Forensic Methodology Report: How to catch NSO Group’s Pegasus

2 Likes

Apparently iVerify scan is able to scan for pegasus: Detecting Pegasus Infections - Schneier on Security

ArsTechnica Reporting: $1 phone scanner finds seven Pegasus spyware infections - Ars Technica

iVerify Blog: iVerify Mobile Threat Investigation Uncovers New Pegasus Samples

Yeah, but this is for Elite version. This company also seems to spread FUD and their basic version that was used to be listed on privacyguides, is just some guide on hardening your device and not detecting any real spyware.

Yeah I saw that thread. Anti-virus are mostly useless anyway on android. I was more interested in iVerify news because apparently you can send files for analysis to them, which might mean a better alternative to VirusTotal.

This is incorrect. The guide is just part of the iVerify app. The most powerful capability, as noted in all the links up thread, is that you can upload a diagnostic file to iVerify to scan with the same tools they use for enterprise customers.

Very limited in the free plan though :frowning:

Getting free scans with the latest and greatest forensic tools available on the planet is not something to complain about.

Its less complaining, more opsec concerns. Payment methods available are tied to identity, and the scan requires log files with extensive personal device data. Correlating data with identity can be an issue for high risk individuals. iVerify is also known to tie up with Palantir, which in itself is a dangerous entity for people with specific affiliations.

Something like Amnesty’s MVT works exactly because you can run it locally without leaking critical info or tying it to a payment method. iVerify isn’t useful without it.

You are right about the trade offs but iVerify remains a very valuable tool for many people and has real world results to back up their claims. Their capabilities also likely go beyond Amnesty’s MVT in detecting new forms of spyware.

Just because a tool isn’t for you or for everyone doesn’t make it bad.

I agree, was just pointing out the free plan is severely limited for people with stricter threat models. Hopefully with time it becomes clearer if their tool is actually able to do this detection consistently.

1 Like