Technical Analysis of Pegasus Spyware

More documents

Recommendations

Info

notification IDs that get posted by various Pegasus modules. In the analyzed sample, this included notifications from the WhatsApp and Viber modules (, libwacalls.dylib and libvbcalls.dylib). Process Injection: converter The interception of real-time calls from the chat messengers (e.g., WhatsApp, Viber) comes through a library that is injected into their process space dynamically at run time. The “converter” binary (the mechanism through which this occurs) is a version of the cynject open-source library available here: https://github.com/r-plus/substrate/blob/master/cynject.cpp The library takes a pid as an argument and injects a dylib into running process using Mach kernel APIs. The usage for converter is: start (usage: %s [args...]) Converter has the following entitlements: com.apple.springboard.debugapplications get-task-allow task_for_pid-allow Additionally, converter has a failsafe key combination that it listens for on the keyboard to dynamically unload the injected libraries. Skype Pegasus pulls all of the data about calls out of the Skype database on the device. TECHNICAL ANALYSIS OF PEGASUS SPYWARE | 24
Pegasus also saves any calls that Skype has previously recorded by reading them out of the Skype database files. TECHNICAL ANALYSIS OF PEGASUS SPYWARE | 25
Page 1 and 2: Technical Analysis of Pegasus Spywa
Page 3 and 4: Executive Summary T his report is a
Page 5 and 6: Background As mobile phones continu
Page 7 and 8: Attack Overview The attack is very
Page 9 and 10: One other unique property of this a
Page 11 and 12: The Trident Vulnerabilities The sof
Page 13 and 14: Persistence: JSC Privilege Escalati
Page 15 and 16: Jailbreak Detection The stage 3 loa
Page 17 and 18: Stealth Update to Command & Control
Page 19 and 20: Pegasus will also remove all of its
Page 21 and 22: Capturing User Passwords One of the
Page 23: Interception of Calls and Messages
Page 27 and 28: TECHNICAL ANALYSIS OF PEGASUS SPYWA
Page 29 and 30: Viber The samples of Pegasus we obt
Page 31 and 32: Conclusion We rely on mobile device
Page 33 and 34: fe:b4:5c:d6:8b:57:e1:cf:de:84:37:4f
Page 35: TECHNICAL ANALYSIS OF PEGASUS SPYWA

Technical Analysis of Pegasus Spyware

Create successful ePaper yourself

Delete template?

Save as template?