Wares of all sorts populate the world of technology – hardware, software, firmware, malware and now spyware. Like appending “gate” to the end of all scandals, ware is just a way to categorize technology. Spyware means a program installed on a mobile device (phone or tablet) that monitors user behavior and reports back to a central source. Malware is usually destructive (think ransomware), but spyware is more insidious.
The data that spyware reports can be as benign as recording when your phone is turned or as malicious as sending a copy of all your data and movements in real time. It purportedly can activate a webcam without triggering the telltale LED so you don’t know you’re being filmed. The most troubling aspect of spyware is that it is designed to be hidden from sight and to operate clandestinely.
The most notorious spyware app is called Pegasus, and comes from an Israeli company called NSO Group. Like much malware, the chief form of installation for Pegasus is a phishing email. Once the recipient of the phish clicks on a link in the message, Pegasus is downloaded and installed on a phone or tablet. However, there are also reports that it can be installed with no user intervention whatsoever. Preliminary investigations show that it was sold to a wide variety of governments and less-reputable organizations, all of whom allegedly used it to spy on and/or intimidate their enemies.
Like a script from Mission Impossible, Pegasus is designed to cover its tracks. If it can’t communicate to its home base for more than sixty days, it uninstalls itself. It can be remotely deleted from any device. NSO Group operated a wide network of “command-and-control” servers so that devices reporting back didn’t rouse suspicion by too much traffic to any one Internet site.
So how do you know if Pegasus is spying on you? The good news is that it probably isn’t, unless you are a celebrity, a person with an activist background that has run afoul of a foreign regime, or a criminal.
It’s also very hard to detect if it is installed. Turning your phone or tablet fully off and back on again will disable it, but it may very well return. A full rebuild of your device’s operating system and apps is the only sure cure. Again, as it’s probable you don’t have it, only do this when you’re sure spyware is running. The time and expense involved in a full rebuild can be daunting.
As it never hurts to be paranoid when it comes to cybersecurity, here are some steps you can take to stay safe.
As with all electronic communications, don’t click on any link in an email or text message unless you were expecting it. Even if it comes from an organization or business with which you are affiliated, don’t assume it’s legitimate.
Think about using a web browser that isn’t the default for your device. Spyware generally relies on using the built-in browser on mobile devices (Safari on iPhones/iPads, and Chrome on Android) and won’t install if those aren’t set as the default. Lots of alternate browsers are available in the Apple and Google App Stores, and performance is just as good as the browsers they come with out of the box.
While mobile devices make computing-on-the-go a reality, they also bring with them the ability to be hacked more readily. Staying aware of the risks involved can keep you safe.
