Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy

by Laurent Richard

THE FINAL BLOW to Vincenzetti—a live-by-the-sword, die-by-the sword blow—was heralded by an unexpected message posted on Hacking Team’s own Twitter account in the first dark hours of July 5, 2015. “Since we have nothing to hide,” read the tweet, “we’re publishing our emails, files, and source code.” This hijacked tweet was almost two months in the making. A very patient and cautious hacker who called himself “Phineas Fisher” (he had already hacked the rival Gamma Group) would eventually take credit, publishing a technical explanation of how he found a vulnerability in the system software that pried open a back door into Hacking Team’s internal network. Once through that door, Phineas lived undetected inside the network for weeks, sniffing out passwords, listening in on audio, viewing webcam images, even watching one of the system administrators spend hours of his workday playing World of Warcraft. When he discovered an under-protected server used by the company’s software developers, its sales team, and its key executives, Phineas mounted the server remotely and accessed a mother lode of company backup files. Within those backups were passwords that gave him access to the live server, as well as the domain admin password, which gave him access to the company’s internal emails. He downloaded the emails to his own server, a stealth exfiltration executed against the kings of exfiltration. Phineas continued to live and learn on the network, dancing around and through firewalls...