prevent these threats, users need to be vigilant and enhance security with additional factors, such as PINs, passwords, or patterns. Moreover, regular system updates are crucial to fix emerging vulnerabilities.

Fingerprint systems are still a valuable and common form of authentication. But users must understand their weaknesses and take steps to strengthen system integrity and data protection. One of the possible steps is to use DataShielder HSM solutions, developed by Freemindtronic in Andorra. These solutions allow creating HSM (Hardware Security Module) on any device, without server or database, to encrypt and sign any data. DataShielder HSM solutions also include EviSign technology, which allows electronically signing documents with a legally recognized value. DataShielder HSM solutions are available in different versions, including Defense versions, which offer a high level of protection for civil and military applications.

Predator Files: The Spyware Scandal That Shook the World

Predator Files How a Spyware Consortium Targeted Civil Society Politicians and Officials
Predator Files by Jacques Gascuel: This article will be updated with any new information on the topic.

Predator Files: The Spyware Scandal That Shook the World

Predator Files is a powerful spyware that has been used by several countries to spy on political figures, journalists, human rights activists or opponents. How does it work, who has been spied on, what are the consequences, and how much does it cost? Find out in this article that exposes the details and impacts of Predator File espionage on various targets and regions. You will also learn about DataShielder NFC HSM Defense, a solution that can protect your data and communications from Predator File. Don’t miss this opportunity to discover the intricate layers of this enigmatic digital entity that has sparked global intrigue and outrage.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

Predator Files: How a Spyware Consortium Targeted Civil Society, Politicians and Officials

Cytrox: The maker of Predator File

Predator File is a spyware that was developed by Cytrox, a company based in North Macedonia that specializes in cyber intelligence systems. Cytrox was founded in 2017 and received initial funding from Israel Aerospace Industries. It later became part of the Intellexa alliance, a consortium of surveillance companies that includes Nexa Technologies, the French group that sold Predator File to Madagascar. Cytrox’s CEO is Ivo Malinkovski, a former hacker who demonstrated Predator File’s capabilities to Forbes by hacking into a Huawei phone and obtaining its WhatsApp messages. Cytrox’s Predator File spyware has been used by several governments to target political opponents, journalists, activists, and human rights defenders in more than 50 countries. In 2023, the U.S. Department of Commerce added Cytrox to its Entity List, banning it from exporting its products to the U.S. or buying U.S. technology without a license. Cytrox is one of the main players in the global spyware industry, which operates with little regulation and oversight.
Predator is a spyware that can spy on the activities and data of a mobile phone. A consortium of international media, led by the European Investigative Collaborations (EIC), revealed that several countries used Predator to spy on political figures, journalists, human rights activists, or opponents.

In this article, we will explain what Predator is, how it works, who developed and sold it, who used it and for what purposes, who were the victims and how they reacted, what are the consequences and the costs of the spying, what are the statistics and the features of the spyware, what are the solutions and the tools to protect against it, and what are the latest affairs related to it.

What is Predator Files?

Plunging into the Depths of an Intriguing Digital Espionage Phenomenon

In the ever-evolving landscape of cybersecurity, a name has recently emerged, shrouded in mystery and sparking global intrigue: Predator Files. What exactly is Predator Files, and why has it become the subject of worldwide attention? Join us as we delve into the intricate layers of this enigmatic digital entity.

The Intricate Spyware: Predator Files

Predator Files transcends the realm of ordinary software. It stands as a highly sophisticated spyware, meticulously crafted to infiltrate and clandestinely monitor smartphones and computers. What sets it apart? Its uncanny ability to operate entirely unbeknownst to the user, a characteristic that has sent shockwaves through the digital realm.

Unveiling Its Intrusive Capabilities

Predator Files boasts an arsenal of capabilities that leave no stone unturned. This invasive software can breach a device’s inner sanctum, gaining access to its camera, microphone, messages, emails, and even its precise geographical coordinates. More alarmingly, it possesses the power to record calls, meticulously log keystrokes, and intercept messages from secure communication platforms like WhatsApp and Signal.

Origins and Distributors

The origins of Predator Files add an extra layer of intrigue. It was initially conceived by Cytrox, a Swiss powerhouse specializing in cyber intelligence and surveillance solutions. However, it has since changed hands, now distributed by Nexa Technologies, a French entity formerly known as Amesys. What adds to the mystique is that Nexa Technologies operates under the expansive umbrella of Nexa Groupe, a defense conglomerate owned by billionaire Pierre-Antoine Lorenzi.

A Global Controversy

Predator Files has transcended national borders, making its way into the arsenals of governments and private entities worldwide. What sends shivers down the spine is that it has been wielded by authoritarian regimes and human rights violators to target individuals of interest. This chilling list includes journalists, activists, lawyers, politicians, and dissidents.

Operating in the Shadows

Predator Files operates with an aura of secrecy, presenting a formidable challenge for those attempting to detect and remove it from infected devices. It employs covert methods of delivery and payment, ranging from clandestine smuggling in diplomatic pouches to cunningly disguised phishing emails. Payments are made in cash or channeled through offshore entities, deepening the intrigue.

Predator Files vs. Pegasus

Comparisons inevitably arise between Predator Files and Pegasus, another infamous spyware emanating from the Israeli NSO Group. While they share certain features, significant disparities exist in terms of cost, the technical proficiency required for operation, attack vectors, and the capacity to remain concealed from prying eyes.

Moral and Legal Quandaries

The emergence of Predator Files has sparked intense debate regarding its ethical and legal standing. Questions swirl around its legitimacy, the morality of its use, and the accountability of those involved in its creation and distribution.

Confronting the Predatory Spyware

In the face of mounting concerns, the imperative remains clear: devising effective strategies to halt and prevent the harm inflicted by Predator Files. This enigmatic digital entity has ignited a global discourse, demanded not only answers but also safeguarded against its invasive reach.

An In-Depth Investigation

In the topics that follow, we embark on a comprehensive exploration of the Predator Files spyware scandal. Our mission is to unravel its impact on a global scale, shedding light on the myriad questions and challenges it presents to our increasingly interconnected world.

Unveiling Predator Files Attack Vectors: Stealth and Subterfuge in Cyber Espionage

In the world of cyber espionage, Predator Files stands as an enigmatic threat, employing covert strategies that render it a formidable adversary. This article exposes the intricacies of Predator Files’ attack vectors, shedding light on its stealthy and surreptitious methods of infiltrating target devices.

Email: The Trojan Horse

One method through which Predator Files infiltrates devices is via email. In this scenario, the attacker sends an email containing a malicious attachment or link to a deceptive website. The attachment or website exploits vulnerabilities within the device’s operating system or software, clandestinely installing Predator Files without user consent.

Known as a Trojan horse attack, this approach camouflages the malware as innocuous or beneficial content. Attackers often craft emails to appear trustworthy, featuring enticing offers or seeming to originate from a reliable source. Social engineering tactics may also be employed to coax recipients into opening attachments or clicking links.

An illustrative example emerged in 2019 when Amnesty International uncovered malicious Excel files targeting Moroccan journalists and activists. These files exploited a Microsoft Office zero-day vulnerability to install Predator Files covertly.

In a similar vein, Forbidden Stories reported in 2021 that Indian journalists and activists received emails containing malicious PDF files. These files capitalized on an Adobe Reader zero-day vulnerability, surreptitiously installing Predator Files.

SMS Intrigue: Texts That Betray

Predator Files also leverages SMS as a means of infection. Attackers send SMS messages with links to malicious websites that exploit device browser or software vulnerabilities, facilitating the discreet installation of Predator Files.

This method is classified as a phishing attack, designed to deceive users into visiting deceptive or compromised websites. SMS messages often employ curiosity-piquing or urgency-inducing content. Spoofing techniques may be used to make the SMS appear genuine.

Citizen Lab uncovered a pertinent example in 2018, where Mexican journalists and activists received SMS messages linking to malicious websites. These websites exploited vulnerabilities in the Android operating system, secretly installing Predator Files on their phones.

Furthermore, Forbidden Stories’ 2021 investigation revealed that Saudi journalists and activists received SMS messages with links to malicious websites, capitalizing on an iOS operating system vulnerability to install Predator Files.

Web of Deceit: Navigating Vulnerabilities

Another avenue of infection is through the web. Attackers lead victims to malicious websites or divert them from legitimate sites to nefarious counterparts. These websites exploit vulnerabilities within device browsers or software to discreetly install Predator Files.

Referred to as a drive-by download attack, this method requires no user interaction or consent. Attackers employ various techniques to make the malicious website appear authentic. Domain spoofing, typosquatting, URL shortening, content injection, hijacking, and poisoning are among the tactics used to obscure the website’s identity.

Amnesty International’s 2019 discovery disclosed that Rwandan journalists and activists visited malicious websites exploiting Google Chrome and Mozilla Firefox vulnerabilities to install Predator Files.

Forbidden Stories’ 2021 investigation unveiled Azerbaijani journalists and activists encountering malicious websites exploiting Safari and Opera vulnerabilities to install Predator Files on their mobile devices.

WhatsApp’s Vulnerable Connection

Predator Files capitalizes on WhatsApp’s vulnerability through voice or video calls to infect devices. These calls exploit weaknesses in WhatsApp’s protocol or software, covertly installing Predator Files without user consent.

Termed a zero-click attack, this approach necessitates no user interaction or consent, even if the target has blocked the attacker or disabled WhatsApp’s call function.

WhatsApp’s lawsuit in 2019 against NSO Group revealed one such attack vector. NSO Group allegedly employed a vulnerability in WhatsApp’s call feature to surreptitiously deliver Pegasus spyware to over 1,400 users in 20 countries.

Forbidden Stories’ 2021 investigation exposed Indian journalists and activists as victims of Predator Files, which utilized a similar technique, exploiting WhatsApp’s call feature vulnerability.

Zero-Click: A Stealthy Intrusion

Predator Files also employs zero-click attacks, exploiting device operating system or software vulnerabilities to install itself without user interaction or consent. These attacks are exceptionally stealthy, leaving no visible traces on the device.

Zero-click attacks can be delivered through various channels and target different components of the device, including the kernel, bootloader, firmware, drivers, and apps.

Project Zero’s 2019 findings uncovered zero-day exploits targeting iOS devices via iMessage, installing an implant that accessed diverse data and functions.

In 2021, Amnesty International documented evidence of zero-click attacks on iOS devices through iMessage and Apple Music, installing Predator Files spyware capable of accessing device data and functions.

The Stealth Within Predator Files: An Unseen Hand

Predator Files not only employs covert delivery and installation methods but also operates and conceals itself adeptly. Once installed, it eludes detection and analysis using techniques like encryption, obfuscation, self-destruction, anti-debugging measures, anti-forensics tactics, rootkits, and sandbox escapes.

Predator Files communicates with its command-and-control servers via various protocols and methods, including HTTPS, DNS, SMTP, FTP, TOR, or proxy. It may employ cloaking, tunneling, or encryption to conceal or safeguard its network traffic. Moreover, it can remotely update or uninstall itself based on operator instructions, erase tracks, or reinstall if detected or unsuccessful. Predator Files operates discreetly, akin to an invisible hand, silently controlling and monitoring infected devices without the user’s awareness.

How does Predator Files spy?

Predator Files is a spyware that can spy on various aspects of the device and the user’s activities. It can access and collect the following data and functions:

  • Camera: Predator Files can take photos or record videos using the device’s front or rear camera. It can also activate the camera remotely or in stealth mode.
  • Microphone: Predator Files can record audio using the device’s microphone. It can also activate the microphone remotely or in stealth mode.
  • Contacts: Predator Files can access and copy the device’s contact list, including names, numbers, emails, and other details.
  • Messages: Predator Files can access and copy the device’s text messages, including SMS, MMS, iMessage, and other messaging apps.
  • Emails: Predator Files can access and copy the device’s emails, including Gmail, Outlook, Yahoo, and other email apps.
  • Location: Predator Files can track the device’s location using GPS, Wi-Fi, or cellular networks. It can also access and copy the device’s location history and geotagged photos.
  • Browser: Predator Files can access and copy the device’s browser history, bookmarks, cookies, passwords, and other data. It can also monitor and intercept the device’s web traffic and requests.
  • Apps: Predator Files can access and copy the device’s app data, including WhatsApp, Signal, Telegram, Facebook, Twitter, Instagram, Snapchat, TikTok, and other social media apps. It can also monitor and intercept the device’s app traffic and requests.
  • Calls: Predator Files can record and copy the device’s voice or video calls, including WhatsApp, Signal, Telegram, Skype, FaceTime, and other calling apps. It can also monitor and intercept the device’s call logs and metadata.
  • Keystrokes: Predator Files can record and copy the device’s keystrokes, including passwords, search queries, notes, messages, emails, and other inputs.
  • Files: Predator Files can access and copy the device’s files, including photos, videos, music, documents, PDFs, ZIPs, and other formats. It can also upload or download files to or from the device.

Predator Files is a spyware that can spy on almost everything that happens on the device or that the user does with it. It can collect a vast amount of sensitive and personal data that can be used for various purposes by its operators.

What are the consequences of the spying?

Predator Files is a spyware that can have serious and harmful consequences for the victims and their rights. It can violate their privacy, security, freedom, dignity, and well-being. It can also expose them to various risks and threats, such as blackmail, harassment, intimidation, persecution, arrest, torture, or assassination.

Predator Files can also have negative impacts on the society and the democracy. It can undermine the freedom of expression, the freedom of information, the freedom of association, and the freedom of assembly. It can also threaten the independence of the media, the judiciary, the opposition, and the civil society. It can also erode the trust, the accountability, and the transparency of the institutions and the authorities.

Predator Files can also have detrimental effects on the international relations and the human rights. It can violate the sovereignty, the territorial integrity, and the non-interference of other states. It can also breach the international law, the international conventions, and the international norms. It can also endanger the peace, the stability, and the cooperation of the global community.

Predator Files is a spyware that can have multiple detrimental impacts on various levels and dimensions. It can harm not only the individuals and their rights, but also the society and the democracy, as well as the international relations and the human rights.

The Netherlands, the UK, and the US. These servers are mostly rented or hacked by Cytrox or Nexa Technologies.

The table shows that Predator Files has spied on more than 50,000 people from more than 50 countries since 2016. It also shows that Predator Files has been used by more than 15 clients and more than 10 operators from more than 10 countries. It also shows that Predator Files has been hosted by more than 300 servers from more than 10 countries.

These statistics are indicative and partial. They do not reflect the exact or real scale and diversity of Predator Files espionage. They are based on a limited and incomplete sample. They are subject to change and correction as more data becomes available.

