Security researchers have found evidence that a piece of malware peddled as "lawful intercept" software to government agencies has been deployed against victims located in 45 countries, a number that far outweighs the number of known operators, meaning that some of them are conducting illegal cross-border surveillance. The findings come from a report published by Citizen Lab, a digital rights watchdog at the University of Toronto's Munk School of Global Affairs. ZDNet: The malware, known as Pegasus (or Trident), was created by Israeli cyber-security firm NSO Group and has been around for at least three years -- when it was first detailed in a report over the summer of 2016. The malware can operate on both Android and iOS devices, albeit it's been mostly spotted in campaigns targeting iPhone users primarily. On infected devices, Pegasus is a powerful spyware that can do many things, such as record conversations, steal private messages, exfiltrate photos, and much much more. Citizen Lab's researchers explained how they were able to arrive at the conclusion. They said they identified 1,091 IP addresses that matched their fingerprint for NSO's spyware. Then, they clustered the IP addresses into 36 separate operators with traces in 45 countries where these government agencies "may be conducting surveillance operations" between August 2016 and August 2018. Motherboard adds: Some of the countries where the researchers spotted Pegasus in democratic countries, such as the United States, France, and the UK, but there's also countries with questionable human rights records such as the United Arab Emirates, Bahrain, Mexico, Turkey, and Yemen. There's a caveat though. In some cases, the researchers aren't sure if the traces they found indicate an infection -- thus a target that may have been hacked from a foreign country -- or an operator. [...] "I can only hope that our research is causing these companies to think twice about sales where there is the potential for spyware abuse, causing potential customers to think twice about being associated with a company dealing with repressive governments, and causing potential investors to think twice about the inherently risky business of selling spyware to dictators." The report includes a corroboration of sorts from security firm Lookout, which noted that it had detected "three digits" Pegasus infections around the world.
Read more of this story at Slashdot.