A U.S. judge has mandated that NSO Group relinquish its source code for Pegasus and other remote access trojans to Meta as part of Meta's ongoing legal dispute with the Israeli spyware vendor.

This decision represents a significant legal triumph for Meta, which initiated the lawsuit in October 2019, accusing NSO Group of exploiting its infrastructure to distribute spyware to roughly 1,400 mobile devices between April and May, including targeting two dozen Indian activists and journalists.

These attacks capitalized on a then-zero-day vulnerability in the instant messaging app (CVE-2019-3568, CVSS score: 9.8), exploiting a critical buffer overflow flaw in the voice call feature to deploy Pegasus simply by making a call, even if unanswered. Additionally, the attack methodology involved erasing call information from logs to evade detection.

Recently released court documents reveal that NSO Group has been instructed to provide details on the full functionality of the relevant spyware, covering a period from one year before the alleged attack to one year after (April 29, 2018, to May 10, 2020). However, NSO Group is not obliged to disclose specific server architecture details, as Meta can acquire such information from the spyware's functionality. Notably, NSO Group is not required to disclose the identities of its clients.

Donncha Ó Cearbhaill, head of the Security Lab at Amnesty International, expressed disappointment that NSO Group can keep its clients' identities confidential, despite the court's decision favoring Meta.

NSO Group faced sanctions from the U.S. in 2021 for developing and supplying cyber weapons to foreign governments, which maliciously targeted various individuals, including government officials, journalists, and activists.

Meanwhile, Meta faces criticism from privacy and consumer groups in the European Union over its "pay or okay" subscription model, which they argue forces users into a choice between paying a "privacy fee" or consenting to be tracked by the company, potentially undermining GDPR regulations.

These legal developments coincide with findings from threat intelligence firm Recorded Future, revealing a new multi-tiered delivery infrastructure linked to Predator, a mobile spyware managed by the Intellexa Alliance. This infrastructure network likely serves Predator customers across several countries, including Angola, Armenia, and Saudi Arabia, among others.

Source: https://thehackernews.com/2024/03/us-court-orders-nso-group-to-hand-over.html