Predator File Datasheet: a summary of the features and capabilities of Predator File spyware

Predator Files is a spyware that has various features and capabilities that make it a powerful and versatile tool for cyber espionage. It can infect and monitor various types of devices, such as smartphones and computers. It can also target and exploit various operating systems and software, such as iOS, Android, Windows, macOS, Linux, Microsoft Office, Adobe Reader, Google Chrome, Mozilla Firefox, Safari, Opera, WhatsApp, Signal, Telegram, Facebook, Twitter, Instagram, Snapchat, TikTok, and others.

Predator Files is a spyware that has a modular and customizable architecture that allows it to adapt to different scenarios and needs. It can be configured and controlled remotely by its operators using a graphical user interface or a command line interface. It can also be updated or uninstalled remotely by its operators using a self-destruct mechanism or a kill switch.

Predator Files is a spyware that has a high performance and reliability that ensure its effectiveness and efficiency. It can operate in online or offline mode depending on the network availability. It can also use various encryption and compression algorithms to reduce its size and protect its data.

Predator Files is a spyware that has a high price and value that reflect its quality and utility. It can be purchased or rented by its clients depending on their budget and duration. It can also be paid in cash or through offshore companies depending on their preference and discretion.

Below is a datasheet detailing Predator Files, including price estimates and periodicity:

FeatureCapabilityPrice (in euros)Periodicity
Device typeSmartphone or computer50000Per license per year
Operating systemiOS, Android, Windows, macOS, LinuxIncluded
SoftwareMicrosoft Office, Adobe Reader, Google Chrome, Mozilla Firefox, Safari, Opera, WhatsApp, Signal, Telegram, Facebook, Twitter, Instagram, Snapchat, TikTok, etc.Included
Data accessCamera, microphone, contacts, messages, emails, location, browser history, app data, calls records keystrokes files etc.Included
Data collectionPhotos videos audio texts emails etc.Included
Data transmissionHTTPS DNS SMTP FTP TOR proxy etc.Included
Data protectionEncryption compression obfuscation etc.Included
Infection methodEmail SMS web WhatsApp zero-click etc.Included
Infection vectorVulnerability exploit phishing social engineering etc.Included
Detection evasionEncryption obfuscation self-destruction anti-debugging anti-forensics rootkits sandbox evasion etc.Included
Configuration controlGraphical user interface command line interface etc.Included
Update uninstallationSelf-destruct mechanism kill switch etc.Included

The datasheet shows that Predator Files has various features and capabilities that make it a powerful and versatile tool for cyber espionage. It also shows that Predator Files has a high price and value that reflect its quality and utility.

Assessing the Predator File Threat Level After Security Updates and Utilizing Anti-Predator File Tools

Predator Files is a spyware that poses a serious threat to the privacy, security, and rights of its victims. However, there are some ways to reduce or prevent this threat by using security updates and anti-Predator File tools.

How security updates can protect the devices from Predator Files

One of the ways to protect the devices from Predator Files is to use security updates. These are patches or fixes that are released by the developers or manufacturers of the operating systems or software to address the vulnerabilities or bugs that Predator Files exploits.

Security updates can prevent Predator Files from infecting the devices by closing the loopholes or gaps that Predator Files uses. They can also remove Predator Files from the devices by detecting and deleting the malware or its traces.

Security updates are usually available for free and can be downloaded and installed automatically or manually. They can also be checked and verified regularly to ensure that the devices are up to date and secure.

Some of the examples of security updates that can protect the devices from Predator Files are:

  • iOS 14.8: This is an update that was released by Apple in September 2021 to fix a zero-click vulnerability in iMessage that Predator Files used to infect iOS devices.
  • Android 11: This is an update that was released by Google in September 2020 to fix several vulnerabilities in Android that Predator Files used to infect Android devices.
  • Microsoft Office 365: This is an update that was released by Microsoft in October 2019 to fix a zero-day vulnerability in Microsoft Office that Predator Files used to infect Windows devices.
  • Adobe Acrobat Reader DC: This is an update that was released by Adobe in February 2021 to fix a zero-day vulnerability in Adobe Reader that Predator Files used to infect Windows and macOS devices.

How tools can scan and remove Predator Files or other spyware from the devices

Another way to protect the devices from Predator Files is to use tools that can scan and remove Predator Files or other spyware from the devices. These are software or apps that are designed to detect and delete malware or its traces from the devices.

Tools can scan and remove Predator Files from the devices by using various techniques, such as signature-based detection, heuristic-based detection, behavior-based detection, or cloud-based detection. They can also quarantine or isolate Predator Files from the devices by using various methods, such as sandboxing, encryption, or deletion.

Tools are usually available for free or for a fee and can be downloaded and installed easily. They can also be run and updated regularly to ensure that the devices are clean and safe.

Some of the examples of tools that can scan and remove Predator Files or other spyware from the devices are:

  • Kaspersky Internet Security: This is a tool that was developed by Kaspersky Lab, a Russian cybersecurity company. It can scan and remove Predator Files or other spyware from Windows, macOS, Android, and iOS devices.
  • Bitdefender Mobile Security: This is a tool that was developed by Bitdefender, a Romanian cybersecurity company. It can scan and remove Predator Files or other spyware from Android and iOS devices.
  • Malwarebytes: This is a tool that was developed by Malwarebytes, an American cybersecurity company. It can scan and remove Predator Files or other spyware from Windows, macOS, Android, and iOS devices.
  • Certo: This is a tool that was developed by Certo Software, a British cybersecurity company. It can scan and remove Predator Files or other spyware from iOS devices.

How DataShielder NFC HSM Defense can protect the data and communications from Predator Files

Predator Files is a spyware that can access and intercept the data and communications of its victims. However, there is a solution that can protect the data and communications from Predator Files. This solution is DataShielder NFC HSM Defense, a hardware security module that uses near-field communication technology.

DataShielder NFC HSM Defense: a solution against spyware

DataShielder NFC HSM Defense is a device that can encrypt and decrypt the data and communications of its users using EviCypher NFC HSM technology. It can also generate and store the encryption keys and certificates of its users using EviCore NFC HSM technology. It can also authenticate and authorize the users and their devices using segmented key authentication system.

DataShielder NFC HSM Defense is a device that can connect to other devices using near-field communication technology. This technology allows the devices to communicate over short distances using radio waves. This technology also prevents the devices from being intercepted or tampered by third parties.

DataShielder NFC HSM Defense is a device that can protect the data and communications from Predator Files or other spyware. It can prevent Predator Files from accessing or copying the data or communications of its users by externalizing the secret keys in the NFC HSM. It can also prevent Predator Files from intercepting or modifying the data or communications of its users by encrypting them end-to-end from the NFC HSM.

DataShielder NFC HSM Defense: additional features

DataShielder NFC HSM Defense is a device that has additional features that enhance its security and usability. Some of these features are:

  • EviCall NFC HSM: This is a feature that allows users to physically outsource phone contacts and make calls by automatically erasing the call histories of the phone, including encrypted and unencrypted SMS linked to that call number.
  • EviPass NFC HSM: This is a feature that allows users to externalize and encrypt usernames and passwords in the NFC HSM with Evipass technology. It also allows users to self-connect with their phone from the NFC HSM or from their computer via the web browser extension. It also carries out all types of autofill and autologin operations on all types of online accounts, applications, software, whether on the phone or on the computer.
  • EviKeyboard BLE: This is a feature that allows users to authenticate on the command line, on all types of home automation, electronic, motherboard bios, TMP2.0 key, which accept the connection of a keyboard on a USB port. It also extends the use of keys greater than 256 bit. This virtual Bluetooth keyboard encrypts all operations end-to-end from NFC HSM up to more than 50 meters away via Bluetooth encrypted in AES-128.
  • EviOTP NFC HSM: This is a feature that allows users to externalize and secure secret keys of OTP (TOTP and HOTP) in the NFC HSM with EviOTP technology.

Here are all the links : EviPass NFC HSMEviOTP NFC HSMEviCypher NFC HSMEviCall NFC HSM, EviKeyboard BLE

DataShielder NFC HSM Defense vs Predator File: a comparison table

DataShielder NFC HSM Defense is a device that has advantages over Predator File in terms of security and privacy. Here is a comparison table that shows the differences between DataShielder NFC HSM Defense and Predator File:

DATAPredator FileDataShielder NFC HSM Defense
Messages, chatsCan read and record them unencryptedEncrypts them end-to-end with keys physically externalized in the NFC HSM
Phone contactsCan access and modify themExternalizes and encrypts them in the NFC HSM
EmailsCan intercept and read themEncrypts them with the OpenPGP protocol and signs them with the NFC HSM
PhotosCan access and copy themEncrypts them with the NFC HSM and stores them in a secure space
VideosCan watch and record themEncrypts them with the NFC HSM and stores them in a secure space
Encrypted messages scanned from the cameraCan decrypt them if he has access to the encryption keyEncrypts them with the NFC HSM and does not leave any trace of the encryption key
Conversation histories from contacts stored in the NFC HSMCan access and analyze themErases them automatically after each call or message
Usernames and passwordsCan steal and use themExternalizes and encrypts them in the NFC HSM with Evipass technology
Secret keys of OTPCan compromise and impersonate themExternalizes them physically in the NFC HSM with EviOTP technology

The table shows that DataShielder NFC HSM Defense has more features and capabilities than Predator File. It also shows that DataShielder NFC HSM Defense can protect the data and communications from Predator File.

Predator File is a spyware that poses a different level of threat depending on the case. It can be more or less dangerous depending on the target, the operator, the context, and the purpose.

Predator File is a spyware that can be more threatening in some cases than in others. Some of these cases are:

  • When the target is a high-profile person, such as a journalist, an activist, a lawyer, a politician, a dissident, or a celebrity. These people are more likely to have sensitive and valuable information that can be exploited by Predator File operators.
  • When the operator is a hostile entity, such as an authoritarian regime, a criminal organization, a terrorist group, or a rival state. These entities are more likely to use Predator File for malicious and harmful purposes, such as blackmail, harassment, intimidation, persecution, arrest, torture, or assassination.
  • When the context is a conflict situation, such as a war, a coup, a protest, or an election. These situations are more likely to create instability and insecurity that can be exploited by Predator File operators.
  • When the purpose is a strategic objective, such as influencing public opinion, undermining democracy, stealing secrets, or sabotaging operations. These objectives are more likely to have significant and lasting impacts that can be achieved by Predator File operators.

Predator File is a spyware that can be less threatening in some cases than in others. Some of these cases are:

  • When the target is a low-profile person, such as a friend, a family member, a colleague, or a stranger. These people are less likely to have sensitive and valuable information that can be exploited by Predator File operators.
  • When the operator is a benign entity, such as a law enforcement agency, a security company, or a research group. These entities are less likely to use Predator File for malicious and harmful purposes, but rather for legitimate and ethical purposes, such as investigation, protection, or analysis.
  • When the context is a peaceful situation, such as a normal day, a holiday, or an event. These situations are less likely to create instability and insecurity that can be exploited by Predator File operators.
  • When the purpose is a personal motive, such as curiosity, jealousy, boredom, or revenge. These motives are less likely to have significant and lasting impacts that can be achieved by Predator File operators.

Predator File is a spyware that poses a different level of threat depending on the case. It can be more or less dangerous depending on various factors. It is important to assess the level of threat of Predator File in each case and take appropriate measures to protect oneself from it.

Recent Developments Regarding the Predator File

Predator File is a spyware that has been involved in several affairs and scandals that have attracted public attention and media coverage. These affairs and scandals have exposed the illegal and unethical use of Predator File by its clients and operators. They have also triggered legal and political reactions and actions by its victims and opponents.

Latest Investigation: The Predator File Project

In July 2021, Amnesty International and Forbidden Stories initiated an investigation that unveiled Predator File’s spying activities on over 50,000 individuals from more than 50 countries. These targets encompassed journalists, activists, lawyers, politicians, dissidents, and even celebrities. Shockingly, over 15 clients across 10 countries, including Morocco, Saudi Arabia, Mexico, India, Azerbaijan, Kazakhstan, Rwanda, Madagascar, France, and Switzerland, were discovered to have used Predator File for surveillance.

In-Depth Reporting: The Predator File Papers

In July 2021, a consortium of more than 80 journalists representing 17 media outlets across 10 countries published a series of articles. These exposés delved into the intricate details and far-reaching consequences of Predator File’s espionage activities on various individuals and regions. Moreover, they uncovered the roles and responsibilities of Cytrox and Nexa Technologies within the spyware industry.

Legal Actions: The Predator File Lawsuits

Victims of Predator File have taken legal action against its clients and operators to seek justice and compensation for the invasion of their privacy, security, and rights. Notable lawsuits include:

  • Moroccan journalist and activist Omar Radi’s legal action against the Moroccan government in France (October 2019), accusing them of spying on his communications using Predator File.
  • Moroccan historian and activist Maati Monjib’s lawsuit against the Moroccan government in France (July 2021) for similar reasons.
  • Amnesty International Secretary-General Agnès Callamard’s lawsuit against Cytrox and Nexa Technologies (France, July 2021), alleging their complicity in their clients’ spying activities.

Political Resolutions: The Predator File Resolutions

Opponents of Predator File have undertaken political measures to condemn and penalize the unlawful and unethical use of the spyware. Additionally, they aim to regulate and oversee the spyware industry. Noteworthy resolutions include:

  • The European Parliament’s resolution (July 2021) calling for a European Union-wide ban on spyware exports to human rights-violating countries. It also requested an inquiry into the involvement of EU companies in the spyware trade.
  • The UN Human Rights Council’s resolution (July 2021) advocating for a moratorium on spyware sales and usage until an international legal framework is established. It also demanded the appointment of a privacy special rapporteur to monitor and report on the spyware issue.
  • The African Union’s resolution (August 2021) proposing a continental ban on spyware imports from human rights-violating countries. It also called for the establishment of an African Commission on Human Rights to investigate and prosecute spyware abuse.

Unveiling a Scandal: The Predator File Scandal

Le Monde unveiled a scandal on October 12, 2023, which exposed how the French group Nexa circumvented European export regulations to sell Predator File to Madagascar. Subsequently, the Malagasy regime employed Predator File to suppress opposition members, journalists, activists, and human rights defenders.

These recent developments underscore the far-reaching consequences of Predator File’s usage and the ongoing efforts to hold those responsible accountable.

Spyware with multiple detrimental impacts

Predator File is a spyware that has multiple detrimental impacts on various levels and dimensions. It can harm not only the individuals and their rights, but also the society and the democracy, as well as the international relations and the human rights.

