Replied by Anurag Sharma, Research Associate, VIF
In May 2019, WhatsApp submitted an incident report to the Indian Computer Emergency Response Team (CERT-In), mentioning that it has “identified and fixed a vulnerability which could have enabled an attacker to insert and execute a code on cellular devices.” The Government of India acknowledged the issue of digital privacy infringements of its citizens. In November 2019, WhatsApp informed the Ministry of Electronics and Information Technology (MeitY) about an exploitation of their platform by a spyware program—Pegasus, developed by the NSO Group. On 26 November 2019, CERT-In had sent a notice to the NSO Group and sought details about the Pegasus and the impact on Indian users.
Pegasus, also known as Trident, is a spyware program developed by the NSO Group—an Israel-based company, to undertake the remote surveillance of the smartphones/cellular phones. A program equipped with powerful coding, Pegasus can survive OS (Operating System) reboot, factory resets, and OS upgrades. Having sophisticated keylogging program and audio recording programs, Pegasus is capable of defying the WhatsApp’s ‘End-to-End Encryption’ feature by “stealing messages before the encryption, and post-decryption in case of incoming messages”.
Further Reading/Sources:
- Government of India. “Withdrawal of WhatsApp security vulnerability warning from the CERT-In website”, Ministry of Electronics and Information Technology, Unstarred question no-2747, Rajya Sabha, 12 December 2019, Available from: http://pqars.nic.in/annex/250/Au2747.pdf. Accessed on 17 July 2021.
- “Unstarred Question No- 1951”, Rajya Sabha- Ministry of Electronics and Information Technology, 05 December 2019, Available from: http://pqars.nic.in/annex/250/Au1951.pdf. Accessed on 17 July 2021.
- Sharma, Anurag. “Pegasus-A Powerful Tool of WhatsApp Surveillance”, Vivekananda International Foundation, 05 February 2020, Available from: https://www.vifindia.org/2020/february/05/pegasus-a-powerful-tool-of-whatsapp-surveillance . Accessed on 17 July 2021.
- Orr Hirschauge and Inbal Orpaz. “U.S. Fund to Buy NSO and its Smartphone-snooping software”, Haaretz, 17 February 2014, Available from: https://www.haaretz.com/israel-news/business/u-s-fund-to-buy-snooping-software-1.5323394. Accessed on 17 July 2021.
- Dinesh Narayanan and Venkat Ananth. “Pegasus spyware can target up to 50 phones at once”, The Economic Times, 02 November 2019, Available from: https://economictimes.indiatimes.com/tech/internet/pegasus-spyware-can-target-up-to-50-phones-at-once/articleshow/71860858.cms?from=mdr. Accessed on 17 July 2021.
- John Snow. “Pegasus: The ultimate spyware for iOS and Android”, Kaspersky daily, 11 April 2017, Available from: https://www.kaspersky.com/blog/pegasus-spyware/14604/. Accessed on 17 July 2021.