NSO denies any involvement in Khashoggi's death, insisting that its software is "used only to combat terrorism and crime."
The company was convicted by NSA whistleblower Edward Snowden as "the worst of the worst" videoconference with an Israeli audience last November.
"The NSO group in the world today, based on the evidence before us, is the worst in selling these burglary tools that are currently being used against human rights abuses by dissidents, opposition activists, and activists," Snowden said.
I experienced the power of Pegasus two years ago. Mobile security experts from Check Point, one of the world's leading cyber security companies, showed me how to hack a phone and get full access to the microphone, camera, keyboard and data with one click.
They say the malware they have Pegasus was similar to Pegasus': A seemingly innocent message appeared on my phone asking me to update my settings, and that was all they needed to access the phone.
Cybersecurity expert Michael Shaulov launched a cybersecurity startup in 201
"Even as [NSO Group sells] the software specifically the law enforcement agency that bought it specifically, in the event that these guys are looking for" unlawful targets ", NSO has no control [over it]," he says. "You can not really stop it."
The NSO Group says that it can monitor the use of all its software by all of its customers, but it should actively examine how customers use their products before they become aware of potential abuse.
The company's technology uses so-called "zero days" – hidden vulnerabilities in operating systems and apps that allow elite hackers to access the phone's internal functions. The term derives from the fact that software developers did not have time to correct them.
Companies like NSO have research teams that are continuously reverse engineering Apple and Android operating systems to find bugs in the code they can then exploit, says Shaulov describing the process as zero days of "art" in the industry to find a largely black and white world of cyber security.
NSO Group's unique focus on mobile devices has made it the "Alpha Hound" on the market, says Shaulov. 19659002] Finding a zero day can take from a few months to more than a year, and there is little guarantee of its long-term effectiveness. However, if the weakness is not resolved, it can be used repeatedly to hack phones. Software developers like Apple and Google have used teams to find and fix vulnerabilities. However, it is no easier for them than for hackers to find the vulnerability. In addition, the developers' priorities may be elsewhere, so even known bugs can not be fixed.
"If Apple or Google does not resolve this vulnerability, this can take many, many years, and NSO can continually sell software that can be used" by these errors in the software and by infecting these phones, "says Shaulov.
Khashoggi: "God help us"
The software that infects a phone after a single click on a link can send a fake sms message that gives hackers full access to the link Phone, data stored on the phone, messages, phone calls and even GPS position data are visible hackers see where someone is, who they are talking to and with whom.
In the case of Khashoggi, Citizen Lab researchers say that the SMS went to Abdulaziz, disguised as a shipping update on a package he had just ordered. The connection, which according to Citizen Lab was attributed to a Pegasus-linked domain, resulted in Abdulaziz & # 39; cell phone becoming infected with the malware, allowing hackers to gain access to virtually all of his phone, including his daily conversations with Khashoggi.
In a text before his death on October 2 at the Saudi Consulate in Istanbul, Khashoggi learned that his talks with Abdulaziz may have been bugged. "God help us," he wrote. CNN was granted access to correspondence between Khashoggi and Montreal-based activist Abdulaziz.
Two months later, Khashoggi entered the building to make an appointment to pick up papers that would allow him to marry his Turkish fiancé, Hatice Cengiz. Minutes later, he was killed in an attack that the Saudi Attorney General later acknowledged as premeditated murder.
The Saudis have presented changing stories about Khashoggi's fate and initially denied any knowledge before arguing that a group of rogue operators, many of whom belong, belonged to Saudi Arabian Crown Prince Mohammed bin Salman, responsible for the journalist's death.
Riad has claimed that neither Salman nor King Salman knew of the operation against Khashoggi. However, US officials said such a mission – including 15 men sent from Riyadh – could not have been carried out without the approval of bin Salman.
NSO speaks out
NSO Group's first interview since the company was involved in the Khashoggi case categorically denied CEO Shalev Hulio any involvement in the persecution of the Saudi journalist or his murder. Hulio called his death a "shocking murder," Hulio said, according to the controls carried out by the NSO Group, the company knew right away whether its software had been used to track down a journalist.
"We conducted a thorough review of all our customers" Not just a customer who may be a potential suspect involved in the case, but also other customers who may be interested in following it for some reason "Hulio said in an interview with Yedioth Ahronoth, one of Israel's largest newspapers." We reviewed all our clients, both through discussions with them and through a foolproof technology review. The systems create their own documentation, and it is not possible to tackle this or that goal without us being able to verify it. "
" I say on the record that after all these reviews, no NSO product or NSO Technology was used on Khashoggi. This does not include tapping, monitoring, finding places, or gathering information.