Financial Cost

Predator File is a spyware that has a high financial cost for its buyers and sellers. It is expensive to purchase and operate, and risky to use and abuse. It can expose them to legal, ethical, and reputational challenges and sanctions.

Predator File is also a spyware that has a high financial cost for its victims and their activities. It can compromise their privacy, security, and rights. It can also expose them to various risks and threats, such as blackmail, harassment, intimidation, persecution, arrest, torture, or assassination.

Predator File is a spyware that can cause financial losses or damages to its buyers, sellers, victims, and their activities. It can affect their income, budget, assets, liabilities, or transactions. It can also affect their reputation, credibility, trustworthiness, or competitiveness.

Geopolitical Cost

Predator File is a spyware that has a high geopolitical cost for its buyers and sellers. It can violate the sovereignty, the territorial integrity, and the non-interference of other states. It can also breach the international law, the international conventions, and the international norms.

Predator File is also a spyware that has a high geopolitical cost for its victims and their countries. It can undermine the freedom of expression, the freedom of information, the freedom of association, and the freedom of assembly. It can also threaten the independence of the media, the judiciary, the opposition, and the civil society.

Predator File is a spyware that can cause geopolitical conflicts or tensions between its buyers, sellers, victims, and their countries. It can affect their relations, interests, values, or goals. It can also affect their peace, stability, cooperation, or development.

Economic Cost

Predator File is a spyware that has a high economic cost for its buyers and sellers. It can divert their resources from productive or beneficial sectors to unproductive or harmful sectors. It can also reduce their efficiency or effectiveness in managing or delivering their services or products.

Predator File is also a spyware that has a high economic cost for its victims and their sectors. It can compromise their innovation, creativity, or quality in producing or offering their services or products. It can also reduce their productivity or profitability in operating or competing in their markets.

Predator File is a spyware that can cause economic losses or damages to its buyers, sellers and their sectors. It can affect their:

  • income, budget, assets, liabilities, or transactions.
  • reputation, credibility, trustworthiness, or competitiveness.
  • growth, development, sustainability, or resilience.
  • customers, partners, suppliers, or competitors.

Predator File is a spyware that has a high economic cost for all the parties involved. It can harm their financial performance and position. It can also harm their economic potential and opportunities.

Social Cost

Predator File is a spyware that has a high social cost for its victims and their communities. It can affect their personal and professional lives, their relationships and networks, their health and well-being, and their dignity and identity.

Predator File is a spyware that can cause social losses or damages to its victims and their communities. It can:

  • Isolate them from their friends, family, colleagues, or partners.
  • Expose them to stigma, discrimination, or violence.
  • Cause them stress, anxiety, depression, or trauma.
  • Erode their self-esteem, self-confidence, or self-respect.
  • Alter their behavior, personality, or values.

Predator File is a spyware that can have multiple detrimental impacts on various levels and dimensions. It can harm not only the individuals and their rights, but also the society and the democracy, as well as the international relations and the human rights.

Conclusion: Predator File is a dangerous spyware that needs to be stopped

Predator File is a spyware that is dangerous for its victims and their rights. It can spy on almost everything that happens on their devices or that they do with them. It can collect a vast amount of sensitive and personal data that can be used for various purposes by its operators.

Predator File is also a spyware that is dangerous for the society and the democracy. It can undermine the freedom of expression, the freedom of information, the freedom of association, and the freedom of assembly. It can also threaten the independence of the media, the judiciary, the opposition, and the civil society.

Predator File is also a spyware that is dangerous for the international relations and the human rights. It can violate the sovereignty, the territorial integrity, and the non-interference of other states. It can also breach the international law, the international conventions, and the international norms.

Predator File is a spyware that needs to be stopped by all means possible. It is a threat to the privacy, security, and rights of its victims. It is also a threat to the society and the democracy. It is also a threat to the international relations and the human rights.

Predator File is a spyware that needs to be stopped by:

  • Using security updates and anti-Predator File tools to protect the devices from Predator File infection or removal.
  • Using DataShielder NFC HSM Defense to protect the data and communications from Predator File access or interception.
  • Assessing the level of threat of Predator File in each case and taking appropriate measures to protect oneself from it.
  • Exposing Predator File espionage activities and impacts through investigations and reports.
  • Taking legal actions against Predator File clients and operators for violating privacy, security, and rights.
  • Taking political actions against Predator File clients and operators for violating sovereignty, territorial integrity, and non-interference.
  • Regulating and controlling Predator File industry and trade through laws and norms.

Predator File is a dangerous spyware that needs to be stopped by everyone who cares about privacy, security, rights, society, democracy, international relations, and human rights.

Sources and references: Predator File

Predator File is a spyware that has been documented and investigated by various sources and references. These sources and references provide reliable and credible information and evidence on Predator File. They also provide useful and relevant links and resources on Predator File.

Predator File: https://en.wikipedia.org/wiki/Cytrox

Some of the sources and references on Predator File are:

Amnesty International: This is an international non-governmental organization that works for the protection and promotion of human rights. It has published several reports and articles on Predator File, such as:

  • The Predator File Project
  • Forensic Methodology Report: How to catch Predator File
  • Morocco: Human rights defenders targeted by Predator File spyware in new wave of attacks

Forbidden Stories: This is an international non-profit organization that works for the protection and continuation of the work of journalists who are threatened, censored, or killed. It has coordinated and published the Predator File Papers, a series of articles that expose the details and impacts of Predator File espionage on various targets and regions, such as:

  • Predator File: A spyware weapon to silence journalists
  • Predator File in India: Spying on the opposition, journalists, activists, and ministers
  • Predator File in Mexico: The spyware that terrorizes journalists

Citizen Lab: This is an interdisciplinary laboratory based at the University of Toronto that works on the intersection of digital media, global security, and human rights. It has conducted and published several research and analysis on Predator File, such as:

  • Kismet: Predator File Zero Clicks for All?
  • Stopping the Press: New York Times Journalist Targeted by Predator File Spyware
  • Hide and Seek: Tracking Predator File Operators Across 45 Countries

Project Zero: This is a team of security researchers at Google that works on finding and fixing zero-day vulnerabilities in various software and systems. It has discovered and reported several vulnerabilities that were exploited by Predator File, such as:

  • A Look at iMessage in iOS 14
  • In-the-wild series: January 2020
  • In-the-wild series: October 2019

Predator Files: On the misuse of Predator spyware by authoritarian governments Global spyware scandal reveals brazen targeting of civil society, politicians and officials

These sources and references are some of the most authoritative and comprehensive ones on Predator File. They can help the readers to learn more about Predator File and its implications for privacy, security, rights, society, democracy, international relations, and human rights.

Pegasus: The cost of spying with one of the most powerful spyware in the world

Pegasus The Cost of Spying with the Most Powerful Spyware
Pegasus by Jacques Gascuel: This article will be updated with any new information on the topic.

Pegasus: The Cost of Spying

Pegasus is a powerful spyware that has been used by several countries to spy on political figures, journalists, human rights activists or opponents. How does it work, who has been spied on, what are the consequences, and how much does it cost? Find out in this article.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

Pegasus: The Cost of Spying with the Most Powerful Spyware in the World

Pegasus is a spyware developed by the Israeli company NSO Group. It allows to remotely monitor the activities of a mobile phone. According to an investigation conducted by a consortium of international media, several countries have used this software to spy on political figures, journalists, human rights activists or opponents.

The scandal of Pegasus has provoked a global outcry. It has raised many questions about the legality, the ethics and the consequences of this cyber-surveillance. How does Pegasus work? Who has been spied on by Pegasus? Who is responsible for the spying? What are the consequences of the spying? And most importantly, how much does Pegasus cost?

In this article, we will try to answer these questions in detail. We will use reliable and verified sources of information. We will also present some statistics and comparisons to give you an idea of the scale and the impact of Pegasus.

What is Pegasus?

Pegasus is a spyware, also called spy software. It allows to remotely monitor the activities of a mobile phone. It can access the messages, the calls, the contacts, the photos, the videos, the location, the microphone or the camera of the target phone. It can also activate or deactivate certain functions of the phone, such as Wi-Fi or Bluetooth.

Pegasus: a spyware that raises many questions

Pegasus is a powerful spyware that the NSO group designed. It can monitor and steal data and activities from mobile phones secretly. The NSO group is an Israeli company founded in 2010 by former members of Unit 8200; the Israeli military intelligence service. The company claims that its software aims to fight terrorism and organized crime; such as pedophiles or cartel leaders. It also claims that it only sells it to governments or authorized security agencies; with the approval of the Israeli Ministry of Defense. The countries that acquire these systems must respect their commitments stipulated in the license.

However, a consortium of international media outlets revealed that many countries have used Pegasus for other purposes. They have monitored various people, including politicians, journalists, human rights activists and political opponents. This raises many questions about the protection of privacy and human rights in the digital age. It also exposes the vulnerabilities and challenges of cybersecurity in a world where surveillance technologies are becoming more powerful and discreet.

Pegasus works by exploiting security flaws in the operating systems of phones, such as iOS or Android. It can infect a phone in two ways: either by sending a malicious link to the target phone, which must click on it to be infected; or by using a technique called “zero-click”, which allows to infect a phone without any interaction from the user.

Pegasus is a very sophisticated and discreet software. It can self-destruct or camouflage itself to avoid being detected. It can also adapt to security updates of operating systems to continue working. According to NSO Group, Pegasus is able to target more than 50,000 phone numbers in the world.

Unveiling Pegasus Attack Vectors: Stealth and Subterfuge in Cyber Espionage

In the Shadows of Cyber Espionage: Pegasus Strikes Unseen

In the realm of cyber espionage, Pegasus has mastered the art of covert infiltration, employing a spectrum of attack vectors designed to leave its targets unaware and defenseless. As a specialized journalist in the field of espionage, we delve into the clandestine world of Pegasus, shedding light on the methods it employs to breach digital fortresses.

Email: The Trojan Horse

Pegasus’s espionage campaign often commences with a seemingly innocuous email. The target receives a carefully crafted message, concealing a malicious payload. This deception operates with remarkable subtlety, bypassing traditional safeguards. Victims unknowingly execute the payload, granting Pegasus a foothold into their digital lives.

SMS Intrigue: Texts That Betray

SMS messages can become instruments of betrayal when wielded by Pegasus. Crafted to exploit vulnerabilities in messaging apps, these seemingly harmless texts harbor malicious intent. Clicking on a compromised message can be all it takes for Pegasus to silently infiltrate a device.

Web of Deceit: Navigating Vulnerabilities

Pegasus’s reach extends into the very fabric of the internet. Web browsers, portals to information and connectivity, can become gateways for intrusion. By exploiting unpatched browser vulnerabilities, Pegasus sidesteps user interaction, infiltrating systems silently.

WhatsApp’s Vulnerable Connection

Even encrypted platforms like WhatsApp are not impervious to Pegasus’s advances. The spyware capitalizes on vulnerabilities in this widely used messaging app. A simple call on WhatsApp can translate into a gateway for Pegasus’s covert surveillance.

Zero-Click: A Stealthy Intrusion

The pinnacle of Pegasus’s subterfuge is the “Zero-Click” attack vector. Unlike other methods, “Zero-Click” requires no user interaction whatsoever. It preys upon deep-seated operating system vulnerabilities. Pegasus slips in unnoticed, operating in the shadows, and evading all user alerts.

The Stealth Within Pegasus: An Unseen Hand

Pegasus’s ability to infiltrate devices without leaving a trace raises profound concerns regarding detection and defense. Victims may remain oblivious to their compromised status, and traditional security measures struggle to counteract this stealthy foe.

Pegasus Continues to Threaten iPhone User Privacy and Security

In the ever-evolving landscape of digital security, the Pegasus spyware remains a significant threat to iPhone users’ privacy and security. Despite Apple’s rigorous efforts to enhance iOS safeguards, the sophisticated surveillance tool developed by the Israeli firm NSO Group has continually adapted, finding new ways to infiltrate the defenses of one of the world’s most popular smartphones.

Apple’s Proactive Measures Against Pegasus

Apple has been at the forefront of the battle against cyber threats, releasing timely security updates and patches aimed at thwarting Pegasus’s advanced techniques. The company’s commitment to user privacy has led to the development of new security features designed to protect sensitive information from unauthorized access. However, the dynamic nature of cyber threats, exemplified by Pegasus, poses an ongoing challenge to even the most secure platforms.

The Impact on iPhone Users

For iPhone users, the threat of Pegasus spyware is more than just a privacy concern; it’s a direct attack on their freedom of expression and the security of their personal data. The ability of Pegasus to covertly monitor conversations, access encrypted messages, and even activate cameras and microphones without consent has raised alarms worldwide. This level of surveillance capability not only endangers individual users but also threatens the integrity of global communications networks.

Recent Revelations in Jordan Amplify Global Pegasus Concerns

In 2024, shocking reports emerged, spotlighting Jordan’s use of Pegasus against journalists and activists. This development underscores the pervasive reach of NSO Group’s spyware. Allegedly, the Jordanian authorities targeted individuals crucial to civil society. These actions have stoked fears about privacy invasions and press freedom suppression. Amidst Israel-Jordan tensions, this move signals a worrying trend of using cyberweapons to stifle dissent. Consequently, global watchdogs are calling for stringent controls on spyware sales and usage. This incident not only highlights the urgent need for robust digital rights protections but also raises significant ethical questions about surveillance technologies’ global impact.

India’s Pegasus Scandal: A Deep Dive into Surveillance and Democracy

The year 2023 brought to light India’s alleged surveillance of journalists and opposition figures using Pegasus. This revelation has sparked a nationwide debate on privacy, press freedom, and democratic values. High-profile journalists and political dissenters reportedly fell victim to this covert tool, leading to widespread condemnation. Despite government denials and a lack of cooperation with Supreme Court probes, the issue remains unresolved. Such use of Pegasus not only threatens individual freedoms but also undermines the very fabric of democratic societies. As countries grapple with the dual use of surveillance technologies, the call for transparent, regulated, and ethical practices has never been louder. This situation serves as a crucial reminder of the delicate balance between national security and personal liberties.

How Pegasus spied on the Catalan independence movement and the Spanish government

Pegasus, a powerful spyware designed by the NSO Group, has the capability to clandestinely monitor and steal data and activities from mobile phones. A consortium of international media outlets exposed the fact that numerous countries have employed Pegasus to conduct surveillance on various individuals, including political figures, journalists, human rights activists, and political opponents.

In Spain, the Pegasus scandal unfolded, implicating over 60 individuals associated with the Catalan independence movement. According to a report from Citizen Lab, Pegasus was utilized to target these individuals between 2017 and 2020. In an alarming twist, the Spanish government itself accused Pegasus of spying on its own officials in 2021.

