Former NSO Employees Says The Company Impersonated Facebook To Deploy Malware

from the so-much-for-the-innocent-middleman-theory dept

As Facebook's lawsuit against Israeli malware purveyor, NSO Group, continues, more facts are coming to light that undercut the spyware vendor's claims that it's just a simple software developer that can't be blamed for the malicious acts of its customers.

NSO Group argued in court that the sovereign immunity that insulates the governments it sells to (including such abusive regimes as the United Arab Emirates and Saudi Arabia) similarly shields it from Facebook's desire to prevent it from using WhatsApp to deploy malware. Facebook has since pointed out NSO uses US servers that it owns or rents to deploy the malware it claims it has no involvement in deploying.

More information has come to light, thanks to a whistleblower of sorts who spoke to Joseph Cox of Motherboard. The statements made by a former NSO employee further implicate the company in the dirty doings of its customers (who have targeted journalists, activists, and lawyers).

Infamous Israeli surveillance firm NSO Group created a web domain that looked as if it belonged to Facebook's security team to entice targets to click on links that would install the company's powerful cell phone hacking technology, according to data analyzed by Motherboard.

"Pegasus" is the name of the malware deployed via WhatsApp -- the preferred tool of governments the company sells to. (It's branded as "Phantom" when NSO pitches to US law enforcement agencies.) Once successfully deployed, the malware grants government agencies almost complete access to phone data, communications, and functions. Messages can be intercepted, making encryption irrelevant and the phone's mic and camera can be surreptitiously accessed to record conversations and take pictures.

It's easier to get targets to activate the malware if it looks like it came from a legitimate source. That's where the impersonation comes in.

The IP address provided to Motherboard related to a 1-click installation of Pegasus, the former employee said. Motherboard reviewed multiple databases of so-called passive DNS records from cybersecurity services DomainTools and RiskIQ, which show what web domain an IP address related to at different points in time. Throughout 2015 and 2016, the IP address resolved to 10 domains. Some of these seem to have been designed to appear innocuous, such as a link a person could click on to unsubscribe themselves from emails or text messages. Others impersonated Facebook's security team and package tracking links from FedEx.

The IP address impersonating Facebook is no longer under NSO's control. Infamous IP protection firm MarkMonitor apparently took control of the domain in late 2016, handing control of it to Facebook to prevent further misuse.

Facebook is also suing domain registrars for allowing customers to purchase domains that appear to be associated with the social media service. This isn't an unusual move, but it does appear to indicate most purchasers of Facebook-adjacent domains are using them for malicious purposes. Until now, no one's linked any of these domains to a malware vendor. This is only going to further harm NSO's assertions that its involvement in malware deployment begins and ends at the point of sale.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: impersonation, malware, spyware, surveillance
Companies: facebook, nso group, whatsapp