You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Spyware</strong> <strong>Analysis</strong><br />
<strong>Pegasus</strong> is one <strong>of</strong> the most sophisticated pieces <strong>of</strong> surveillance and espionage s<strong>of</strong>tware that Lookout has investigated. It<br />
has a novel mechanism to install and hide itself and obtain persistence on the system. Once it is resident, it uses a number<br />
<strong>of</strong> ways to hide its communications and protect itself from discovery, and it hooks into a large number <strong>of</strong> the phone’s<br />
functions in order to gather data and intercept messages and calls.<br />
Installation and Persistence<br />
The spyware is installed during the stage 3 execution by running the lw-install binary. Lw-install sets up a few <strong>of</strong> the key<br />
structures <strong>of</strong> the product, as well as establishes persistence across reboots (and has a few protective functions to ensure<br />
that the s<strong>of</strong>tware doesn’t accidentally brick the phone).<br />
The first thing that lw-install does is check the iOS version; it runs different commands depending on whether it is running<br />
on iOS 9 or a previous version.<br />
If it is installed on iOS 9, lw-install runs “/sbin/launchctl load” on .plist files dropped into /Library/LaunchDaemons (which<br />
is normally empty or used to hold launchd plists for jailbroken services, such as sshd). This will ensure that these files get<br />
launched and started on reboot.<br />
If the OS is not iOS 9, the first thing that lw-install does is remove the following files:<br />
Then it starts<br />
Note that lw_install appears to log to /private/var/wireless/Library/com.apple.wifid.r.log<br />
TECHNICAL ANALYSIS OF PEGASUS SPYWARE | 12
Change language