As Facebook's lawsuit against Israeli malware purveyor, NSO Group, continues, more facts are coming to light that undercut the spyware vendor's claims that it's just a simple software developer that can't be blamed for the malicious acts of its customers.
NSO Group argued in court that the sovereign immunity that insulates the governments it sells to (including such abusive regimes as the United Arab Emirates and Saudi Arabia) similarly shields it from Facebook's desire to prevent it from using WhatsApp to deploy malware. Facebook has since pointed out NSO uses US servers that it owns or rents to deploy the malware it claims it has no involvement in deploying.
More information has come to light, thanks to a whistleblower of sorts who spoke to Joseph Cox of Motherboard. The statements made by a former NSO employee further implicate the company in the dirty doings of its customers (who have targeted journalists, activists, and lawyers).
"Pegasus" is the name of the malware deployed via WhatsApp -- the preferred tool of governments the company sells to. (It's branded as "Phantom" when NSO pitches to US law enforcement agencies.) Once successfully deployed, the malware grants government agencies almost complete access to phone data, communications, and functions. Messages can be intercepted, making encryption irrelevant and the phone's mic and camera can be surreptitiously accessed to record conversations and take pictures.Infamous Israeli surveillance firm NSO Group created a web domain that looked as if it belonged to Facebook's security team to entice targets to click on links that would install the company's powerful cell phone hacking technology, according to data analyzed by Motherboard.
It's easier to get targets to activate the malware if it looks like it came from a legitimate source. That's where the impersonation comes in.
The IP address impersonating Facebook is no longer under NSO's control. Infamous IP protection firm MarkMonitor apparently took control of the domain in late 2016, handing control of it to Facebook to prevent further misuse.The IP address provided to Motherboard related to a 1-click installation of Pegasus, the former employee said. Motherboard reviewed multiple databases of so-called passive DNS records from cybersecurity services DomainTools and RiskIQ, which show what web domain an IP address related to at different points in time. Throughout 2015 and 2016, the IP address resolved to 10 domains. Some of these seem to have been designed to appear innocuous, such as a link a person could click on to unsubscribe themselves from emails or text messages. Others impersonated Facebook's security team and package tracking links from FedEx.
Facebook is also suing domain registrars for allowing customers to purchase domains that appear to be associated with the social media service. This isn't an unusual move, but it does appear to indicate most purchasers of Facebook-adjacent domains are using them for malicious purposes. Until now, no one's linked any of these domains to a malware vendor. This is only going to further harm NSO's assertions that its involvement in malware deployment begins and ends at the point of sale.