Pegasus Spyware Signs Can Be Detected on Your Phone Using This Dedicated Tool

Mobile Verification Toolkit (MVT) tool is aimed to help you find forensic traces to understand whether the Pegasus spyware has targeted your phone.

By Jagmeet Singh | Updated: 20 July 2021 15:16 IST

Pegasus Spyware Signs Can Be Detected on Your Phone Using This Dedicated Tool

Photo Credit: Pexels/ cottonbro

Pegasus spyware targeted thousands of activists, journalists, and politicians

Highlights

NSO Group’s Pegasus spyware signs can be detected using a tool
Amnesty researchers found more forensic traces on iPhone over Android
You need basic command line knowledge to use MVT for your phone

Pegasus spyware from Israel-based NSO Group was found to have allegedly helped governments in countries, including India, to hack into the phones of thousands of activists, journalists, and politicians. An international consortium of news outlets revealed some details of the targets in the last couple of days. However, the scope of targeted attacks through Pegasus is yet to be defined. Meanwhile, researchers at Amnesty International have developed a tool to let you see whether your phone is targeted by the spyware.

Called Mobile Verification Toolkit (MVT), the tool is aimed to help you identify if the Pegasus spyware has targeted your phone. It works with both Android and iOS devices, though the researchers noted that it is easier to find the signs of compromise on iPhone handsets over an Android device due to more forensic traces available on the Apple hardware.

“In Amnesty International's experience there are significantly more forensic traces accessible to investigators on Apple iOS devices than on stock Android devices, therefore our methodology is focused on the former,” the non-governmental organisation said in its research.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

Users need to generate a backup of their data to let MVT decrypt locally stored files on their phone to look for Pegasus indicators. However, in case of a jailbreak iPhone, a full filesystem dump can also be used for the analysis.

In its current stage, MVT requires some command line knowledge. It may, however, receive a graphical user interface (GUI) over time. The tool's code is also open source and is available along with its detailed documentation through GitHub.

Once a backup is created, MVT uses known indicators such as domain names and binaries to look for traces related to NSO's Pegasus. The tool is also capable of decrypting iOS backups if they are encrypted. Further, it extracts installed apps and diagnostic information from Android devices to analyse data for any potential compromise.

Pegasus, Other Spyware Exports Are for Lawful Use Only, Israel Says

MVT requires at least Python 3.6 to run on a system. If you are on a Mac machine, it also needs to have Xcode and Homebrew installed. You also need to install dependencies if you want to look for forensic traces on an Android device.

After you are done with the installation of MVT on your system, you need to feed in Amnesty's indicators of compromise (IOCs) that are available on GitHub.

As reported by TechCrunch, there might be an instance in which the tool may find a possible compromise that might be a false positive and needs to be removed from the available IOCs. You can, however, read the organisation's forensic methodology report to check out the known indicators and look for them in your backup.

iMessage on Many iPhone Models Compromised by Pegasus Spyware: Amnesty

In collaboration with Amnesty International, Paris-based journalism nonprofit Forbidden Stories shared a list of more than 50,000 phone numbers with the news outlet consortium Pegasus Project. Of the total numbers, journalists were able to find more than a thousand individuals in 50 countries who were allegedly targeted by the Pegasus spyware.

Amazon Shuts Down Cloud Infrastructure Linked to Pegasus Firm NSO: Report

The list of targets included journalists working for organisations including The Associated Press, Reuters, CNN, The Wall Street Journal, and India's The Wire, among others. Some political figures including Rahul Gandhi of the Indian National Congress and political strategist Prashant Kishore were also recently claimed to be a part of the targets.

What is the best phone to buy right now? We discussed this on Orbital, the Gadgets 360 podcast. Orbital is available on Apple Podcasts, Google Podcasts, Spotify, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Pegasus Spyware, Pegasus, NSO Group, Pegasus Tool, Pegasus Mobile Verification Toolkit, Mobile Verification Toolkit, Amnesty International