Tracking Pegasus

The spy program leaves traces on smartphones. Software now enables iPhone users to check their device for the surveillance tool.

Governments around the world are spying on their critics - journalists, human rights activists, opposition figures: the international "Pegasus Project" series of revelations made headlines around the world two and a half weeks ago. At the center of the research, in which the Süddeutsche Zeitung was also involved, was the Pegasus spy software from the Israeli company NSO. The program is capable of infecting smartphones from a distance. A secret service or police agency that has a Pegasus license usually only needs the phone number of a target person to attack his or her smartphone. Pegasus then turns the phone into a digital bug, taking complete control of the device. All data and all communications can be viewed, stolen and analyzed by police and intelligence officers, even encrypted chats. Even remote control of the camera and microphone is possible.

It is a widespread fear that smartphones eavesdrop on their owners, for example for advertising purposes, but this fear has often been disproved as unfounded by security researchers. Pegasus, however, makes exactly that possible and has thus triggered uncertainty.

Surveillance hunters have to rummage through the most private of information

The software "iMazing" now offers a way for at least iPhone users to examine their device for traces of a Pegasus infection. "iMazing" is a paid program for managing Apple devices such as iPhones and iPads, and is primarily designed to back up personal data and export chat histories from messengers such as Whatsapp, for example. The feature to detect spyware is free, according to the company. The product from Swiss company Digi DNA works on Apple's macOS operating system and on Windows devices.

If users want to make use of the Pegasus check, they have to create a backup of their iPhone for the program or allow "iMazing" to access an existing data backup. The software then searches for traces of Pegasus in this data. These can be found in chat messages, search histories in the browser or in log files of the operating system. The software thus rummages through the most private information. The developers emphasize that no data is transferred and the analysis takes place exclusively on the user's computer. As with all software, however, users should only run programs whose developers they trust - and the more sensitive the processed data, the greater the trust must be.

IT researchers from Amnesty International have published analysis tools for free use

Security researchers have been examining every line of Pegasus code they find on activists' or journalists' smartphones for years. They also map the infrastructure of the manufacturer NSO, i.e. the servers and their IP addresses through which the spy software is downloaded. This has resulted in a worldwide exchange of known attack routes, which makes automatic tracking by programs like "iMazing" possible.

Crucial parts of the program code of "iMazing" were thus also developed by IT forensic experts of the "Security Lab" of Amnesty International and published as open source software on the net for free use as part of the Pegasus project. However, Amnesty International's "Mobile Verification Toolkit" is less user-friendly if you don't know basic programming. However, it also allows Android users to verify their devices.

Despite the widespread use of the spy software, as evidenced by the Pegaus Project's research, Pegasus is not a mass-market product. Governments pay millions of dollars for a few hundred attacks. And each attack must be planned, controlled and evaluated. Nevertheless, anyone who thinks they are of great interest to a government agency with a Pegasus license can use "iMazing" to quickly and easily gain a measure of clarity. But it is also clear that companies like NSO are usually one step ahead of IT security researchers.