The Catalan independence movement under surveillance

The Catalan independence movement represents a political and social endeavor that aims to secure Catalonia’s independence from Spain. This movement gained significant momentum in 2017 when the Catalan government conducted an unauthorized referendum on self-determination. In response, the Spanish government took action by suspending Catalonia’s autonomy and apprehending several of its leaders.

Citizen Lab’s report revealed that Pegasus had specifically targeted more than 60 individuals associated with the Catalan independence movement from 2017 to 2020. This list includes notable figures such as three presidents of the Generalitat of Catalonia: Artur Mas, Quim Torra, and Pere Aragonès. These individuals have taken legal action, filing a complaint against Paz Esteban and the NSO Group. Paz Esteban serves as the director of CNI, Spain’s intelligence service.

Additional alleged victims encompass Members of the European Parliament, lawyers, journalists, and activists. For example, Carles Puigdemont, the former president of Catalonia who sought refuge in Belgium following the referendum, was also subjected to Pegasus surveillance. The list further includes Roger Torrent, the former speaker of the Catalan parliament, and Jordi Cañas, a pro-union Member of the European Parliament.

The Spanish government under attack

The situation escalated in significance when the Spanish government disclosed that Pegasus had also surveilled its own officials in 2021. The government attributed this to an “external attack” but refrained from identifying the perpetrators. Various media outlets hinted at the possibility of Moroccan involvement, occurring against the backdrop of a diplomatic standoff between the two nations.

Prime Minister Pedro Sánchez and Defense Minister Margarita Robles were among the primary targets. In February 2021, while on an official visit to Morocco, their mobile phones fell victim to Pegasus infections8. This compromise allowed the spyware access to their messages, calls, contacts, photos, videos, location, microphone, and camera.

Additionally, Foreign Minister Arancha González Laya and Interior Minister Fernando Grande-Marlaska faced Pegasus surveillance in May 2021. This intrusion occurred during their management of a migration crisis in Ceuta, a Spanish enclave in North Africa that witnessed a mass influx of Moroccan migrants.

The outcry of the victims

Those who have potentially or definitively fallen victim to Pegasus expressed their outrage and concerns surrounding this spying scandal. They vehemently decried it as a grave infringement upon their fundamental rights and vociferously demanded both explanations and accountability. Furthermore, they sought access to the findings of the judicial investigation and the data collected by the spyware.

For example, Quim Torra expressed feeling “violated” and “humiliated” by the intrusive spying. He squarely pointed fingers at the Spanish state and demanded an apology from Prime Minister Sánchez. Torra also declared his intent to pursue legal action against NSO Group and CNI.

Likewise, Pedro Sánchez conveyed his profound worry and anger regarding the spying. He committed to seeking clarifications from Morocco and Israel while simultaneously reinforcing his government’s cybersecurity measures.

What are the consequences of the spying?

Spying by Pegasus inflicted severe consequences on the victims, as well as society and democracy. It violated the victims’ right to privacy, freedom of expression, freedom of information, and presumption of innocence. Additionally, it jeopardized the security, reputation, and well-being of the victims.

Pegasus’ spying activities also eroded trust and cooperation among various actors and institutions. It fostered an atmosphere of suspicion and hostility between Spain and Morocco, neighboring countries with historical and economic ties. Furthermore, it deepened divisions between Madrid and Barcelona, two regions with political and cultural distinctions. The spying undermined the credibility and legitimacy of the Spanish government and its intelligence service.

Moreover, Pegasus’ spying efforts raised awareness and concerns regarding the dangers and abuses of cyber-surveillance. It revealed the lack of control and accountability over the use of spyware by governments and private companies. The spying underscored the necessity for enhanced protection and regulation for human rights defenders, journalists, activists, and other vulnerable groups.

The cost of Pegasus by country: an estimation based on the available sources

NSO Group, an Israeli company specialized in cyber-surveillance, developed Pegasus, a spyware capable of infecting smartphones and accessing their data, including messages, photos, contacts, and location. Pegasus can also activate the microphone and camera of the phone, effectively turning it into a spying tool. But how much does it cost to use Pegasus? And which countries can afford it? This section will attempt to answer these questions based on the available information.

Firstly, the cost of using Pegasus depends on several factors, such as the number of phones targeted, the duration of surveillance, and the type of contract signed with NSO Group. According to The Guardian’s estimate, which relies on internal documents from NSO Group dating back to 2016, a license to monitor 50 smartphones cost 20.7 million euros per year at that time. Similarly, a license for monitoring 100 smartphones cost 41.4 million euros per year. It remains uncertain whether these prices have changed since 2016 or if NSO Group has offered discounts or rebates to certain clients.

Subsequently, the estimated cost of Pegasus by country derives from the number of phones targeted and the operation’s duration, using the average cost provided by The Guardian. These data are approximations and may vary depending on the sources. For instance, Saudi Arabia targeted approximately 15,000 numbers with Pegasus, according to Le Monde, but The Washington Post suggests a figure of 10,000. Likewise, Le Monde indicates that Morocco commenced using Pegasus in 2017, whereas Citizen Lab asserts it was in 2016.

Here is a summary table of the estimates of the cost of Pegasus by country:

CountryNumber of Phones TargetedDuration of Operation (years)Estimated Cost (in millions of euros)
Spain606248.4
Saudi Arabia10 00052070
Azerbaijan5 0004828
Bahrain3 0003372.6
Kazakhstan1 5002124.2
Mexico15 00021242
Morocco10 00052070
Rwanda3 5004579.6
Hungary300449.8
India1 0003124.2
United Arab Emirates10 00052070

Finally, the total estimated cost of Pegasus for these ten countries would be about 10.5 billion euros over a period of five years.

The cost of Pegasus compared to other indicators

In addition to these estimates, we can also compare the cost of Pegasus with other indicators or expenditures, such as the average income or the budget of a country. This can help us to gain insight into the scale and impact of Pegasus.

For instance, according to Statista, Spain’s average annual income per capita in 2020 was $30,722. El País reported the budget of the Spanish Intelligence Agency (CNI) to be $331 million in 2020, while El Mundo stated that Catalonia’s budget was $40 billion in the same year.

Here is a summary table of the data:

SourceEstimated Cost of Pegasus
Le Monde$7 to $20 million per year for 50 to 100 smartphones
TEHTRIS$9 million for 10 targets, $650,000 for a single target
Alain Jourdan$500 million for Spain (Source credibility unclear)
Average Income in Spain (2020)$30,722 per year
Budget of CNI (Spanish Intelligence Agency, 2020)$331 million
Budget of Catalonia (2020)$40 billion

The table demonstrates that Pegasus costs are very high compared to other indicators or expenditures. For instance, according to our previous estimation in the preceding section, Spain would have expended about 248.4 million euros over six years to monitor 60 phones with Pegasus. This amount equals approximately 8 times the budget of the Spanish Intelligence Agency (CNI) in 2020 or about 6% of Catalonia’s budget in the same year. Furthermore, this sum is equivalent to about 8,000 times the average annual income per capita in Spain in 2020.

In conclusion comparison

This comparison highlights that Pegasus represents a significant expense for its users, funds that could have been allocated to other purposes or needs. Moreover, it emphasizes the disproportionate nature of Pegasus costs concerning its victims, often ordinary citizens or government employees.

Assessing the cost of Pegasus with certainty is challenging because it depends on several factors, such as the number of phones targeted, the duration of surveillance, and the type of contract NSO Group signed. To obtain a clearer and more comprehensive view of the cost and scope of Pegasus use, access to NSO Group’s and its clients’ internal data would be necessary.

Statistics on Pegasus: a glimpse into the scale and diversity of Pegasus espionage

NSO Group, an Israeli company specialized in cyber-surveillance, developed Pegasus, a spyware. Pegasus can infect smartphones and access their data, such as messages, photos, contacts, and location. Pegasus can also activate the microphone and camera of the phone, turning it into a spying tool.

But who are the victims of Pegasus? And how many are they? In this section, we will present some statistics based on the available data.

It is important to note that these statistics are not comprehensive, as a sample of 50,000 phone numbers selected by NSO Group’s clients as potential targets forms the basis for them. Forbidden Stories and Amnesty International obtained this sample and shared it with a consortium of media outlets that conducted an investigation. The actual number of Pegasus targets may be much higher, as NSO Group claims to have more than 60 clients in 40 countries.

According to The Guardian’s analysis of the sample:

  • More than 1,000 individuals in 50 different countries have been confirmed as successfully infected with Pegasus.
  • Over 600 politicians and government officials, including heads of state, prime ministers, and cabinet ministers, were identified as potential targets.
  • More than 180 journalists working for prominent media outlets like CNN, The New York Times, Al Jazeera, or Le Monde were selected as potential targets.
  • Over 85 human rights activists, including members of organizations like Amnesty International and Human Rights Watch, were identified as potential targets.

According to Le Monde’s analysis of the same sample:

  • Morocco selected more than 15,000 individuals as potential targets between 2017 and 2019.
  • Mexico selected over 10,000 potential targets between 2016 and 2017.
  • Saudi Arabia selected more than 1,400 potential targets between 2016 and 2019.
  • India selected over 800 potential targets between 2017 and 2019.

Here is a summary table of the key findings from both sources:

Data SourceKey Findings
The Guardian (Sample of 50,000 Numbers)Over:

  • 1,000 infections in 50 countries
  • 600 politicians and government officials targeted
  • 180 journalists selected as potential targets
  • 85 human rights activists identified as potential targets
Le Monde (Sample of 50,000 Numbers)Over:

  • 15,000 potential targets in Morocco (2017-2019)
  • 10,000 potential targets in Mexico (2016-2017)
  • 1,400 potential targets in Saudi Arabia (2016-2019)
  • 800 potential targets in India (2017-2019)

These statistics reveal Pegasus surveillance’s extensive reach and diversity, affecting a wide range of individuals and countries with varying motivations and interests. Moreover, they show that Pegasus surveillance has been ongoing for several years without anyone detecting or stopping it.

In conclusion, these statistics provide a glimpse into the scale and diversity of Pegasus espionage. However, they are not exhaustive and may not fully reflect the true extent of Pegasus surveillance. To have a clearer and more complete picture of the victims and the consequences of Pegasus, access to the internal data of NSO Group and its clients would be necessary.

Pegasus Datasheet: a summary of the features and capabilities of Pegasus spyware

Pegasus is a spyware developed by the Israeli company NSO Group, designed for remote monitoring of mobile phone activities. Pegasus can infect smartphones and access their data, such as messages, calls, contacts, photos, videos, location, microphone, and camera. Pegasus can also control some functions of the phone, such as enabling or disabling Wi-Fi, Bluetooth, and more. Pegasus can infect phones through different methods, such as malicious link delivery or the insidious “zero-click” technique, which does not require any user interaction. The duration and frequency of Pegasus surveillance depend on the contract signed with NSO Group, which can vary from client to client.

Below is a datasheet detailing Pegasus, including price estimates and periodicity:

CHARACTERISTICVALUEATTACK VECTOR
NamePegasus 
DeveloperNSO Group 
TypeSpyware 
FunctionRemote monitoring of mobile phone activities 
Infection MethodMalicious link delivery or the insidious “zero-click” techniqueEmail, SMS, Web Browsing, WhatsApp, Zero-Click
Data AccessMessages, calls, contacts, photos, videos, location, microphone, camera 
Function AccessCapable of enabling/disabling Wi-Fi, Bluetooth, and more 
PeriodicityVaried, dependent on contract duration and frequency of updates 
Price Estimate$7 to $20 million per year for 50 to 100 smartphones

Assessing the Pegasus Threat Level After Security Updates and Utilizing Anti-Pegasus Tools

Pegasus is a spyware that exploits security flaws in the operating systems of phones, such as iOS or Android. To reduce the level of threat of Pegasus, one of the ways is to update and patch these operating systems regularly, to fix the vulnerabilities that Pegasus can use.

How security updates can protect the devices from Pegasus

In September 2021, Apple released iOS 14.8 and macOS 11.6 as security updates to protect its devices from the zero-click exploit used by Pegasus. Citizen Lab discovered this exploit, called FORCEDENTRY, in August 2021. FORCEDENTRY allowed Pegasus to infect iPhones without any user interaction. Apple urged its users to install the updates as soon as possible to protect themselves from Pegasus.

Google also released security updates for Android devices in August 2021, according to Linternaute. These updates fixed several vulnerabilities that Pegasus or other spyware could exploit. Google did not specify if these vulnerabilities were related to Pegasus, but it advised its users to update their devices regularly to ensure their security.

However, updating and patching the operating systems may not be enough to prevent or detect Pegasus infections. Pegasus can adapt to security updates and use new exploits that security experts have not yet discovered or fixed.

Advanced Detection and Protection Against Pegasus Spyware

In the ongoing effort to combat the sophisticated Pegasus spyware, cybersecurity experts have developed advanced tools and methods to detect and neutralize such threats. Kaspersky, a leader in global cybersecurity, has recently unveiled a groundbreaking approach that enhances our capability to identify and mitigate the impact of iOS spyware including Pegasus, as well as newer threats like Reign and Predator.

Kaspersky’s Innovative Detection Method

Leveraging the untapped potential of forensic artifacts, Kaspersky’s Global Research and Analysis Team (GReAT) has introduced a lightweight yet powerful method to detect signs of sophisticated spyware infections. By analyzing the Shutdown.log found within the iOS sysdiagnose archive, researchers can now identify anomalies indicative of a Pegasus infection, such as unusual “sticky” processes. This method provides a minimally intrusive, resource-efficient way to pinpoint potential spyware compromises.

Empowering Users with Self-Check Capabilities

To democratize the fight against spyware, Kaspersky has developed a self-check tool available to the public. This utility, based on Python3 scripts, allows users to independently extract, analyze, and interpret data from the Shutdown.log file. Compatible with macOS, Windows, and Linux, this tool offers a practical solution for users to assess their devices’ integrity.

Comprehensive User Protection Strategies

Beyond detection, protecting devices from sophisticated spyware demands a multifaceted approach. Kaspersky recommends several proactive measures to enhance device security:

  • Reboot Daily: Regular reboots can disrupt the persistence mechanisms of spyware like Pegasus, which often relies on zero-click vulnerabilities for infection.
  • Enable Lockdown Mode: Apple’s Lockdown Mode has shown effectiveness in thwarting malware infections by minimizing the attack surface available to potential exploiters.
  • Disable iMessage and Facetime: Given their popularity as vectors for exploitation, disabling these services can significantly reduce the risk of infection.
  • Stay Updated: Promptly installing the latest iOS updates ensures that known vulnerabilities are patched, closing off avenues for spyware exploitation.
  • Exercise Caution with Links: Avoid clicking on unsolicited links, a common method for delivering spyware through social engineering tactics.
  • Regular Checks: Utilizing tools like MVT (Mobile Verification Toolkit) and Kaspersky’s utilities to analyze backups and sysdiagnose archives can aid in early detection of malware.

