Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Note that each function location in memory (as an <strong>of</strong>fset from the base <strong>of</strong> the kernel) is mapped. Each <strong>of</strong> these will be<br />
used later in the kernel version.<br />
Additionally, the code is extremely modular, relative to other malware our researchers have encountered. We found common<br />
libraries and common formats with similar naming conventions. For example, the libwacalls (WhatsApp Call Library)<br />
and libvbcalls (Viber Call Library) use similar formats with similar function names and common standards. Unlike most<br />
malware authors, the code in <strong>Pegasus</strong> is clean and efficient, with evidence <strong>of</strong> pr<strong>of</strong>essional and careful design.<br />
Finally, we see evidence <strong>of</strong> a robust quality assurance process for their development: even their first stage exploit contains<br />
both debugging and QA-specific functions <strong>of</strong> the type one would expect from an enterprise-class s<strong>of</strong>tware development<br />
organization.<br />
Evolution <strong>of</strong> S<strong>of</strong>tware<br />
The malware has been in operation for well over a year, which has enabled it to develop a degree <strong>of</strong> s<strong>of</strong>tware maturity,<br />
and as a result it is capable <strong>of</strong> exploiting multiple iOS versions. An excerpt from the magic table that maps addresses in<br />
the kernel shows that the exploit supports versions <strong>of</strong> the phone from the iPhone 4s up to the iPhone 6s Plus.<br />
The kernel exploit includes checks that indicate that the exploit works against iOS 7 (which was released in 013):<br />
TECHNICAL ANALYSIS OF PEGASUS SPYWARE | 10