In the wake of the \u201cPegasus Project\u201d revelation that nearly 200 journalists around the world have been Pegasus spyware targets, Reporters Without Borders (RSF) has compiled recommendations for journalists who could themselves be the targets of those who buy this high-performance surveillance software.<\/p>\n
Pegasus\u2019s strength is due above all to the fact that, \u201cthere is no effective way for a user to counter this type of attack,\u201d explains Claudio Guarnieri, an IT security expert at Amnesty International\u2019s Security Lab. Designed by the Israeli company NSO Group, this high-performance spyware is capable of sucking up a phone\u2019s entire content \u2013 messages, emails, photos, contacts and so on \u2013 without requiring any particular user action and without leaving easily detectable traces.<\/p>\n
As they cannot guard against such an attack, journalists working on sensitive subjects in connection with any of NSO Group\u2019s 11 known governmental clients (the governments of Mexico, India, Morocco, Indonesia, Saudi Arabia, United Arab Emirates, Kazakhstan, Azerbaijan, Togo, Rwanda and Hungary) should take the following steps if they suspect a potential Pegasus infection:<\/p>\n
\u2022 Stop using your smartphone at once and buy a new one to continue communicating. Keep the potentially infected device as evidence but keep it far away from yourself and your work environment.<\/p>\n
\u2022 Disconnect all accounts from the potentially infected phone and change all the passwords from another device.<\/p>\n
\u2022 Contact Forbidden Stories or IT experts such as those at Amnesty International\u2019s Security Lab to see if your number is on the leaked list of 50,000 numbers. The Amnesty International expert group has also developed a tool, the Mobile Verification Toolkit (MVT), which can be used to find out if a smartphone has been infected with Pegasus. Note that its use requires good IT skills. Journalists can also send their phone number to Share@amnesty.tech to be checked.<\/p>\n
\u2022 If you cannot replace your phone:\u00a0<\/b><\/p>\n
\u2022 Restart the phone. Amnesty\u2019s experts have established that, on an iPhone, a restart can temporarily stop Pegasus from functioning on iOS.<\/p>\n
\u2022 Perform a factory reset of the smartphone even if this does not guarantee Pegasus\u2019s removal. Note that this may also destroy evidence of an infection.<\/p>\n
\u2022 Update the system software and all of the apps on the phone.<\/p>\n
\u2022 Remove all unknown devices connected to the various messaging and online account apps (Signal, WhatsApp, Twitter, Facebook, etc.).<\/p>\n
\u2022 Compile a list all the passwords that have been entered and stored in the smartphone. Then change them and never reuse the old ones.<\/p>\n
If any of your close contacts has been infected, they should follow the same recommendations.<\/p>\n
While there is to date no reliable countermeasure against Pegasus, certain actions and good practices can complicate the task of spyware trying to access a journalist’s smartphone:\u00a0<\/b>
\n<\/b><\/p>\n
Secure your smartphone:\u00a0<\/b><\/p>\n
\u2022 Protect your smartphone with a PIN. Use a six-digit PIN at least or, even better, a strong and unique sentence (different from your other passwords). Using an easy PIN such as “0000” or “1234” or your date of birth \u2013 whether for the phone itself or the SIM card \u2013 provides absolutely no security.<\/p>\n
\u2022 Update the smartphone\u2019s system software frequently.<\/p>\n
\u2022 Install a VPN. (But be aware that a VPN does not protect against certain types of attack.)<\/p>\n
\u2022 Install antivirus software (Avast, McAfee or Kaspersky).<\/p>\n
\u2022 Delete apps that are not used.<\/p>\n
\u2022 Turn your smartphone off at least once a day. This simple measure may be enough to thwart the operation of many spyware apps.<\/p>\n
Secure your messaging service and social media accounts:<\/b><\/p>\n
\u2022 Enable two-factor authentication on your most important accounts (Twitter, Google, Facebook, etc.).<\/p>\n
\u2022 Disable iMessage and FaceTime (which are known to be Pegasus points of entry).<\/p>\n
\u2022 Avoid using Google Home or any other voice assistant.<\/p>\n
\u2022 On an iPhone, uninstall such Apple apps as Apple Music, FaceTime, iMessage and Mail. Note that you must disable iMessage before uninstalling it.<\/p>\n
When using your smartphone:\u00a0\u00a0<\/b><\/p>\n
\u2022 Whenever possible, use a VPN when browsing the Internet.<\/p>\n
\u2022 Never click on links in a message from an unknown number.<\/p>\n
\u2022 Do not use Wi-Fi in unreliable places, or use it only after previously activating your VPN.<\/p>\n
\u2022 Only install apps from the App Store (on an iPhone) or Google Play (on an Android phone).<\/p>\n
\u2022 Block notifications and requests for permission to access the address book.<\/p>\n
\u2022 Do not allow your smartphone to save passwords. Use a secure password manager such as LastPass.<\/p>\n
\u2022 Use Signal to communicate with your sources. For journalists dealing with very sensitive information, it may be a good idea to use a phone that is not connected to the Internet \u2013 an old mobile phone or a smartphone with no access to data.<\/p>\n
Other useful resources:\u00a0<\/b><\/p>\n
\u2022 The Access Now digital security helpline can diagnose your problems and provide helpful technical advice in nine languages.<\/p>\n
\u2022 The Digital First Aid Kit gives advice about a device that is behaving suspiciously, as does Surveillance Self-Defence. – Reporter’s Without Borders<\/p>\n","protected":false},"excerpt":{"rendered":"
In the wake of the \u201cPegasus Project\u201d revelation that nearly 200 journalists around the world have been Pegasus spyware targets, Reporters Without Borders (RSF) has compiled recommendations for journalists who could themselves be the targets of those who buy this high-performance surveillance software. Pegasus\u2019s strength is due above all to the fact that, \u201cthere is […]<\/p>\n","protected":false},"author":4,"featured_media":2543,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[76],"tags":[],"class_list":["post-2542","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifestyle"],"jetpack_featured_media_url":"https:\/\/timesasian.com\/wp-content\/uploads\/2021\/07\/ajouter_un_titre-4_page-0001.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/posts\/2542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/timesasian.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2542"}],"version-history":[{"count":1,"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/posts\/2542\/revisions"}],"predecessor-version":[{"id":2544,"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/posts\/2542\/revisions\/2544"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/timesasian.com\/index.php?rest_route=\/wp\/v2\/media\/2543"}],"wp:attachment":[{"href":"https:\/\/timesasian.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/timesasian.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/timesasian.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}