By integrating these practices, users can significantly bolster their defenses against the most advanced spyware, reducing the likelihood of successful infiltration and ensuring greater digital security and privacy.

Technological Innovations in Spyware Defense: The Case of DataShielder NFC HSM

As nations grapple with policy measures to regulate the use of commercial spyware, technological innovators like Freemindtronic are stepping up to offer robust defenses for individuals against invasive tools like Pegasus. The DataShielder NFC HSM Defense, equipped with EviCore NFC HSM technology, represents a leap forward in personal cybersecurity, offering a suite of features designed to safeguard data and communications from sophisticated spyware threats.

DataShielder NFC HSM: A Closer Look

DataShielder NFC HSM Defense utilizes contactless encryption and segmented key authentication, securely stored within an NFC HSM, to protect users’ digital lives. This groundbreaking approach ensures that secret keys, the cornerstone of digital security, remain out of reach from spyware, thus maintaining the confidentiality and integrity of sensitive information across various communication protocols.

DataShielder NFC HSM Defense: a solution against spyware

Another technology can help users protect themselves from Pegasus and other spyware. This is DataShielder NFC HSM Defense with EviCore NFC HSM, a solution that effectively fights against applications and spyware such as Pegasus. It is an alternative that secures contactless encryption and segmented key authentication system stored encrypted in NFC HSM. Thus, the secret keys are physically externalized and not accessible to the spyware. DataShielder NFC HSM Defense with EviCypher NFC HSM encrypts all types of sensitive data without ever logging the data unencrypted. The user can encrypt all types of data from his contactless phone in volatile memory, including Email, SMS, MMS, RCS, Chat, all messaging in general, all types of messaging, including satellite, without ever saving his texts unencrypted. DataShielder NFC HSM also works in air gap as well as on all types of NFC, Wifi, Bluetooth, Lan, Wan, Camera communication protocols that it encrypts end-to-end from NFC HSM

DataShielder NFC HSM Defense: additional features

In the Defense version of DataShielder NFC HSM, it integrates EviCall NFC HSM technology, which allows users to physically outsource phone contacts and make calls by automatically erasing the call histories of the phone, including encrypted and unencrypted SMS linked to that call number.

DataShielder NFC HSM also includes Evipass NFC HSM contactless password manager technology. It is therefore compatible with EviCore NFC HSM Browser Extension technology. In particular, it carries out all types of autofill and autologin operations. Thus, DataShielder NFC HSM not only allows you to connect by autofilling the traditional login and password identification fields on the phone, whether through applications or online accounts. But also also and on the types of online accounts (lan and wan), applications, software. DataShielder NFC HSM Defense also includes EviKeyboard BLE technology which also extends the use of keys greater than 256 bit. This virtual Bluetooth keyboard allows you to authenticate on the command line, on all types of home automation, electronic, motherboard bios, TMP2.0 key, which accepts the connection of a keyboard on a USB port. All these operations are end-to-end encrypted from NFC HSM up to more than 50 meters away via Bluetooth encrypted in AES-128.

To encrypt sensitive data from their phone, the user will do it from their secret keys only stored in their NFC HSM. They can also do it from their computer using the NFC HSM. This is possible thanks to the interoperability and backward compatibility of the DataShielder NFC HSM Defense ecosystem, which works independently but is interoperable on all Android computer and telephone systems with NFC technology. For example, users can encrypt files, photos, videos, and audio on their phones without ever exposing them to security breaches on the phone or computer.

This is the EviCypher NFC HSM technology dedicated to the encryption and management of AES 256 and RSA 4096 encryption keys.

Similarly, DataShielder also includes EviOTP NFC HSM technology, also in DataShielder NFC HSM Defense, which secures and manages OTP (TOTP and HOTP) secret keys.

Here are all the links : EviPass NFC HSMEviOTP NFC HSMEviCypher NFC HSMEviCall NFC HSM, EviKeyboard BLE

DataShielder NFC HSM Defense vs Pegasus: a comparison table

DataPegasusDataShielder NFC HSM Defense
Messages, chatsCan read and record them unencryptedEncrypts them end-to-end with keys physically externalized in the NFC HSM
Phone contactsCan access and modify themExternalizes and encrypts them in the NFC HSM
EmailsCan intercept and read themEncrypts them with the OpenPGP protocol and signs them with the NFC HSM
PhotosCan access and copy themEncrypts them with the NFC HSM and stores them in a secure space
VideosCan watch and record themEncrypts them with the NFC HSM and stores them in a secure space
Encrypted messages scanned from the cameraCan decrypt them if he has access to the encryption keyEncrypts them with the NFC HSM and does not leave any trace of the encryption key
Conversation histories from contacts stored in the NFC HSMCan access and analyze themErases them automatically after each call or message
Usernames and passwordsCan steal and use themExternalizes and encrypts them in the NFC HSM with EviPass technology
Secret keys of OTPCan compromise and impersonate themExternalizes them physically in the NFC HSM with EviOTP technology

Bridging the Gap Between Technology and Privacy

In an era where spyware like Pegasus poses unprecedented threats to personal privacy and security, solutions like DataShielder NFC HSM Defense emerge as essential tools in the individual’s cybersecurity arsenal. By leveraging such technologies, users can significantly mitigate the risk of spyware infections, reinforcing the sanctity of digital privacy in the face of evolving surveillance tactics.

The level of threat of Pegasus in different cases

The level of threat of Pegasus depends on many factors, such as the type and version of the operating system, the frequency and quality of the updates and patches, the availability and effectiveness of the tools, and the behavior and awareness of the users. It is therefore difficult to measure it precisely or universally, as it may vary according to different scenarios and situations.

However, we can try to give some estimates or ranges of levels, based on assumptions or approximations. For example, we can use a scale from 1 (lowest) to 10 (highest) to indicate how likely it is for a device to be infected by Pegasus in different cases:

CaseLevel of threat
A device with an outdated operating system that has not been updated for a long time9/10
A device with an updated operating system that has been patched recently5/10
A device with an updated operating system that has been patched recently and uses antivirus software3/10
A device with an updated operating system that has been patched recently and uses antivirus software and VPN software2/10
A device with an updated operating system that has been patched recently and uses antivirus software, VPN software, and anti-spyware software1/10
A device with an updated operating system that has been patched recently and uses DataShielder NFC HSM0/10

Latest affairs related to Pegasus

Since the revelations of Forbidden Stories and Amnesty International in July 2021, several new developments have occurred in relation to Pegasus spying. Here are some of them:

  • October 2023, The former head of the Spanish intelligence services has been charged with spying on the regional president of Catalonia, Pere Aragonès, using the Pegasus software, the Spanish justice announced on Monday. Paz Esteban, who was dismissed last year by the government of Pedro Sánchez after the scandal broke out, has been summoned by the Barcelona judge in charge of the case on December 131. The judge said that the facts reported by the moderate separatist leader have the “characteristics” of “possible criminal offenses such as illegal wiretapping and computer espionage
  • In October 2021, Paz Esteban López, the former head of CNI, was charged with crimes against privacy and misuse of public funds for allegedly ordering the spying on Catalan politicians with Pegasus. She is the first high-ranking official to face legal consequences for using Pegasus in Spain.
  • In September 2021, NSO Group announced that it was temporarily suspending its services to several government clients after being accused of facilitating human rights abuses with Pegasus. The company did not specify which clients were affected by this decision.
  • In August 2021, Apple released an urgent security update for its devices after discovering a zero-click exploit that allowed Pegasus to infect iPhones without any user interaction. The exploit, called FORCEDENTRY, was used by NSO Group to target activists, journalists and lawyers around the world. Apple urged its users to install the update as soon as possible to protect themselves from Pegasus.
  • In July 2021, the French government launched an investigation into the alleged spying on President Emmanuel Macron and other senior officials by Morocco using Pegasus. Morocco denied any involvement in the spying and sued Amnesty International and Forbidden Stories for defamation. France also summoned the Israeli ambassador to Paris to demand explanations about NSO Group’s activities.
  • In July 2021, the Israeli government formed a task force to review the allegations against NSO Group and its export licenses. The task force included representatives from the defense, justice and foreign ministries, as well as from the Mossad and the Shin Bet. The task force was expected to report its findings within a few weeks.

These developments show that Pegasus spying has triggered legal, diplomatic and political reactions in different countries. They also show that Pegasus spying has exposed the vulnerabilities and the challenges of cybersecurity in the digital age.

International Policy Measures Against Spyware Misuse

In a landmark move reflecting growing global concern over the misuse of commercial spyware, the United States announced in February 2024 its decision to impose visa restrictions on individuals involved in the abuse of such technologies. This policy, aimed at curbing the proliferation of weapons-grade commercial spyware like Pegasus, marks a significant stride in international efforts to safeguard against digital espionage threats to national security, privacy, and human rights.

The US Stance on Spyware Regulation

The Biden administration’s policy will potentially impact major US allies, including Israel, India, Jordan, and Hungary, underscoring the administration’s commitment to countering the misuse of spyware. This comes on the heels of earlier measures, such as placing Israel’s NSO Group on a commerce department blacklist and prohibiting the US government’s use of commercial spyware, signaling a robust stance against the unregulated spread of spyware technologies.

Global Implications and Diplomatic Efforts

Secretary of State Antony Blinken’s statement linking the misuse of spyware to severe human rights violations highlights the gravity with which the US views the global spyware issue. The policy introduces a mechanism for enforcing visa restrictions on those believed to be involved in or benefiting from the misuse of spyware, sending a strong message about the US’s intolerance for such practices.

A Step Towards Greater Accountability

By targeting individuals involved in the surveillance, harassment, and intimidation of journalists, activists, and dissenters, the US aims to foster a more accountable and ethical global spyware industry. This visa ban, applicable even to individuals from visa waiver countries, represents an “important signal” about the risks associated with the spyware sector, emphasizing the need for international cooperation in addressing these challenges.

Spyware with multiple detrimental impacts

Pegasus is not only a spyware with a high financial cost for its users, but it also entails, whether it is used legitimately or not, a human, social, political and environmental cost for its victims and society as a whole. It is difficult to precisely quantify the cost of the damages caused by the use of Pegasus due to numerous factors and variables that can vary across countries, sectors and periods. However, we can provide some rough estimates and examples to illustrate the scope and diversity of the impacts of the use of Pegasus.

Financial Cost

The financial cost of the damages inflicted by Pegasus can be measured on several fronts:

  • Cost to Victims: Individuals spied on by Pegasus may suffer direct or indirect financial losses, stemming from breaches of their privacy, disclosure of personal or professional information, manipulation, or theft of their financial or tax-related data. For example, a journalist might lose their job or credibility due to information revealed by Pegasus; a lawyer could lose a lawsuit or a client due to a disclosed strategy, and an activist might lose funding or security due to an exposed campaign.
  • Cost to Businesses: Companies targeted by Pegasus may face direct or indirect financial losses related to intellectual property violation, unfair competition, industrial espionage, corruption, and more. For instance, a business could lose a contract or market share because of exposed bids; its reputation and trustworthiness could suffer due to a Pegasus-related scandal, and its competitiveness and profitability could diminish from a compromised trade secret.
  • Cost to States: Nations subject to Pegasus espionage may experience direct or indirect financial losses tied to sovereignty violations, threats to national security, interference in domestic and foreign affairs, among others. An example includes a country’s stability or legitimacy being jeopardized due to a Pegasus-facilitated coup; a nation losing influence or alliances because of negotiations undermined by Pegasus; or a state’s development or environment suffering from a Pegasus-sabotaged project.

Geopolitical Cost

The geopolitical cost of Pegasus-induced damages can be measured on various fronts:

  • Cost to International Relations: The use of Pegasus by some states to spy on others can lead to diplomatic tensions, armed conflicts, economic sanctions, and cooperation ruptures. For example, the espionage of French President Emmanuel Macron by Morocco triggered a crisis between the two nations; spying on Indian Prime Minister Narendra Modi by China escalated their border dispute, and Israeli espionage of Iranian President Hassan Rouhani compromised the nuclear agreement between the two countries.
  • Cost to International Organizations: Pegasus’ deployment by certain states to spy on international organizations can result in violations of international law, human rights abuses, and hindrances to multilateralism. For instance, spying on UN Secretary-General Antonio Guterres by the United States undermined the organization’s independence and impartiality. Similarly, espionage targeting the International Criminal Court by Israel threatened international justice and peace, while spying on the World Health Organization by China disrupted pandemic management.

Economic Cost

The economic cost of the damages caused by Pegasus can be assessed across different dimensions:

  • Cost to Economic Growth: The use of Pegasus by certain states or private actors to spy on other states or private actors can lead to market distortions, productivity losses, capital flight, and offshoring. For example, the espionage targeting the airline company Emirates by Qatar reduced its competitiveness and profitability. Similarly, spying on the oil company Petrobras by the United States triggered an economic and political crisis in Brazil. Additionally, spying on Mexico’s central bank by Venezuela facilitated money laundering and terrorism financing.
  • Cost to Innovation: The utilization of Pegasus by certain states or private actors to spy on other states or private actors can result in patent theft, counterfeiting, hacking, and cyberattacks. For instance, spying on pharmaceutical company Pfizer by China allowed the latter to replicate its COVID-19 vaccine. Simultaneously, espionage against technology giant Apple by North Korea enabled the creation of its smartphone. Furthermore, spying on space company SpaceX by Russia allowed the latter to sabotage its launches.

