Pegasus spyware: Zero Click Attacks
One thing that worries Pegasus spyware is that it is more powerful than other similar gray software before it. Earlier spyware infected a phone or other device when a customer clicked on a link or message or did something similar. But when it comes to Pegasus, spyware can infect the device without any such reaction on the part of the user.
Such cyber-attacks are called zero-click attacks. Zero Click is the name given to this spyware, though it is not specifically clicked anywhere. Undoubtedly, this is the most powerful and most undetectable spyware ever built.
'The Guardian' reports quoting Claudio Guarnieri, who runs Amnesty International's Berlin-based security lab, as saying that if Pegasus infiltrates a phone, it can gain more control over its owner. Because, on an iPhone, spyware gets "root-level privileges." After that, you can see everything from contact lists to messages and internet browsing history and send it to the attacker,” he said.
How do zero-click attacks work?
Zero-click attacks using spyware such as Pegasus are used to gain control of a device without human intervention or human error. Precautions such as avoiding a phishing attack or which links should not be clicked would be meaningless in this case. This is because spyware like Pegasus targets the system itself.
Most of these attacks exploit software such as the email client. The reason for targeting such software and apps is the habit of receiving data before checking whether it is from trusted sources or not. Earlier this year, cybersecurity firm SecOps claimed a traditional risk of unlisted attacks on iPhones and iPods. The risk was found especially in its mail application.
Since iOS 13, it also faces the threat of zero-click attacks. "This security vulnerability enables the ability to process code on a remote computer and enables a cyber attacker to infect remote computer spyware by sending emails that use a significant amount of memory," said a SecOps blog published this April. Apple reportedly closed the threat in April 2020 with a security patch.
In November 2019, Google Project Zero security researcher Ian Beer showed how attackers could take complete control of an iPhone in radio proximity without user intervention. He said the regulation was aimed at Apple Wireless Device Link (AWDL), a peer-to-peer wireless connectivity protocol used by iOS devices to interact with each other. Apple patched it up when iOS 13.3.1 was released but acknowledged that the attack was "powerful enough to" turn off the phone or damage kernel memory.
The security flaw was through the graphics library on Android phones running Android 4.4.4 and above. The cyberattack also exploited flaws in WhatsApp that could infect a phone even if a dangerous incoming call was not taken. Security vulnerabilities in Wi-Fi, chipsets, games, and movie streaming systems have also been exploited. Amnesty claims that spyware can infiltrate even devices patched with the latest software.
Can zero-click attacks be prevented?
Zero-click attacks are difficult to detect, so they are even harder to prevent. It can be more difficult if the information sent or received cannot be disclosed due to encryption. One thing users can do is make sure that all operating systems and software are updated. Then they will have at least some patches that have been identified as dangerous. Also, download apps only through the Google Play Store or the Apple App Store.
If you are in a state of panic, you may decide to use social media and email in your browser to avoid using dangerous apps. It will not be so convenient, but experts say it is safer.
You must be logged in to post a comment.