Spain’s prime minister’s cell phone was hacked with Pegasus spy app

Spanish authorities have detected the presence of the spy app Pegasus on the cell phones of Prime Minister Pedro Sánchez and Defense Minister Margarita Robles, said on Monday (2) the Minister of Government for the Presidency, Félix Bolaños, at a press conference.

Sánchez’s phone was infected in May 2021 and at least one data breach has occurred since then. Bolaños did not say who was behind the action or whether foreign groups are suspected of spying on the prime minister. “The interventions were illegal and external. ‘External’ means that they were carried out by unofficial bodies and without the authorization of the State,” he said, adding that the violations were reported to the Ministry of Justice and that the country’s Supreme Court will be responsible for the case.

The announcement comes after intense pressure on the left-wing coalition that commands the government, after the Canadian digital rights group Citzen Lab (citizen lab) said that more than 60 people linked to the Catalan separatist movement were targeted by Pegasus, an app made by the company. Israeli NSO.

Following the allegations, Catalonia’s pro-independence party ERC, minority partners in the ruling alliance, said it would stop supporting Sanchez until Madrid took steps to restore the relationship.

The separatist Pere Aragones, Catalonia’s regional president, said on Monday that when spying is against the independence movement, “we only hear silence and apologies”. “[Mas] today everything was done quickly. The double standard is clear. It seems that against independence, everything is accepted.”

European Union Data Monitoring has called for Pegasus to be banned due to allegations of abuses by governments to spy on human rights activists, journalists and politicians.

What is Pegasus? A digital spying tool sold by the Israeli company NSO Group. Instead of trying to intercept data circulating on the internet, it installs itself inside the target cell phones and has access to all the information inside the devices.

The company says it provides the technology only to governments, for purposes such as investigating terrorists, pedophiles and criminals in general, but does not disclose its customers. All sales must be approved by the Israeli Ministry of Defense. Its existence became public in 2018.

What he does? It monitors virtually all information on cell phones, such as messaging, email access and phone conversations. It can also trigger the cell phone’s camera, microphone and GPS sensor to capture information, without the user noticing.

By being inside the devices, it manages to bypass barriers such as end-to-end encryption, in which only the author and receiver of a message can access it.

How does the invasion take place? There are several ways. Initially, infection by sending links was more common. The owner of the device received messages with promotions that could interest him, such as a discount on well-known products. When clicking, he was taken to a fake page, which triggered the download and installation of the spy program, without the user noticing.

There are many tactics to convince the victim to click on the link, such as sending a series of annoying spam messages. When the person clicks on the “stop receiving this message” option, they land on the infected link.

In the last two years, the “zero link” model has become more common, in which the infiltration takes place without the user having to do anything. The spy program looks for security holes in everyday apps or websites and infiltrates them. By default, apps on mobile are allowed to access the internet. If the security of the app is not properly configured by the developers, a hacker can infiltrate and send the spy program through any app, such as messaging, music, news, exercises, etc. Upon entering the cell, Pegasus installs itself and starts spying within seconds.

There is also the “network injection” tactic, which makes a momentary intercept of the connection between the target cell phone and a known website. The attack lasts milliseconds and manages to infiltrate before the site or user’s device notices the flaw.

However, this option is more complex, as it depends on monitoring how the target user uses the internet, to know in which app or website to place the trap and the exact time to trigger it. Thus, it is also necessary to have access to connection data, stored by telephone companies.