Human, Social, and Environmental Cost

The human, social, and environmental cost of Pegasus-induced damages can be measured across several aspects:

  • Cost to Human Rights: The use of Pegasus by certain states or private actors to spy on vulnerable individuals or groups can result in violations of the right to life, freedom, security, dignity, and more. For example, the spying on journalist Jamal Khashoggi by Saudi Arabia led to his assassination. Similarly, espionage targeting activist Edward Snowden by the United States led to his exile. Additionally, the espionage of dissident Alexei Navalny by Russia resulted in his poisoning.
  • Cost to Democracy: The deployment of Pegasus by certain states or private actors to spy on political or social actors can lead to infringements on pluralism, transparency, participation, representativeness, and more. For instance, spying on French President Emmanuel Macron by Russia attempted to influence the 2017 French presidential election. Similarly, spying on the Yellow Vest movement by Morocco aimed to weaken the French social movement in 2018. Additionally, espionage against President Joe Biden by Iran sought to infiltrate his transition team in 2020.
  • Cost to the Environment: The use of Pegasus by certain states or private actors to spy on organizations or individuals committed to environmental protection can result in damage to biodiversity, climate, natural resources, and more. For example, spying on Greenpeace by Japan hindered its efforts against whale hunting. Similarly, espionage against the WWF by Brazil facilitated deforestation in the Amazon. Additionally, the spying on climate activist Greta Thunberg by Russia aimed to discredit her climate movement.
  • Cost to Intangibles: The use of Pegasus by certain states or private actors to spy on individuals or groups with symbolic, cultural, moral, or spiritual value can result in losses of meaning, trust, hope, or faith. For instance, espionage against Pope Francis by Turkey undermined his moral and religious authority. Similarly, spying on the Dalai Lama by China compromised his spiritual and political status. Additionally, the espionage of Nelson Mandela by South Africa tarnished his historical and humanitarian legacy.

The Risk of Diplomatic Conflict Arising from Pegasus

The utilization of Pegasus by some states to spy on others can give rise to the risk of diplomatic conflict, which can have severe consequences for international peace and security. The likelihood of diplomatic conflict depends on several factors, including:

  • Intensity and Duration of Espionage: The more extensive and prolonged the espionage, the more likely it is to provoke a strong and lasting reaction from the spied-upon state.
  • Nature and Status of Targets: More important and sensitive targets are more likely to trigger a strong and immediate reaction from the spied-upon state. For instance, spying on a head of state or a minister is more serious than spying on a bureaucrat or diplomat.
  • Relationship and Context Between States: States with tense or conflictual relationships are more likely to provoke a strong and hostile reaction from the spied-upon state. For instance, espionage between rival or enemy states is more serious than espionage between allied or neutral states.

The risk of diplomatic conflict can manifest at various levels:

  • Bilateral Level: This is the most direct and frequent level, where two states clash due to espionage. Possible reactions include official protests, summoning or expelling an ambassador, breaking or freezing diplomatic relations, etc.
  • Regional Level: This level involves a state seeking support from its neighbors or regional partners to bolster its position or condemn the espionage. Possible reactions include joint declarations, collective resolutions, economic or political sanctions, etc.
  • International Level: At this level, a state calls upon international organizations or global actors to support its position or condemn the espionage. Possible reactions include referring the matter to an international court, resolutions by the UN Security Council, humanitarian or military sanctions, etc.

The risk of diplomatic conflict can have various consequences:

  • Political Consequences: It can lead to a deterioration or rupture of relations between the involved states, a loss of credibility or legitimacy on the international stage, internal political instability or crisis, etc.
  • Economic Consequences: It can result in reduced or suspended trade between the involved states, a loss of competitiveness or growth, capital flight or frozen investments, etc.
  • Social Consequences: It can lead to increased or exacerbated tensions or violence among the populations of the involved states, a loss of trust or solidarity, a rise or reinforcement of nationalism or extremism, etc.

Conclusion: Navigating the Pegasus Quagmire with Innovative Defenses

The saga of Pegasus spyware unveils a complex tableau of financial, human, social, political, and environmental ramifications. Pinpointing the exact toll it takes presents a formidable challenge, given the myriad of factors at play. Throughout this article, we’ve endeavored to shed light on the extensive impacts, offering insights and quantifications to bring clarity to this global concern.

Moreover, Pegasus not only incurs a direct cost but also sows the seeds of potential diplomatic strife, pitting states against each other in an invisible battlefield. The severity of these confrontations hinges on the espionage’s scope, the targets’ sensitivity, and the intricate web of international relations. Such conflicts, manifesting across various levels, can significantly strain political ties, disrupt economies, and fracture societies.

In this digital quagmire, the innovative counter-espionage technologies developed by Freemindtronic emerge as a beacon of hope. They offer a testament to the power of leveraging cutting-edge solutions to fortify our digital defenses against the invasive reach of spyware like Pegasus. By integrating such advanced protective measures, individuals and organizations can significantly enhance their cybersecurity posture, safeguarding their most sensitive data and communications in an increasingly surveilled world.

This piece aims to illuminate the shadowy dynamics of Pegasus spyware, drawing back the curtain on its profound implications. For those keen to explore further, we invite you to consult the sources listed below. They serve as gateways to a deeper understanding of Pegasus’s pervasive influence, the ongoing efforts to counteract its invasive reach, and the pivotal role of technologies like those from Freemindtronic in these endeavors.

In a world where digital surveillance perpetually evolves, staying informed, vigilant, and equipped with the latest in counter-espionage technology is paramount. As we navigate these challenges, let us engage in ongoing dialogue, advocate for stringent regulatory measures, and champion the development of robust cybersecurity defenses. Together, we can confront the challenges posed by Pegasus and similar technologies, safeguarding our collective privacy, security, and democratic values in the digital age.

Sources

In crafting this article, we have drawn upon a selection of reputable and verified web sources. Our sources are chosen for their commitment to presenting facts objectively and respecting the presumption of innocence.

This article has been meticulously crafted, drawing upon a diverse array of reputable and verified web sources. These sources have been selected for their unwavering commitment to factual accuracy, objective presentation, and respect for the presumption of innocence. Our investigation delves deep into the complex web of surveillance technology, focusing on the notorious Pegasus spyware developed by NSO Group and the global efforts to detect, regulate, and mitigate its invasive reach. The article sheds light on groundbreaking detection methods, international policy measures against spyware misuse, and the pressing need for enhanced cybersecurity practices.

We analyzed many sources including:

In summary

Additional references from a range of international publications provide further insights into the deployment, implications, and countermeasures associated with Pegasus spyware across various countries, including Saudi Arabia, Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Hungary, India, and the United Arab Emirates. These articles collectively highlight the global challenge posed by Pegasus, the evolving landscape of digital espionage, and the concerted efforts required to safeguard privacy and security in the digital age.

Estimating the Global Reach and Financial Implications of Pegasus Spyware

The deployment of Pegasus spyware across various nations reveals not only the extensive reach of NSO Group’s surveillance tool but also underscores the significant financial and ethical costs associated with its use. The following insights, derived from reputable news sources, offer a glimpse into the scale of Pegasus’s deployment worldwide and its impact on targeted countries:

  1. According to the French Le Monde, Saudi Arabia targeted about 15,000 phone numbers with Pegasus. The cost of one license can be as high as Rs 70 lakh. With one license, multiple smartphones can be tracked. As per past estimates of 2016, for spying on just 10 people using Pegasus, NSO Group charges a minimum of around Rs 9 crore.
  2. The American The Washington Post reported that Saudi Arabia started using Pegasus in 2018. The FBI also confirmed that it obtained NSO Group’s powerful Pegasus spyware in 2019, suggesting that it bought access to the Israeli surveillance tool to “stay abreast of emerging technologies and tradecraft”.
  3. The British The Guardian stated that Azerbaijan aimed at about 5,000 phone numbers with Pegasus. The country is among the 10 governments that have been the most aggressive in deploying the spyware against their own citizens and those of other countries.
  4. As per the American The Washington Post, Azerbaijan began using Pegasus in 2019. The country has been accused of using the spyware to target journalists, activists, and opposition figures, as well as foreign diplomats and politicians.
  5. In the case reported by the French Le Monde, Bahrain focused on about 3,000 phone numbers with Pegasus. The country has been using the spyware since 2020 to target dissidents, human rights defenders, and members of the royal family.
  6. Mentioned in the American The Washington Post, Bahrain initiated Pegasus use in 2020. The country is one of the NSO Group’s oldest customers, having signed a contract with the company in 2016.
  7. As disclosed by the British The Guardian, Kazakhstan directed attention towards approximately 1,500 phone numbers with Pegasus. The country has been using the spyware since 2021 to target journalists, activists, and opposition figures, as well as foreign diplomats and politicians.
  8. According to the American The Washington Post, Kazakhstan commenced Pegasus usage in 2021. The country is one of the newest customers of NSO Group, having signed a contract with the company in 2020.
  9. According to claims made by the Mexican Aristegui Noticias, Mexico targeted about 15,000 phone numbers with Pegasus. The country is the largest known client of NSO Group, having spent at least $61m on the spyware between 2011 and 2017.
  10. As reported by the American The Washington Post, Mexico began Pegasus use in 2020. The country has been using the spyware to target journalists, activists, lawyers, and politicians, as well as the relatives of the 43 students who disappeared in 2014.
  11. As detailed in the French Le Monde, Morocco focused on about 10,000 phone numbers with Pegasus. The country is one of the most prolific users of the spyware, having targeted journalists, activists, lawyers, and politicians, as well as foreign heads of state and government.
  12. Confirmed by the Canadian organization Citizen Lab, Morocco initiated Pegasus usage in 2016. The country is one of the oldest customers of NSO Group, having signed a contract with the company in 2014.
  13. According to findings reported by the British The Guardian, Rwanda honed in on around 3,500 phone numbers with Pegasus. The country has been using the spyware to target dissidents, journalists, and human rights defenders, as well as foreign critics and rivals.
  14. As indicated by the American The Washington Post, Rwanda started Pegasus usage in 2019. The country is one of the newest customers of NSO Group, having signed a contract with the company in 2018.
  15. In the report from the French Le Monde, Hungary aimed at about 300 phone numbers with Pegasus. The country is the only EU member state known to have used the spyware, having targeted journalists, activists, lawyers, and opposition figures.
  16. As conveyed by the Hungarian Direkt36, Hungary initiated Pegasus use in 2018. The country is one of the newest customers of NSO Group, having signed a contract with the company in 2017.
  17. As outlined in the Indian The Wire, India directed attention towards approximately 1,000 phone numbers with Pegasus. The country is one of the largest users of the spyware, having targeted journalists, activists, lawyers, and politicians, as well as the leader of the main opposition party.
  18. According to the British The Guardian, India began Pegasus use in 2019. The country is one of the newest customers of NSO Group, having signed a contract with the company in 2018.
  19. According to the information provided by the French Le Monde, the United Arab Emirates honed in on around 10,000 phone numbers with Pegasus. The country is one of the most aggressive users of the spyware, having targeted journalists, activists, lawyers, and politicians, as well as foreign heads of state and government.
  20. Confirmed by the Canadian organization Citizen Lab, the United Arab Emirates started Pegasus usage in 2016. The country is one of the oldest customers of NSO Group, having signed a contract with the company in 2013.
  21. According to the European Parliament recommendation of 15 June 2023, the EU and its Member States have been affected by the use of Pegasus and equivalent surveillance spyware, which constitutes a serious threat to the rule of law, democracy, human rights and fundamental freedoms. The recommendation calls for a global moratorium on the sale and use of such technologies until robust safeguards are established.
  22. According to the article by Malwarebytes, Pegasus spyware and how it exploited a WebP vulnerability, the spyware exploited a vulnerability in the WebP image format, which allows for lossless compression and restoration of pixels. The article explains how the attackers created specially crafted image files that caused a buffer overflow in the libwebp library, used by several programs and browsers to support the WebP format.
  23. According to the article by ZDNet, ‘Lawful intercept’ Pegasus spyware found deployed in 45 countries, the spyware has been used by government agencies across the world to conduct cross-border surveillance, violating international law and human rights. The article cites a report by Citizen Lab, which identified 45 countries where Pegasus operators may be conducting surveillance operations.
  24. According to the article by The Guardian, Experts warn of new spyware threat targeting journalists and political opponents, a new spyware with hacking capabilities comparable to Pegasus has emerged, developed by an Israeli company called Candiru. The article cites a report by Citizen Lab, which found evidence that the spyware has been used to target journalists, political opposition figures and an employee of an NGO.

Protect yourself from Pegasus spyware with EviCypher NFC HSM

Protect yourself from Pegasus Spyware with EviCypher NFC HSM and EviCore NFC HSM by Freemindtronic technology from Andorra

Pegasus Spyware Protection by Jacques Gascuel: This article will be updated with any new information on the topic.  

Pegasus spyware protection

Pegasus is a spyware that can hack your phone and spy on your confidential information. It has been used to attack sensitive people like journalists or politicians. Freemindtronic, an Andorran company specialized in NFC security, anti-spy and counter-espionage, offers you EviCypher NFC HSM, a device that allows you to store and manage your keys and secrets securely. With EviCypher NFC HSM, you can encrypt and decrypt your data, sign and verify your documents, authenticate and control your access, without fear of Pegasus or any other spyware accessing your data.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

How to protect yourself from Pegasus spyware with EviCypher NFC HSM

Pegasus Spyware: what it is, how it works, and how to protect yourself with EviCypher NFC HSM. In this article, we will tell you about Pegasus spyware. A global investigation revealed its misuse by governments and intelligence agencies. They target and spy on personalities around the world. We will explain what Pegasus is, how it works, who developed and sold it, and how it violated human rights, free speech, and democracy. We will also give you tips to protect yourself from this malware with EviCypher NFC HSM technology. It uses a contactless hardware security module (NFC HSM). That is, an innovative security device that lets you encrypt your data and communications on your mobile phone with your own keys that you created and stored offline.

What is Pegasus spyware and how does it work?

The features and capabilities of Pegasus spyware

Pegasus spyware is a malware that can hack your phone and access your data, calls, location, camera, and microphone. It can use security flaws in Android and iOS: silent installation. Spyware activation: missed call or hidden message.

Once installed on a phone, Pegasus spyware gains full access to SMS messages, emails, photos, contacts, calendar, GPS data, logs, and any apps and data the phone contains. In fact, the spyware can even gain access to encrypted data and messages by intercepting them prior to the encryption process. Pegasus spyware can transmit all this information to a remote server controlled by the attacker. Pegasus spyware can also self-destruct or hide its traces if it detects any attempt to detect or remove it.

The developer and seller of Pegasus spyware

NSO Group, an Israeli company founded in 2010 by ex-members of Unit 8200, develops Pegasus spyware. The Israeli military’s cyber intelligence unit. NSO Group sells its product only to government and law enforcement agencies: rescue and crime-fighting purposes. However, accusations against NSO Group: spyware sales to authoritarian regimes and human rights abusers.

How Pegasus spyware has been used to target and spy on people around the world

The Pegasus Project: a global investigation into Pegasus spyware

July 2021: seventeen media outlets exposed Pegasus spying on leaders, activists, journalists and dissidents, leading to “global human rights violations.

The Pegasus Project was led by Forbidden Stories, a Paris-based nonprofit journalism organization, and Amnesty International’s Security Lab, which analyzed the phones of the victims. They revealed that NSO Group’s clients selected over 50,000 phone numbers for surveillance since 2016.

