█ DEEPDIVE
Issue: WhatsApp Cyber Intrusion
1,400 affected in 20 countries
As one of the biggest cyber snoopgates to hit India unravels, we deconstruct some myths and fears surrounding the dark horse of cyber intrusion that is sure to have far-reaching consequences on our idea of privacy
1,400 across 20 countries. At least 20 Indians (* Number yet to be verified)
Between April 29 and May 10
High-ranking government and military officials, opposition leaders, lawyers, activists
Earlier, the virus was sent via an SMS or a WhatsApp message as a link. Clicking on the link immediately infected the user's device. The updated version of Pegasus, however, is even more powerful – a missed call is enough for the malicious code to get into your phone.
There is no known way to uninstall Pegasus. Even a factory reset won't help, according to reports. But now that WhatsApp has patched the security issue, buying a new device and changing all your passwords may be the only way to get rid of it.
NSO is a private player using capabilities that Israelis have. There is no Israeli govt involvement here, everyone knows this is not about the state of Israel
WhatsApp chats are touted to be protected by the strongest encryption methods known today. This means that any message shared between two users is heavily protected while it travels from one phone to another and no third party can view the encoded messages, not even WhatsApp.
Pegasus, however, once installed on the user's phone, renders this protection completely useless as once the messages are decoded and stored on the user's phone, the malware can upload the conversations and attachments to the monitoring server silently in the background.
International firms and their misdeeds are a little difficult to rectify due to global norms. On its part though, WhatsApp has filed a lawsuit against NSO Group in a California federal court alleging that the company violated its terms of service and "developed their malware in order to access messages and other communications after they were decrypted on target devices".
NSO has disputed the allegations stating that they will 'vigorously fight them.'
This one is a little difficult to explain. NSO says they sell their software exclusively to authorised government agencies. And even though the Indian government has outright denied its involvement, the fact remains that the software has reportedly been used to target journalists and civil activists that have dared to take on the government and/or question its policies. Several of the targeted users who have come forward to report the hack are associated with the ongoing Bhima Koregaon case.
Instead, pointing the gun back at the messaging giant, the Information and Technology ministry has sought a detailed response from WhatsApp by November 4.
Questions are being raised on whether the disclosure was a rearguard action by WhatsApp to prevent the government from bringing measures on traceability and accountability. Recently, the Centre sought three months' time from the Supreme Court to formulate rules to curb misuse of social media in the country. Earlier too the messaging giant has faced flak from the Indian government for being misused for spreading misinformation that led to incidents of mob lynching.
Our highest priority is the privacy and security of WhatsApp users. We agree with the government of India it's critical that together we do all we can to protect users from hackers attempting to weaken security.
If you haven't received a message from WhatsApp informing you of the hack, then no.
As the software has been developed to target individual users to glean important information, it is unlikely that the average user will be targeted. WhatsApp has also since patched the security hole that enabled the hacks.
If you have reason to suspect you were targeted, you must contact Citizen Lab or another cybersecurity agency, and avoid using your device for any sensitive communication.
Since the latest versions of spyware like Pegasus are designed to leave no trail on a device, it is almost impossible to detect them. The only way one would know is through an official notification from the developer.
If you suspect you have been infected, you should immediately change all your passwords including emails, cloud-storage accounts among others. As the spyware records every detail including login IDs and passwords, merely changing your device wont suffice.
If the BJP has engaged Israeli agencies to snoop into phones of journalists, lawyers, activists and politicians, it is a gross violation of rights and a scandal with grave ramifications on national security
Not all applications are out to get you, there are some that you can use to protect yourself.
► This clearly means that some entities within the Indian govt are, in all likelihood, contracting providers of legal hacking solutions – Sunil Abraham, Director, CIS
► This shows just how important it is to have surveillance reform which includes tabling of the Data Protection Bill in parliament, and that evidence through such means is not admissible in any court – Vrinda Bhandari, Supreme Court advocate