Shalev Hulio – whose first name in NSO is "S" The NSO Group may use a customer's software when inappropriately used or against abusive targets such as journalists or human rights activists who only do their jobs.
"In cases where the system is misused, provided we know it technically the ecological system we sell immediately separated. this is something we can do both technologically and legally.
Hulio said NSO had "permanently" shut down the systems of three clients for abuse, even though he did not specify which clients.
Pegasus had been sold to Saud al-Qahtani, a high-ranking Saudi official who was arrested accused of having played an important role in Khashoggi's assassination, saying that he had close ties with Crown Prince Mohammed bin Salman, Hulio said that this had not been the case and did not sell to "private elements."
"All sales are authorized by the Israeli Ministry of Defense and are only given to states and their police and law enforcement agencies, "he said," just to fight terrorism and crime. "
Key point when the NSO Group sold the system to Saudi Arabia, Hulio said, "We do not comment on questions about specific customers. We can neither deny it nor confirm it. "
Worldwide, Hulio said that there are currently no more than 150" active targets "with the technology being pursued by NSO, saying that last year was the best in the company's history and system sold to" dozens of countries worldwide at all. " Continents beyond Antarctica. "
Hulio repeatedly portrayed his company as a company helping the world's intelligence agencies to combat terrorism and announce the lives saved by the technology.
" I will say with modesty that Thousands of people in Europe owe their lives to the hundreds of workers [we have] in Herzliya, "he said, referring to the Israeli city where the company is based." I repeat that any use [of our technology] to save on the criteria of life against crime or terrorism will cause our company to take immediate and unambiguous action.
Possible attack surface
The results of the Citizens Lab, which Hulio dism Citizen Lab says it was inaccurate, paint "a bleak picture of the human rights risk" of Pegasus, adding, "At least six Countries with significant Pegasus activity were previously associated with abusive spyware in connection with civil society, including Bahrain. Kazakhstan, Mexico, Morocco, Saudi Arabia and the United Arab Emirates. "
Apple, Google, and other technology companies are constantly working to fix bugs and close zero days in their software, bringing new code with new vulnerabilities that software developers spend millions of dollars on. To close these vulnerabilities before they are discovered, hackers spend time and energy discovering them before they are closed.This is a digital arms race of the 21st century.
Adam Donenfeld, a researcher focused on mobile Zimperium's focus on security says that the number of places where a phone is hacked is called a potential attack surface is nearly unlimited.
Donenfeld says it's hard to determine how many exist, "But much more than people think. There are many of them … there are always new vulnerabilities that connect to devices. "
Any interaction between a device and a phone, as simple as it may be, is a potential attack surface. Donenfeld uses the example of chat Applications, however, say it's not just chat apps that offer potential hackers.
If a hacker sends a video to your phone even before you open it, your phone has already received some metadata about the video also told the hacker that the video was being received, so you do not have to click on the video or accept the message to create a potential attack surface.
"I can send you a malicious data package that could corrupt the memory on your phone that can happen remotely if you only have [a chat app]"explains Donenfeld." They receive messages even when the app is closed because they run in the background becomes. [so] It is possible to execute code on your device without your knowledge. "
Value of Malware
 Although the number of potential attack surfaces is nearly unlimited, few provide access to it In addition, there are relatively few cyber experts who understand how to take advantage of the zero-day vulnerabilities.
The scarcity of zero days, coupled with the technical difficulties that are required of them uncovering them makes them incredibly valuable to the right buyer.
19659002] "If you have a working complete chain, it's definitely [worth] more than a million dollars," says Donenfeld. "There is always demand. There is always someone who will buy them. "
The NSO Group has apparently taken advantage of this demand and made it a multi-million dollar company with a powerful product.
But this product – Pegasus – has NSO has also been at the center of a series of lawsuits alleging that malware is being used, as Jamal Khashoggi has violated international law.
NSO told Abdulaziz in December against CNN's complaint was "completely unfounded" and showed "That there is no indication that the company's technology has been used."
"The lawsuit appears to be based on a collection of press releases created solely for the purpose of making headlines," NSO said in a statement Declaration. "In addition, products supplied by NSO are operated by the government customer to whom they are delivered without NSO or its employees participating are not. "