Securing the Digital Frontier (eBook)

Threats and Advanced Techniques in Security and Forensics

Kavita Sharma, Vishnu Sharma, Parma Nand, Anil Kumar Sagar, Gulshan Shrivastava (Herausgeber)

eBook Download: EPUB

2025
572 Seiten
Wiley-Scrivener (Verlag)
978-1-394-26889-4 (ISBN)

Infos

Secure your understanding of vital security and forensic strategies by purchasing Securing the Digital Frontier: Threats and Advanced Techniques in Security and Forensics, a definitive guide that empowers you to protect sensitive information and tackle cyber threats with insights from leading experts and real-world case studies.

In the field of security and forensics, it's crucial to implement strong security measures to protect sensitive data and effectively respond to cyber incidents. Digital forensics is vital for analyzing cyber threats, where experts use advanced techniques to scrutinize digital artifacts, system logs, and network traffic. This approach helps reconstruct incidents, pinpoint vulnerabilities, and support legal actions, ensuring the confidentiality, integrity, and availability of crucial data in our rapidly evolving digital world.

This book provides an in-depth look at security and forensics, pooling knowledge from top experts across various cybersecurity domains. It focuses on real-world applications and case studies, offering valuable insights for protecting information and responding to digital crimes. Designed for cybersecurity professionals, digital forensics investigators, legal teams, and academics, this comprehensive guide is a key resource for anyone looking to deepen their understanding of modern digital forensics and cybersecurity challenges.

Kavita Sharma, PhD, is a professor in the Department of Computer Science and Engineering at Galgotias College of Engineering and Technology, Greater Noida, India with over 12 years of research and academic experience. She has also been awarded a research fellowship from the Ministry of Electronics and Information Technology from the Government of India. Additionally, she has four patents (one granted and three published) and one granted design and has published seven books and 45 research articles in international journals and conferences of high repute.

Vishnu Sharma, PhD, is the Head of Department and a professor in the Department of Computer Science and Engineering at Galgotias College of Engineering and Technology, Greater Noida, India with over 21 years of teaching experience. He has published over 50 research papers on mobile ad-hoc networks and mobile computing in national and international conferences and journals, as well as two books on mobile computing and advanced mobile computing. Additionally, he has organized several national and international conferences and workshops and serves as the editor of IEEE Conference ICCCA proceedings.

Parma Nand, PhD, is the Dean of Academics at Sharda University, Greater Noida, India. He has over 26 years of teaching, industry, and research experience, emphasizing bridging the gap between academics and industry keeping in mind the growing IT industry in terms of futuristic technologies. Through his work, he has provided consultancy on a number of projects for industries and has delivered many invited and keynote talks at national and international conferences, workshops, and seminars in India and abroad. He has published more than 85 papers in peer-reviewed national and international journals and conferences, as well as two filed patents.

Anil Kumar Sagar, PhD, is a professor in the Department of Computer Science and Engineering in the School of Engineering and Technology, Sharda University, India with over 20 years of experience in teaching, guiding ten Master's of Technology and five doctoral candidates in computer science. He also serves as a member of the editorial boards and review committees for many national and international journals and has served as a program and organizing committee member for several conferences.

Gulshan Shrivastava, PhD, is an associate professor in the Department of Computer Science and Engineering at Galgotias University, Greater Noida, India. He has five patents (four granted, one published) and 55 articles, books, and editorials in international journals and conferences of high repute. He also serves many reputed journals as a guest editor, editorial board member, international advisory board member, and reviewer board member and has delivered expert talks and guest lectures at numerous international conferences.

Textauszug

1
Pegasus—A Menace to Privacy and Security

Raunaq Khurana* and Shilpa Mahajan

Department of Computer Science, The NorthCap University, Gurugram, Haryana, India

Abstract

The Israeli-based cyber group NSO developed Pegasus, a spyware that can access and collect data from a target system without the user’s consent. Pegasus commonly exploits zero-day vulnerabilities, which are system weaknesses that the manufacturer has not addressed or is unaware of. This chapter thoroughly examines the Pegasus spyware, highlighting its unique features that pose significant challenges in its detection as compared to other malicious software. It presents an extensive analysis of Pegasus on both iOS and Android operating systems, with the intention of educating readers about its capabilities and advocating for the use of advanced technologies such as AI, ML/DL to develop effective countermeasures against spyware, malware, and adware. The chapter also includes various case studies that illustrate the transformation of Pegasus over time and the measures taken to prevent its infiltration into user devices. To facilitate reader’s understanding, the chapter provides essential security checklists that help identify Pegasus’s monitoring mechanisms.

Keywords: Malware/spyware, encryption, vulnerability, vishing

1.1 Introduction

Spyware is harmful software made with the intention of stealing data from a system and sharing it with unidentified outside third parties. Pegasus is a sophisticated programme that can break into mobile devices like smartphones and tablets and eventually go over security precautions like internal encryption and two-factor authentication to allow hackers complete access to the targeted device once it is plugged in. If that is the case, Pegasus can control all communication between devices, including calls, messages, emails, microphone and camera providers, location data, contacts and calendars [1]. The memory consumption can be discovered using covert methods, CPU cycles, and network traffic monitoring, despite the fact that the Pegasus file store was initially intended to target officials, politicians, journalists, and influencers.

Pegasus tool is produced by the Israeli company NSO Group. This surveillance tool is designed purposely to monitor specific individuals for national security. Although this tool is developed to be used by the government agencies but it has been a subject of significant controversies. These controversies arises as they are considered to be threat to human privacy, an abuse to human rights and potential misuse of surveillance technologies.

