Can NSO Pegasus infect my Xubuntu laptop

[Ralph L]

I've recently been reading about how NSO's Pegasus software can infect iphones and Android phones. Apparently you don't even need to click on something in some cases. It can be sent to you as a message and just installs itself??? I also read something about it can infect a phone??? by sending it a pdf file. Does anybody know how true this stuff is??? Most importantly, does anybody know if it can infect my Xubuntu laptop computer, and steal my passwords???????

[QIII]

Does anyone know? Maybe not here, unless there is a very high-level security analyst who has access to Nation-State-Level knowledge and just hangs out on the Ubuntu Forums for the fun of it.

I would say that the answers to your last two questions are "probably" and "probably".

But unless you feel you are a likely target of a nation-state, a roque nation, a drug cartel, a terrorist organization or a counter-terror organization, the more likely threat for you is the more mundane criminal element trying to get access to your credit cards or interested in identity theft. That's what you need to be more concerned about.

That, of course, presumes that some nation-state or mega-billionaire has not already produced a quantum computer. If they have, every password, every database, every security system or protocol, every database on the face of the Earth ... you get the idea ... was compromised and hacked within 15 minutes of the thing being connected to the internet. If that has happened, you are known right down to the brand, color size of underpants you wear. In which case the gig is up anyway and all we can hope is that Neo and Morpheus are on the job.

In all seriousness, worry about the common criminals.

[crip720]

Don't even have to worry about the common criminals. Worry about the idiots that leave databases wide open on the net with all your info available to look at. They do seem a bit better now, have not noticed any in the news this month.

[Ralph L]

My question was really to get a better understanding of linux. Apple claimed the problem was that they had a bug that they were able to fairly easily fix. It apparently allowed messages to insert code in the operating system. So I was trying to understand if linux had a similar bug that allowed messages to insert code in the OS. I know some of linux vulnerabilities, for example that somebody was able to insert a keystroke recorder in linux and send recorded keystrokes back to a website. Since that vulnerability was well known, I presume it was fixed, but I don't really know, since nobody talks about such security issues. I would guess that, since NSO Pegasus is so well known, somebody would be looking at the vulnerabilities that allowed it, but again I can find no information. I am not particularly worried about NSO coming after me, but I do like to understand the OSs that I use. Lack of transparency is one of the reasons I use linux and not windows.

Thanks for the responses....

[mikewhatever]

Xubuntu 14.04 is probably vulnerable to all kinds of exploits. It is a good idea to take care of the basics, such as upgrades, first, and then move on to more complex complex topics... - quantum physics, black holes, OS understanding, etc.

I've seen no reports that Ubuntu or other distos (or the Linux kernel, as this is what you use) were targeted by Pegasus. It is not impossible to do it, but if you expect regular forum members to know about very secret and sophisticated exploits, you come across as somewhat naive.

[HermanAB]

It depends on who you are and where you work. If you are Joe Sixpack or Pete The Plumber, then you don’t have much to worry about.

[naxal]

Hello,

I would like draw your attention to the cost of infecting one single phone with NSO Pegasus. It's not just a piece of software you and I can buy, install and then randomly use to infect who or whatever system you & I may wish.

Pegasus is one of the many tools which NSO uses. They offer their services and if you may pay close attention, hacking a phone using NSO Pegasus may cost ten of thousands of dollars. Pegasus isn't a software / tool running out in the wild or in dark-net where some random hacker may release it upon the internet to infect all.

When someone or some govt is willing to spend that much on snooping on a single individual, I guess that Individual is also someone worthy enough.

Point is the cost of hacking with such sophisticated tools and there, NSO isn't the only player in the game, So if you are such high value target worthy of spending top dollar on Pegasus, I guess your attackers will have many other tools at their disposal. Check out the victim list of NSO, who they are. They should have taken multiple hard steps to secure themself.

Barack Obama once shared his smartphone experience in an interview. Department of Defense gave President of USA a Blackberry phone, where they physically removed multiple components from the device, like Camera Module, GPS and many such. Not only that, the said device was running a custom firmware / software jointly developed with RIM and DoD (US). So the potential targets are taking hard steps to reduce the chance of such hack and teams are there actively working to prevent a hack.

Now coming to your question,

If you are such a high value potential target, why just Pegasus? Your attackers will have many other tools and services at their disposal and eventually they will hack your device. Unless you too are actively working and spending such top dollars to prevent such hack.

Thanks.

[Ralph L]

Thanks for the responses.

[grahammechanical]

Since that vulnerability was well known, I presume it was fixed, but I don't really know, since nobody talks about such security issues

I do not accept that statement. This forum has a link to a weekly news letter that lists all security vulnerabilities in Ubuntu versions that are still supported. See the heading Updates and Security for 18.04, 20.04, 21.04 and 21.10. The editor of this newsletter is Bashing-om a contributor to this forum.

https://ubuntuforums.org/showthread.php?t=2468962

Have you heard of the BootHole vulnerability in the X-Server? I read about in a post at Ubuntu.com. It reveals the extent that Linux distributors cooperate to fix vulnerabilities. In the case of BootHole they also worked with Microsoft.

https://ubuntu.com/blog/mitigating-b...ulnerabilities

Regards

[Ralph L]

grahammechanical
Thank you very much for your informative post. I had never heard of the Ubuntu Newsletter and the security section. I think that will answer a lot of my questions.