I've been hearing of Pegasus for a good 3 years now. Is it so hard to patch devices to close whatever means it uses to hack them?
Or is there also a Pegasus V2, V3, etc that plays catchup with OS's security patches?
Or is there also a Pegasus V2, V3, etc that plays catchup with OS's security patches?
It's been around with zero-click exploits for years, and apparently even now, after their big iMessage "security" rewrite with iOS 14. Very likely that they have other entrypoints as well though.
[1] https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-sa...
It is NSO running these operations. They are directly implicated in whatever their malware ends up doing.
Is it not clear that at least Apple must be involved in this too? Who else is?
I've been there done that. It's how we pretty much kept Wii homebrew available consistently throughout the console's life. We had the next exploit ready before Nintendo patched the current one.
Apple isn't involved. NSO are just good at their job.
The whole operation is incredibly sophisticated—this report [0] by Amnesty International is a great read. They also constantly upgrade their infrastructure—for example, they have at least -four- major versions of their C&C infrastructure, which they dub the "Pegasus Anonymizing Transmission Network". :(
[0]: https://www.amnesty.org/en/latest/research/2021/07/forensic-...