NSO Group continues to stay at the top of the headlines as 2022 carries on. There have been 3 noteworthy updates since the last nGuard Security Advisory, let’s look into each. If you haven’t seen the prior Security Advisories covering the NSO Group they can be found here, here, and a video summary here.
FBI discloses it tested the Pegasus spyware in 2019
Earlier this month, the FBI and the Justice Department confirmed they had tested Pegasus but stated it had not been deployed for use in any of their investigations. The FBI stated, “The FBI works diligently to stay abreast of emerging technologies and tradecraft — not just to explore a potential legal use but also to combat crime and to protect both the American people and our civil liberties,” the statement said. “That means we routinely identify, evaluate, and test technical solutions and problems for a variety of reasons, including possible operational and security concerns they might pose in the wrong hands. There was no operational use in support of any investigation, the FBI procured a limited license for product testing and evaluation only.” The NSO Group has since been blacklisted from the United States, however The New York Times reported the FBI ran up roughly $5 million in charges in its contract with the NSO Group prior to this occurring.
Although the NSO Group has stated they cannot deploy their software Pegasus against U.S. based phones with a +1 number, they have created another product called Phantom which allows the monitoring of those types of numbers. A company called Westbridge, NSO’s North American branch, was handing out this brochure to law enforcement for Phantom. It looks very similar to the one leaked for Pegasus when this story originally broke last year.
NYPD Received Demo of Pegasus
The NYPD intel group was in communication to receive a demo of the Pegasus software, as seen in the email below courtesy of Motherboard. This is a very similar brochure the FBI received from Westbridge.
The email came from James Sheehan who is a program manager for Northern New Jersey-Newark and Jersey City Urban Area Security Initiative, which is administered by the United States Department of Homeland Security (DHS). Others that were invited to attend the demonstration were Bergen County Prosecutor’s Office, Jersey City’s public safety agency, and the Paterson Police Department. The NYPD has not responded to these revelations, so it is still unknown if they took any steps to acquire the Pegasus software.
The Israeli Government Announced its Investigation into Domestic Use of Pegasus
As more and more eyes have focused on the NSO Group, Israel has announced they are investigating reports of the Israeli police illegally using Pegasus against its own citizens without a court order. One individual that has been reported to have been spied on is a witness in the trial of former Israeli Prime Minister Benjamin Netanyahu. Pegasus continues to draw negative attention and is being labeled as a “threat to democracy” with Aylet Shaked, a cabinet minister, saying, “I am shocked,” she added. “I cannot believe this is my country.”
The police in Israel have been using Pegasus since 2015 and deployed it on over 100 phones each year since. In a list recently revealed, it seems as if nobody was immune. The list includes protesters, Ministry CEOs, and journalists. It was also used to determine witness credibility. When the news about Pegasus initially broke last year we discovered Pegasus was used on all types of individuals throughout the world, but nobody knew it was used domestically in Israel against its own people.