Infosec community is battling the log4j bug that has the whole internet stressed out. But at the same time, privacy activists might have a wholly different reason to heave a sigh of relief.
While this is playing out, Israel-based NSO Group is considering shutting down its notorious spyware product Pegasus, and selling the company — potentially ending a nightmare of breaches of sensitive information and surveillance of prominent global figures and journalists.
A report by Bloomberg noted the NSO Group has consulted advisors from New York-based bank Moelis & Co. to chart the road ahead. It said that two unnamed US funds have expressed interest in acquiring the Israeli firm.
In November, the US blacklisted the NSO Group for the use of the Pegasus Spyware. The US Department of Commerce said at that time the company supplied spyware to foreign governments to “maliciously target government officials, journalists, business people, activists, academics, and embassy workers.” Along with NSO, another Israeli spyware firm, Candiru, was also put on the entity list.
This ban resulted in the Israel-based firm running out of funds and defaulting on loans worth $500 million. Because of these events, the NSO Group is mulling a sale.
However, there’s a cautionary line as in the story. Bloomberg’s Yaacov Benmeleh and Eliza Ronalds-Hannon reported that the new investors want to infuse $200 million and turn Pegasus into a ‘defensive’ product. That doesn’t sound trustworthy.
Pegasus spyware has haunted journalists, activists, and politicians the world over. First discovered in 2016, it came to the limelight in 2019 with a WhatsApp exploit, which allowed attackers to secretly infect phones with malicious spyware. This was followed by allegedly being involved in hacking Amazon founder Jeff Bezos and playing a part in journalist Jamal Khashoggi’s murder by the state of Saudi Arabia.
In July, a consortium called Pegasus Project revealed the true impact of the spyware. It noted that there was an extensive list of phone numbers of officials in high places that could’ve been targeted. Plus, it said at least 10 national governments were trying to monitor their citizens.
Major tech companies, including Meta and Apple, have sued the Israeli company for exploiting their platforms and snooping on people. So it’s hard to trust this kind of product in a defensive avatar. Plus, there will likely be some suspicion of the presence of backdoors being built into its new products.
Ronald Deibert, the director of Canada-based research firm Citizen Labs, warned that we should look out for corporaterebranding of the product.
Fire sale may be happening soon at NSO Group:
Israel’s NSO Group considering sale or shutdown of Pegasus unit
Warning: don't believe the hype about "defensive" products. Who'd trust that company with defence?
Watch out for corporate rebranding too…
— profdeibert (@RonDeibert) December 14, 2021
Israeli publication Haaretz noted that Pegasus’ rise to prominence could be linked to the former prime minister Benjamin Netanyahu. He used his diplomatic relation with friendly countries to lay “the groundwork for the purchase of Pegasus”.
Now that Netanyahu is no longer in power, the Israeli administration fears that the US will blacklist more offensive cybersecurity firms. According to a report by the Times of Israel, the country’s new government banned the sale of cyber technologies to 65 countries, including UAE, Saudi Arabia, and Mexico — fueled by the NSO controversy.
If Pegasus is shut down eventually, digital privacy experts around the world should put pressure on governments to bring in bans and legislation to block the use of spyware to snoop on citizens. As the situation in India has shown, it’s not going to be easy.
Get the TNW newsletter
Get the most important tech news in your inbox each week.