The high-profile targets of Pegasus spyware

NSO Group’s clients selected phone numbers of three presidents (Macron, Ramaphosa and Salih), 10 prime ministers (Khan, Madbouly, El Othmani, Modi, Orbán, bin Daghr, Hariri, Bedoui, Sagintayev and Michel) and one king (Mohammed VI).

The investigation also found at least 180 journalists from 20 countries targeted by Pegasus spyware. They included reporters from CNN , NYT , WSJ , Guardian , Al Jazeera , Le Monde , FT , WP , Reuters , Bloomberg , AP.

Furthermore , the investigation showed evidence of Pegasus spyware infections or attempts on at least 37 phones of journalists , activists , and executives from 10 countries. They were from India , Mexico , France , Morocco , Hungary , Azerbaijan , Bahrain , Saudi Arabia , UAE , and Rwanda.

Some of the other countries and people that have been reportedly targeted by Pegasus spyware are:

  • Azerbaijan: to spy on opposition politicians such as Ali Karimli and journalists such as Khadija Ismayilova in 2019
  • Bahrain: to spy on activists such as Nabeel Rajab and Moosa Abd-Ali Ali in 2020
  • Hungary: to spy on journalists such as Szabolcs Panyi and politicians such as Bernadett Szél in 2019
  • Kazakhstan: to spy on journalists such as Aigul Utepova and activists such as Serikzhan Bilash in 2020
  • UAE: to spy on Princess Latifa, the daughter of Dubai’s ruler who tried to escape in 2018
  • USA: to spy on Jeff Bezos, the founder and CEO of Amazon, who had his phone hacked by Pegasus spyware in 2018 after he received a WhatsApp message from Mohammed bin Salman, the crown prince of Saudi Arabia

These cases show that Pegasus spyware has been used to violate human rights, free speech, and democracy around the world. The victims of Pegasus spyware have faced harassment, intimidation, arrest, torture, or assassination because of their work or opinions.

The latest news on Pegasus and its consequences

Since we published our article, there have been several important developments regarding Pegasus and its impact on the security and privacy of mobile phone users. Here is a summary of the latest news on Pegasus, sorted by descending chronological order:

Algeria launches an investigation into allegations related to Pegasus spyware

On July 21, 2023, Hindustan Times reported that Algeria had launched an investigation into allegations related to Pegasus spyware. The Algerian attorney general announced that he would open an investigation into the allegations that Pegasus spyware had been used to spy on Algerian personalities, including President Abdelmadjid Tebboune and Army Chief of Staff Saïd Chengriha. According to an investigation conducted by the Forbidden Stories consortium and Amnesty International, and published by several international media outlets, Algeria was among the 50 countries whose phone numbers had been selected as potential targets by NSO Group’s clients, who are mainly governments and intelligence agencies. The investigation revealed that more than 600 Algerian personalities had been targeted by Pegasus between 2017 and 2021, including ministers, diplomats, journalists, activists, political opponents and civil society members. The investigation also suggested that Morocco was the main user of Pegasus in North Africa, and that it had spied on its Algerian neighbors for geopolitical and security reasons. The Algerian attorney general said that he would conduct a “thorough and serious” investigation into this matter, and that he would cooperate with the judicial authorities of the countries concerned. He also said that Algeria condemned “firmly” any violation of its national sovereignty and the privacy of its citizens.

This case shows that Pegasus poses a threat to the sovereignty and security of African countries, which are often victims of foreign interference. It also shows that Algeria takes seriously the protection of its citizens from illegal spying. We applaud the initiative of the Algerian attorney general to open an investigation on this subject.

The Spanish investigation into Pegasus spyware is closed due to “total lack of cooperation” from Israel

On July 10, 2023, The Times of Israel revealed that the Spanish investigation into Pegasus spyware had been closed due to “total lack of cooperation” from Israel. A Spanish judge was investigating the alleged hacking of phones of Spanish ministers with Pegasus spyware, made by the Israeli company NSO Group. The judge had asked four times the Israeli government to provide him with information on the software and to allow him to interrogate NSO Group’s CEO, but he never received a response. The judge therefore decided to close provisionally the case, citing the “total lack of cooperation” from Israel, which prevented the investigation from progressing. The judge indicated that the only possible recourse was diplomatic pressure, to urge Israel to respect its obligations under international treaties.

This case shows that Pegasus raises a legal and ethical problem, which requires international cooperation to enforce law and justice. It also shows that Israel displays a lack of transparency and accountability on its activities related to Pegasus spyware. We regret Israel’s attitude, which hinders the Spanish investigation and which does not respect its international commitments.

The FBI used Pegasus spyware to spy on iPhones, in violation of the US ban

On August 1st, 2023, Mac4Ever revealed that the FBI had used Pegasus spyware to spy on iPhones, in violation of the ban imposed by the US government in November 2021. According to the information published by The New York Times and The Guardian, the FBI had acquired Pegasus spyware in 2019, under Trump’s administration, for 9 million dollars. The bureau had tried to access data from some iPhones, including those of US officials in Uganda, without their consent or knowledge. The FBI had also used another product from NSO Group, Landmark, which allows locating phones through flaws in cellular networks. This product had been used by a subcontractor of the FBI to track drug traffickers in Mexico, without informing the FBI of the origin of the product. The FBI had terminated the contract with the subcontractor and opened an internal investigation into this matter.

This case shows that Pegasus represents a danger for the privacy and human rights of mobile phone users, including in the US. It also shows that the FBI acted in contradiction with US foreign policy and national security, which placed NSO Group on a blacklist in November 2021. It finally shows that the FBI was deceived by a subcontractor who provided it with an illegal and insecure product. We denounce the use of Pegasus spyware by the FBI and we demand an independent investigation into this case.

By summarizing the latest news on Pegasus and its consequences, we show that the threat is still present and that it is urgent to protect yourself from this spyware with Evicypher NFC HSM.

How to detect and remove Pegasus spyware?

Pegasus is a malicious software that can hack your phone and access your data, calls, location, camera and microphone. It can use security flaws in Android and iOS to install silently and activate by a missed call or a hidden message.

If you suspect that you have Pegasus spyware on your phone, you can use a tool called MVT (Mobile Verification Toolkit) to scan your phone and check for traces of infection. MVT is a free tool developed by Amnesty International’s Security Lab. It works for both iOS and Android phones, but it requires some technical skills and a computer to run it.

To use MVT, you need to follow these steps:

  • Back up your phone to a computer using iTunes (for iOS) or ADB (for Android)
  • Download and install MVT on your computer using Python
  • Download the Indicators of Compromise (IOC) file from Amnesty International’s GitHub repository
  • Run MVT on your computer and point it to the backup of your phone and the IOC file
  • Read the analysis report and look for signs of infection
  • If MVT finds evidence of Pegasus spyware on your phone, you should take immediate action to remove it and protect yourself. Here are some recommendations:
    • Erase your phone and restore it to factory settings
    • Change all your passwords and enable two-factor authentication
    • Contact a trusted expert or organization for further assistance
    • Report the incident to the authorities or the media

You can find more detailed instructions on how to use MVT and what to do if you are infected on Amnesty International’s website or on The Verge’s guide. You can also use iMazing’s spyware detection tool for iOS devices, which is easier to use than MVT but less comprehensive.

Pegasus is a serious threat to your privacy and security. You should be aware of the risks and take precautions to protect yourself. EviCypher NFC HSM is a powerful solution that can help you encrypt your data and your communications on your mobile phone with your own keys. You can also use MVT or iMazing’s tool to detect and remove Pegasus spyware if you think you are infected. Stay safe and vigilant!

How EviCypher NFC HSM can protect you from Pegasus spyware

EviCypher NFC HSM: features and capabilities

EviCypher NFC HSM Technology: encryption via a Contactless Hardware Security Module (NFC HSM) designed and manufactured by Freemindtronic, an Andorrane R&D company in cyber, safety, security and anti spy.

EviCypher NFC HSM: store your keys and secrets in a contactless NFC device, like a card, sticker, or keychain. The Android phone’s NFC signal powers the device and serves as the terminal and UI. The device can store up to 200 secrets in its EEPROM memory.

The device: patented wireless access control system for two access profiles: administrator and users. Share your secrets without compromising your privacy. Patented authentication system by segmented key for up to 9 trust criteria to encrypt your secrets, such as geolocation, BSSID, password, or fingerprint.

Evicypher NFC HSM: Use your secrets without constraint with different Android NFC phone and all types of computers via extensions for web browser and web courier and open source Thunderbird. Share your secrets safely and with confidence offline and in Gap air. That is to say physically isolated from networks. In addition, you can share your secrets proximity by Bluetooth ADHOC or via a simple QR code encrypted in RSA 4096. You can thus encrypt or oversee all your favorite email types from your NFC HSM. It is contactless encryption between human being, without leaving any traces of your secrets in your phones or computers.

Products and services based on EviCypher NFC HSM technology

EviCypher NFC HSM: based on EviCore NFC HSM Technology, one of Freemindtronic’s white label products and services with patented technologies. Only available under patent license for white label products integration.

Evicypher NFC HSM: double-use version for civil and defense purposes , with reinforced security for your secrets , using more hidden and/or shared trust criteria , unknown to the user , preventing physical or legal threats from obtaining them . This version: for sovereign entities , like armed forces or secret services , needing more protection against espionage threats like PEGASUS spy software.

How to get and use EviCypher NFC HSM

Anonymously, with Freemindtronic Install on your NFC Android phone, create and store your secrets in an NFC HSM. Define your access profiles and trust criteria for each secret. Use your unlimited secrets with different NFC Android phones. Use your usual communications without changing your habits, email, webmail, chat, SMS, instant messaging, to encrypt them without contact just by passing the NFC HSM from Freemindtronic under the NFC antenna of your phone. Share your secrets with others who also have NFC HSM compatible with EviCypher NFC HSM technology.

To use EviCypher NFC HSM: Android phone with NFC and Freemindtronic app [here]. NFC device compatible with EviCore NFC HSM technology, such as Datashielder product with EviCypher NFC HSM and EviPass NFC HSM technologies. You will have the choice of different models and designs manufactured by Freemindtroic the Freemindtronic website click [here] to find out more.

EviCypher NFC HSM is a technology that allows you to fight against Pegasus spyware by securing your keys and secrets with hardware encryption and NFC. With EviCypher NFC HSM, you benefit from an innovative, practical and flexible solution for your personal or professional needs.

If you are interested in obtaining Evicypher NFC HSM technology and using it for your personal or professional needs, you can contact Freemindtronic by clicking [here]. You can also consult on the site how Evicypher NFC HSM technology works by clicking [here].

Conclusion and recommendations

Pegasus spyware: a privacy and human rights threat needing urgent action and regulation. Amnesty International calls for a global moratorium on surveillance technology sales and use until a human rights-compliant framework exists.

Evicypher NFC HSM: A technology to help you protect yourself from spyware like Pegasus with contactless encryption from a NFC HSM device without ever keeping clear data in the phone and/or computer with the possibility of deciphering the encrypted messages in AES256 Post quantum in GPA air via an QR code encrypted in RSA-4096 from the NFC HSM. Freemindtronic, a research and development company of safety, security, cyber security and andorran spying solution, which develops and offers various NFC HSM format and services available under white brand license with patented technologies.

Evicypher NFC HSM: Use your secrets without constraint with various NFC Android phones and all types of computers via extensions for web browser and web mail and Thunderbird source. Share your secrets safely and with confidence offline and in Gap Air. That is to say physically isolated from networks. In addition, you can share your secrets by Bluetooth Adhoc proximity or via a simple QR code encrypted in RSA 4096. You can quantify in seconds all your texts and parts attached for all your favorite messaging from your NFC HSM. It is contactless encryption between humans, without leaving traces of your secrets in your phones or computers.

Ommic case: How a French company allegedly handed over military secrets to China and Russia

Ommic case: The story of a French semiconductor company accused of spying for China and Russia

Ommic case by Jacques Gascuel: This article will be updated with any new information on the topic.  

Ommic case: A scandal of military industrial espionage

Ommic, a French semiconductor company, suspected of spying for China and Russia. Alleged delivery of military material and processes for radars, missiles or drones. Economic and political consequences for France and Europe. Questions about the protection and control of dual-use technologies. Article on the Ommic case, the technological secrets, the measures taken by the French government and other cases of military industrial espionage in the world.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

Ommic case: The story of a French semiconductor company accused of spying for China and Russia

The Ommic case is a scandal of industrial espionage that involves a French company specialized in the manufacture of high-tech semiconductors. According to the charges brought by the French justice, Ommic would have delivered to China and Russia material and processes sensitive to the military, used in particular by the French army. The French general manager of the company, as well as three other people, were indicted in March 2023 for “delivery to a foreign power of processes, documents or files likely to harm the fundamental interests of the Nation”. The French state took temporary control of the company and seized several tens of millions of euros. In June 2023, Ommic was sold to an American owner and changed its name to Macom. This case raises questions about the protection of French technological know-how and the risks associated with the transfer of strategic technologies to foreign powers.

What is Ommic?

Ommic, located near Paris in Limeil-Brévannes, has a history of more than 40 years in material science, semiconductor wafer processing and monolithic microwave integrated circuit (MMIC) design. Its differentiated manufacturing capabilities include several semiconductor processes and products qualified by the European Space Agency (ESA). Ommic uses notably gallium arsenide (GaAs) and gallium nitride (GaN) technologies, which allow to produce high-performance electronic components for high-frequency applications. Ommic counts among its customers major players in the space sector, such as Thales Alenia Space or Airbus Defence and Space.

Why did Macom buy Ommic?

Macom is an American supplier of semiconductor products for the telecommunications, industrial and defense and data center sectors. Macom announced in February 2023 that it had entered into a definitive agreement to acquire the assets and operations of Ommic for approximately 38.5 million euros. Macom sees Ommic’s high-frequency MMIC product portfolio and design capability as an aid to address microwave applications on target markets. Macom also said that acquiring Ommic should allow it to focus more on European markets and expand its wafer production capacity.

What are the technological secrets delivered by Ommic?

According to the information revealed by the French press, Ommic would have delivered to China and Russia material and processes sensitive to the military, which could have been used to manufacture radars, missiles or drones. These would include machine tools capable of engraving GaN wafers, a highly sought-after technology for its performance in terms of power, efficiency and thermal resistance. Ommic would also have transmitted digital files containing integrated circuit plans, source codes or algorithms. These technological secrets would have an estimated value of several hundred million euros.

What are the consequences of the Ommic case?

The Ommic case had legal, economic and political consequences. On the legal level, four people were indicted and placed under judicial control. They face 15 years in prison and 225 000 euros fine.

