Private Israeli malware 'Pegasus' used to spy on journalists, activists

france24.com

70 points·underscore_ku··7 comments

What methods are available to normal folks to ensure they don't have these malware? Does factory reset help? Or would this malware reinstall itself? How do I know or check if I'm a target? Do I need to Wireshark and inspect the entire network payloads to find offending packets?

That's a great question. There have been quite a lot of discussions on Pegasus on HN, but I have not seen any one answer that.

Maybe this one: https://news.ycombinator.com/item?id=27876165 > MVT – forensic tool to look for infections on smartphones (github.com/mvt-project)

That's cool. Thanks. Interesting to see. Not trivial though. Imagine a non techie looking at that. Next step: How to prevent infection?

The methods in use by Pegasus make it impossible to avoid. "Zero Click" malware allows them to take over a device without any interaction needed by the user so even if you factory reset the device, heck, even if you reinstall the OS entirely, Pegasus malware can get back into the device. Until the method they are using to break into devices is found and patched there will be no stopping it except for disconnecting the device from all networks or keeping it powered off.

Edit: They are using 0-Day exploits against mobile clients that take advantage of flaws in default applications like iMessage. Pegasus intrusions have been detected on devices as new as the iPhone 12 running iOS 14.6. This would be a severity rating 10/10 for a CVE, to put it into perspective.

Probably wireshark, then

Relevant Twitter thread: https://twitter.com/billmarczak/status/1416817352549625858

Reply on news.ycombinator.com