Spyware from Israeli firm NSO Group has been secretly installed on tens of thousands of smartphones, many of which are owned by heads of state, activists, and journalists, according to a report from Paris-based media non-profit Forbidden Stories and Amnesty International.
NSO’s Pegasus software can be installed on a phone without any action from its owner; sending a text message is all that’s required in some cases. Pegasus then has access to the phone’s messages, emails, media, microphone, camera, calls and contacts.
Forbidden Stories and Amnesty International were provided access to a leak of more than 50,000 phone numbers targeted by NSO clients. Those clients, the report says, include officials in 11 countries: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates (UAE).
Both groups have partnered with media organizations—The Guardian, Le Monde, Süddeutsche Zeitung and The Washington Post—for a series of stories about those 50,000 targets.
In a statement, the NSO Group says “the report by Forbidden Stories is full of wrong assumptions and uncorroborated theories,” and threatened a defamation lawsuit.
“We firmly deny the false allegations made in their report,” NSO Group says. “Their sources have supplied them with information which has no factual basis, as evident by the lack of supporting documentation for many of their claims.”
Among those targeted by Pegasus clients were Hatice Cengiz and Hanan Elatr, the fiancee and wife, respectively, of Jamal Khashoggi, a Washington Post contributing columnist murdered by Saudi officials in 2018. Elatar carried an Android phone that was breached six months before Khashoggi died; Cengiz had an iPhone that was hit after the murder, the Post reports.
NSO Group denies it. “Our technology was not associated in any way with the heinous murder of Jamal Khashoggi. We can confirm that our technology was not used to listen, monitor, track, or collect information regarding him or his family members mentioned in the inquiry,” it says.
In a separate story, the Post argues that Pegasus can bypass the iPhone’s strict security measures. At issue is the fact that, by default, anyone can send a text to an iPhone owner via iMessage. You can change that (Settings > Messages > Filter Unknown Senders), but the average iPhone user probably hasn’t done so.
Apple did not immediately respond to a request for comment, but tells the Post that it restricts the type of software that can run on its phones, thanks in part to BlastDoor, a security system introduced in iOS 14.
The Post examined a sample of 67 phones from the 50,000 and found Pegasus software or attempted intrusions on 37 of them, 34 of which were iPhones.
“Only three of the 15 Android phones examined showed evidence of a hacking attempt, but that was probably because Android’s logs are not comprehensive enough to store the information needed for conclusive results,” the Post says, citing Amnesty’s investigators.
Google did not immediately respond to a request for comment, but tells the Post that offering persistent logs could be helpful to hackers.