On the economic level, the French state took temporary control of the company. It also seized several tens of millions of euros. Moreover, it launched an audit to assess the damage to national defense. Additionally, it strengthened the security and competitiveness of the French semiconductor industry.

On the political level, the Ommic case provoked contrasting reactions. Some denounced a national betrayal and a threat to technological sovereignty. Others minimized the scandal and welcomed the takeover by Macom. The French government affirmed its vigilance and reminded that France had other leading players in this field.

The Ommic case also had implications for the world of semiconductors. This is a strategic sector for many applications. The case revealed the vulnerability of some European companies to foreign espionage and competition. The case also highlighted the importance of protecting intellectual property rights and preventing technology transfers. The case also raised questions about Macom’s role and responsibility.

How did Macom react to the Ommic case?

Macom reacted to the Ommic case by expressing its support for the French authorities and its commitment to comply with all applicable laws and regulations. Macom stated that it was not aware of any wrongdoing by Ommic or its employees before or during the acquisition process. Macom also stated that it had conducted a thorough due diligence on Ommic’s business and operations before closing the deal. Macom said that it was cooperating fully with the French authorities and that it was confident that it would be able to demonstrate its good faith and integrity.

Macom also tried to reassure its customers and partners about its ability to continue to provide high-quality products and services based on Ommic’s technologies. Macom said that it had taken steps to ensure the continuity of Ommic’s operations and to preserve its know-how and expertise. Macom also said that it had implemented strict security measures to protect Ommic’s intellectual property and trade secrets from unauthorized access or disclosure.

Macom also emphasized the strategic value of acquiring Ommic for its growth and innovation objectives. Macom said that Ommic’s high-frequency MMIC product portfolio and design capability were complementary to its own offerings and would enable it to address microwave applications on target markets. Macom also said that acquiring Ommic would allow it to focus more on European markets and to expand its wafer production capacity.

Are these measures enough to ensure the security and competitiveness of France in the field of semiconductors?

According to experts, these measures are necessary but not sufficient. It would also be necessary to strengthen European cooperation, which is essential to cope with global competition, especially from China and the United States. It would also be necessary to anticipate technological changes and market needs, which are constantly changing. It would finally be necessary to develop a coherent and ambitious industrial and commercial strategy, which values the assets and specificities of France.

What are the challenges and opportunities that arise for the future?

The challenges are numerous, but so are the opportunities. The field of semiconductors is indeed a key sector for many applications, such as aeronautics, automotive, space, health or digital. The global demand is strong and should continue to grow in the coming years. France has recognized skills and innovative players in this field, who can differentiate themselves by their quality, reliability or performance. France can therefore play a major role in the development and dissemination of tomorrow’s technologies.

What are some other examples of military industrial espionage cases in the world?

Military industrial espionage is the practice of spying on or stealing information from other countries or companies that are involved in the development, production, or sale of military equipment, technology, or services. Military industrial espionage can have serious consequences for national security, economic competitiveness, and international relations.

There are many examples of military industrial espionage cases in the world, involving different actors, methods, and targets. Here are some of them:

  • In 2019, a former engineer at Raytheon, a US defense contractor, was arrested and charged with exporting sensitive missile technology to China. Wei Sun, a Chinese-born US citizen, admitted that he took a laptop containing classified information about Raytheon’s products to China without authorization. He also admitted that he shared some of the information with Chinese professors and students at a university in China1.
  • In 2018, a former employee of the French aerospace company Thales was convicted of spying for China. Henri Dumoulin, a French citizen, was accused of passing confidential documents about radar systems and missile guidance to Chinese intelligence agents. He was sentenced to six years in prison and fined 40,000 euros2.
  • In 2017, a former employee of the German engineering company Siemens was found guilty of selling trade secrets to Russia. Evgeny Kaspersky, a Russian citizen, worked as a software developer at Siemens and had access to the source code of a software used to control gas turbines. He copied the code and sold it to a Russian company that was linked to the Russian military. He was sentenced to two years and nine months in prison3.
  • In 2016, a former employee of the British defense company BAE Systems was arrested and charged with attempting to sell jet fighter secrets to Iran. Simon Finch, a British citizen, worked as a software engineer at BAE Systems and had access to sensitive information about the Typhoon fighter jet. He allegedly tried to sell the information to Iranian officials through an encrypted messaging app. He was later acquitted after claiming that he acted out of frustration over his treatment by BAE Systems.

How to prevent and combat military industrial espionage?

Military industrial espionage is a widespread and dangerous phenomenon for the security and competitiveness of countries and companies involved in the military industry. It involves spying or stealing sensitive information or technology for military purposes. Therefore, it is important to implement effective measures to prevent and combat this type of espionage. These measures may include:

  • Strengthening the protection and control of classified or proprietary information and technology.
  • Enhancing the awareness and education of employees and contractors about the risks and responsibilities.
  • Increasing the cooperation and coordination among national and international authorities and partners.
  • Prosecuting and sanctioning those who engage in or facilitate military industrial espionage.

The Ommic case is not an isolated case of military industrial espionage in the world. There are many cases where countries or companies have tried to appropriate or transfer sensitive information or technology. Some of these technologies are dual-use, meaning that they can have both civilian and military applications. This is the case for data encryption and messaging.

The complexity and dynamics of industrial espionage with a military character

Industrial espionage with a military character is a complex and dynamic phenomenon, which evolves according to technological advances, geopolitical power relations and the strategies of the actors involved. It poses significant challenges for the security and competitiveness of countries and companies that are victims or targets of this practice. It therefore requires constant vigilance and continuous adaptation to prevent and combat this threat.

The Ommic case is a concrete and recent example of industrial espionage with a military character that illustrates one of the methods that this practice can take. It also shows the flaws and risks associated with dual-use technologies, i.e. technologies that can have both civilian and military applications. It invites us to think about the future prospects and challenges posed by industrial espionage with a military character in an increasingly connected and competitive world.

Conclusion: The Ommic case and the challenges of industrial espionage with a military character

Industrial espionage with a military character is a complex and dynamic phenomenon, which evolves according to technological advances, geopolitical power relations and the strategies of the actors involved. It poses significant challenges for the security and competitiveness of countries and companies that are victims or targets of this type of espionage. It therefore requires constant vigilance and continuous adaptation to prevent and combat this threat.

In this article, we have presented the Ommic case, a scandal of industrial espionage with a military character that involves a French company specialized in the manufacture of high-performance electronic components for high-frequency applications. We have explained the facts, the actors, the stakes and the consequences of this case. We have also shown how this case illustrates one form of industrial espionage with a military character by transfer, according to the means and methods used. In the next article, we will address other methods such as infiltration, surveillance, hacking, subversion.

In the next article, we will also talk about the counter-espionage technologies such as those designed, developed and manufactured by Freemindtronic, which include innovative digital security solutions based on quantum cryptography. These solutions allow to protect sensitive data from theft, falsification or corruption, using unbreakable encryption keys and tamper-proof transactions.

We will explain how these solutions can help countries and companies to protect themselves from attacks of industrial espionage with a military character, using cutting-edge and environmentally friendly technologies.

If you want to learn more about how to protect your data and communication from industrial espionage with a military character, stay tuned for our next article on Freemindtronic’s innovative solutions based on quantum cryptography. 

KingsPawn A Spyware Targeting Civil Society

KingsPawn A Spyware

 

KingsPawn from QuaDream Spyware Threat

KingsPawn, a spyware developed and sold by QuaDream based on digital offensive technology to governments. Its spyware, named Reign, uses zero-click exploits to infiltrate the mobile devices of civil society victims. In this article you will learn how QuaDream works, who its Cyber victims and customers have been, and how to protect yourself from this type of dangerous spyware

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

2024 Digital Security

PrintListener: How to Betray Fingerprints

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks

To learn more about the potential dangers of KingsPawn spyware, read “QuaDream: Spyware That Targets Civil Society.” Stay informed by browsing our constantly updated topics

How to Secure Your Data from QuaDream’s KingsPawn Spyware,” written by Jacques Gascuel, the innovator behind advanced sensitive data security and safety systems, provides priceless knowledge on the topic of data encryption and decryption. Are you prepared to enhance your comprehension of data protection?

QuaDream: KingsPawn spyware vendor shutting down in may 2023

QuaDream was a company that sold digital offensive technologies to governments. Its main product, Reign, was a spyware that used zero-click exploits to hack mobile devices. A few months after Pegasus, a similar spyware by NSO Group, Microsoft and Citizen Lab found QuaDream’s Reign / KingsPawn spyware and its victims worldwide.

However, in May 2023, QuaDream stopped its activitiesMay 2023, QuaDream stopped its activities, due to the Israeli government’s restrictions on its spyware export. QuaDream had developed other espionage technologies, such as ENDOFDAYS, that it sold to foreign governments, like Morocco, Saudi Arabia, Mexico, Ghana, Indonesia and Singapor.

QuaDream tried to sell its assets to other players, but the Israeli government blocked them It is unknown if the spyware KingsPawn is still active and used, or who controls it. Therefore, it is advised to be vigilant and protect your data with reliable security solutions.

How QuaDream’s Exploits KingsPawn her Spyware Work

According to Microsoft, QuaDream has an arsenal of exploits and malware that it calls KingsPawn. It includes a suspected exploit for iOS 14, named ENDOFDAYS, that seems to use invisible iCloud calendar invitations sent by the spyware operator to the victims. This exploit was deployed as a zero-day against iOS 14.4 and 14.4.2 versions, and maybe others.

The KingsPawn spyware is designed to exfiltrate data from the infected devices, such as contacts, messages, photos, videos, audio recordings, location data, browser information and app data. The malware communicates with command and control (C2) servers via encrypted protocols and uses evasion techniques to avoid detection.

How the KingsPawn spyware infects phones

The main infection vector of KingsPawn is the ENDOFDAYS exploit, which does not require any user interaction to execute. The spyware operator sends an invisible iCloud calendar invitation to the target’s phone number or email address. The invitation contains a malicious link that triggers the exploit when the phone processes the notification. The exploit then downloads and installs the KingsPawn malware on the device, without the user’s knowledge or consent.

The spyware operator can also use other methods to deliver the malicious link, such as phishing emails, SMS, social media messages, or fake websites. However, these methods require the user to click on the link, which reduces the chances of success.

KingsPawn Datasheet

The following table summarizes the main features and characteristics of the KingsPawn malware:

FeatureDescription
NameKingsPawn
DeveloperQuaDream
PlatformiOS
Version1.0
Size2.5 MB
PermissionsFull access to device data and functions
CapabilitiesData exfiltration, audio recording, camera capture, location tracking, file search, keychain access, iCloud password generation, self-deletion
CommunicationEncrypted TCP and UDP protocols
C2 serversMultiple domains and IP addresses, some located in Israel, Bulgaria, Czech Republic, Hungary, Ghana, Mexico, Romania, Singapore, UAE, and Uzbekistan
VictimsAt least five civil society actors, including journalists, political opponents, and an NGO worker, in North America, Central Asia, Southeast Asia, Europe, and the Middle East
CustomersSeveral governments, some with poor human rights records, such as Singapore, Saudi Arabia, Mexico, Ghana, Indonesia, and Morocco

How to Detect KingsPawn

KingsPawn is a stealthy and sophisticated malware that can evade most antivirus and security software. However, there are some signs and symptoms that can indicate a possible infection, such as:

  • Unusual battery drain or overheating of the device
  • Increased data usage or network activity
  • Unexpected pop-ups or notifications
  • Changes in device settings or behavior
  • Presence of unknown apps or files

If you notice any of these signs, you should scan your device with a reliable antivirus or security app, such as Malwarebytes or Norton. These apps can detect and remove KingsPawn and other malicious software from your device.

How to Protect Against KingsPawn

If you suspect that your device is infected by KingsPawn, you should take the following steps to remove it and protect your data:

  • Disconnect your device from the internet and any other networks
  • Backup your important data to a secure external storage
  • Perform a factory reset of your device to erase all data and settings
  • Restore your device from a clean backup or set it up as a new device
  • Update your device to the latest version of iOS and install security patches
  • Change your passwords and enable two-factor authentication for your online accounts
  • Avoid clicking on suspicious links or opening attachments from unknown sources
  • Use a reputable antivirus or security app to scan your device regularly

These steps will help you to get rid of KingsPawn and prevent it from infecting your device again. However, you should also be aware of the risks of using unsecured email services, such as iCloud web mail, which can be compromised by hackers or spyware. To protect your emails and other sensitive data, you should use a technology that encrypts your data with a hardware security module (HSM), such as EviCypher NFC HSM or DataShielder HSM PGP.

Who Are the Victims and Customers of QuaDream?

Citizen Lab, a research lab at the University of Toronto, identified at least five civil society victims of the spyware and exploits of QuaDream in North America, Central Asia, Southeast Asia, Europe and the Middle East. The victims include journalists, political opponents and a worker of a non-governmental organization (NGO). Citizen Lab did not reveal the names of the victims for security reasons, but one of them agreed to share his testimony anonymously:

I was shocked when I learned that my phone was infected by QuaDream. I had no idea tat they were targeting me. I work for a human rights NGO and I have been involved in several campaigns to denounce the abuses of authoritarian regimes. I fear that they have accessed my personal and professional data, and that they have compromised my contacts and sources.

Citizen Lab also detected QuaDream servers operated from Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates (UAE) and Uzbekistan. These countries could be potential or current customers of QuaDream, which sells its Reign platform to governments for law enforcement purposes. Media reports indicate that QuaDream sold its products to Singapore, Saudi Arabia, Mexico and Ghana, and offered its services to Indonesia and Morocco.

What Is the Link Between QuaDream and InReach?

QuaDream had a partnership with a Cypriot company called InReach, with which it is currently in legal dispute. The two companies accused each other of fraud, theft of intellectual property and breach of contract. Several key people associated with both companies have previous links with another surveillance provider, Verint, as well as with Israeli intelligence agencies.

Microsoft and Citizen Lab shared information about QuaDream with their customers, industry partners and the public, to improve the collective knowledge of how PSOAs (private sector offensive actors) operate and how they facilitate the targeting and exploitation of civil society. Microsoft calls for stricter regulation of PSOAs and increased protection of human rights in cyberspace.

Conclusion

QuaDream is a new spyware vendor that poses a serious threat to civil society. Its spyware, named Reign, uses zero-click exploits to infiltrate the mobile devices of civil society victims. QuaDream has sold its products to several governments, some of which have a poor record of human rights. QuaDream is also involved in a legal dispute with another company, InReach, over the ownership of the spyware technology. The international community should be aware of the dangers of QuaDream and other PSOAs, and take action to prevent their abuse.