The allegation involves that government is spying on its officials and political opponents and even individuals or not even legitimate targets for surveillance. NSO group gave his assurance that their tool is used for legitimate purposes like for frightening crimes and terrorism. However, number of evidences and investigations have suggested that Pegasus has been used for questionable purposes by some people.

The way that this tool operates is by taking advantage of flaws in mobile devices, especially smartphones, to access personal data, including calls, texts, emails, and other communications. It may also be used to activate the camera and microphone, monitor the device’s position, and do a variety of other things, thereby transforming it into a robust surveillance tool.

The properties of Pegasus are thoroughly covered in this chapter, with special emphasis placed on those aspects that set it isolated from different spyware and malware in terms of difficulty in detection [2]. It also explains how Pegasus operates on both iOS and Android operating systems and suggests using advanced technologies like machine learning and AI to develop systems that can identify and prevent Pegasus, safeguarding devices from adware, malware, or spyware. Additionally, the chapter presents case studies demonstrating Pegasus’s evolution over time and proposes methods to prevent spyware from infiltrating and spreading on user devices. By following the practical safety guidelines outlined in this chapter, readers can learn how to protect themselves from Pegasus’s surveillance tool.

• Investigating the market origins and distribution of Pegasus.
• Examining how Pegasus operates and its ability to turn smartphones into listening devices by exploiting multiple vulnerabilities.
• Proposing various techniques to detect potential Pegasus attacks.
• Sharing advice on how to recognize the presence of Pegasus spyware on a device.
• Suggesting the utilization of command-line or terminal utilities to lower the likelihood of being affected by the Pegasus spyware.
• Providing practical recommendations to enhance awareness and protect devices from Pegasus spyware.

Spyware attacks have become increasingly sophisticated in recent years. In the past, malicious software could be installed by opening a suspicious email as early as a decade ago [3]. However, Pegasus spyware has now adopted a “mobile first” strategy, whereby it impersonates its users by sending links in text messages that appear to be from trusted sources. Clicking on these links gives Pegasus access to sensitive information, such as location data and financial information. From 2016 to 2021, Pegasus has become even more advanced and now uses “zero-click” technology, which relies on zero-day threats that are unknown to the user and remain unpatched [4]. To limit the success of Pegasus on user devices, the research paper titled “Pegasus: A Privacy Killer” recommends adopting basic precautions, like avoid unknown links, categorization of devices, and using reliable VPNs for all devices [5, 6]. Pegasus uses complex zero-day infection vectors to infiltrate devices. Once installed, try different ways to get access to victim’s data and transmits it to the server [7]. The way how Pegasus can attack and exploit your phone can be seen in Figure 1.1.

1. It uses GPS information to identify and differentiate targets and obtain precise information
2. The Pegasus spyware does not require coordination with local Mobile Network Operators (MNOs), making it independent of service providers.
3. It control both the content and devices it infects by utilizing proprietary protocols and SSL, commonly used in complex communications, which allows it to surpass encrypted information.
4. The surveillance includes monitoring various applications, such as Instagram, Twitter, WhatsApp, Skype, Viber etc.
5. Monitor VoIP and voice calls in real time (call interception).
6. Pegasus can recognize operational identities without the need for regularly switching virtual identities or while continuously surveilling/observing the device.

Figure 1.1 Pegasus impact.

1.2 Working of Pegasus

This spyware name Pegasus is a highly advance and dangerous tool that exploits “Zero-day Vulnerability,” a security weakness for which no patch or update is available or known by the manufacturer. Pegasus can silently infiltrate various Android and iOS devices and covertly monitor all device activities. By exploiting vulnerabilities in third-party spyware, Pegasus can take complete control of the device, allowing the attacker to perform various actions. To protect against such attacks, users must take proactive measures, such as installing antivirus software, regularly updating device firmware, and being vigilant when clicking on links from unknown sources.

Pegasus can access data like access your messages, location tracking, content surfing, can make calls from compromised phones, call logs can be accessed, access to photo, camera and Microphone can be accessed and an delete data and even retrieve the deleted files from the mobiles. Pegasus spyware directly transmit the data obtained from target’s phone straight to the data server of NSO group [8].

Pegasus spyware is a highly advanced malware that can be installed easily through physical contact, text or email and through calls and messages. It exploits vulnerabilities that have not been updated with a patch or are not known to the relevant parties. It can infiltrate a device through a missed call on WhatsApp or an iMessage on iPhones [9]. The Pegasus spyware utilizes a zero-click method that does not require any user interaction, making it challenging to detect. Even if a user tries to delete a suspicious message, the spyware can persist on the device and infect it [10].

Pegasus spyware is a highly sophisticated tool that can decrypt end-to-end encrypted messages and files, making it a potent weapon in espionage [11, 12]. Recent findings indicate that the latest versions of Pegasus can infiltrate devices through missed calls and delete the call logs to cover up the attack, making it harder to detect and track its actions. This poses a significant challenge for users who may not even be aware that their devices have been compromised [13].

A diagram depicting the general workflow of Pegasus can be seen in Figure 1.2.

Figure 1.2 Pegasus workflow.

The workflow of Pegasus on a normal device vs. an infected device can be seen in Figure 1.3. It is interesting to find how an infected device behave differently from the normal device. In normal device, the common phasis include

Device Setup

The user...

Produkt-Details

• Erscheint lt. Verlag: 27.2.2025
• Sprache: englisch
• Themenwelt: Mathematik / Informatik ► Informatik ► Theorie / Studium
• ISBN-10: 1-394-26889-0 / 1394268890
• ISBN-13: 978-1-394-26889-4 / 9781394268894