NSO Pegasus Malware - How Governments spy on any phone

[@Pocketpapi-JP]

As a newby in the cyber security field, this video was super good at explaining what this vulnerability is and how it was exploited by this malware. Gained a new subscriber 🤙🏽

[@cybercdh]

welcome :)

[@ReversingHub]

Awesome analysis! Thanks for posting this! One small note, the strings app for macOS finds ASCII, that's why I believe it didn't work for that sample. Thanks again!

[@thehen101]

Nice video, good catch with the domain. OA Labs did a similar thing with a ~20 year old sample and he had hundreds of computers phoning home if I recall correctly. It would also be very interesting to see if you could get your hands on the code that was doing those requests you were talking about right at the start. (had to re-phrase this comment, youtube silently removed it the first time around, they are autocensoring comments with keywords in them)

[@cybercdh]

OALabs rock for sure :)

[@produKtNZ]

Are you in any way able to advise what filterlist for Pi-Hole you would use fpr additional protection from these threats?

[@snowdoxsecurity8486]

Excellent video as usual bro..... Thank you for doing this 😊 🔥

[@cmdsecure]

Excellent walkthrough as usual Colin. Particularly in the threat intel side, really interesting.

[@Kattakam]

Amen brother, spot on about the lack of response. Just have to play the long game and hope for the best since there’s no possible way to completely re-engineer unless you’re the one writing the code. Educating institutions and users isn’t going to be as impactful as a critical mass event, which is, in this case what must happen to make the scale of change needed.

[@DiendaMadick]

If I was to see an app called Pegasus in my IOS crash analytics is that the same software/spyware? I got the phone from a pawn shop and eventually just ditched it but can it show up in crash logs? No idea who's phone it was before me. This was about a year ago

[@DarkLord-mp8fu]

Amazing work! Loved it.

[@kcthewanderer]

I've never used Patreon. That's about to change. These videos are excellent!

[@cybercdh]

Amazing - much appreciated!!

[@lahcenedaif7953]

Thank you for this high quality content keep it up 👏👏👏

[@J4vv4D]

Brilliant job! Thanks for sharing

[@TheAdeelkhaliq]

Great work! Loved your dedication

[@adelettouati4820]

Great Work Thanks for sharing , waiting for more Colin

[@codinguy]

Great video, excellent and really interesting work, love it 😍

[@PrinterJamOnToast]

Hi Colin - I'm currently going through the "Practical Malware Analysis" book, and was wondering if you think I should learn C before I learn Assembly, or vice versa?

[@cybercdh]

There’s no right path tbh, personally I knew more about C before I tackled an intro to x86. I found it made more sense having learned some basic principles with C. But YMMV.

[@PrinterJamOnToast]

@@cybercdh Thanks! I have started going through a beginners book on C. I will do a deep dive on x86 after I finish it, and then will continue learning at least how to read other languages (VBA, JavaScript, etc.) by going through source code. I am trying to avoid doing practical coding exercises because I think that an understanding of the syntax plus using Google, will be enough to understand what a piece of malware is trying to achieve. Would you agree with this?

[@cybercdh]

@@PrinterJamOnToast I think it’s a great pathway that will definitely help you explore the world of malware. Consider writing a blog; or tweeting about your progress, no doubt others will benefit from your journey

[@PrinterJamOnToast]

@@cybercdh Many thanks 🙏

[@andrewh619]

I mean honestly, how do i get your knowledge....

[@cybercdh]

There’s a LOT I don’t know.

[@sbakor8043]

Why do you think they would send a text with a domain they haven't registered? is it just because they don't need the user to click anything and they just put something random there?

[@cybercdh]

They previously owned the domain, but let it expire.

[@strudders2112]

Great Video as usual. Thanks.

[@johnsnow228]

Anyone know a documentary on Pegasus I can watch? Cant find any that are on. I just see 2 min trailers from forbidden stories

[@cybercdh]

Not one to watch, but highly recommend episode 99 and 100 of Darknet Diaries podcast. Episode 99 for me was unreal.

[@sumo-ninja]

So as someone as interested in a subject as you are to the point of making videos about it I'm pretty surprised that you've missed the point with the Pegasus samples. Pegasus basically is referring to whatever is zero days they're using at the time of the conversation because the whole remote compromise without user interaction is the only unique thing the malware needs after that you can use anything you want to compromise the phone and persist you can literally just use some of the built-in features to have the text and phone calls intercepted and blah blah blah once you install that malware dropper using hide the icon and you can do that one of several ways but again it could be the most basic dumb malware in the world if you wanted it to be after you compromise the phone it's to compromise it's important

[@rudielvaston9399]

Great Info mate!

[@davidhardy6881]

Very Interesting indeed

[@allurbase]

Great content, thank you!

[@bbazzahh]

Great video mate.

[@MauroScomparin]

Always interesting!

[@overlaw66]

More videos like this please :-)

[@TechNobo]

Very interesting

[@firosiam7786]

Could you please do a vedio on malware analysis using ghydra for beginers to understand how malware analysis works

[@1982masood]

it takes balls to cover such topic.. (you know y i relate i m form india. heheheh)

[@kantnklaar]

Right on

[@1982masood]

Awesome awesome

[@watap154]

Yeah

[@Southized]

Im 100% sure i have this on my iphone 8. I get random texts all the time never clicked on one link never anything my phone will be on 100% at 6 am and by 10 oclok it will be at 20% with barely any usage the phone was brand new a year ago