Judge orders NSO Group to show Pegasus spyware source code

NSO Group, the Israel-based maker of super-charged snoopware Pegasus, has been ordered by a federal judge in California to share the source code for "all relevant spyware" with Meta's WhatsApp. The order [PDF] from Judge Phyllis Hamilton at the end of last month stems from WhatsApp's 2019 lawsuit [PDF] against NSO for allegedly spying on 1,400 WhatsApp users. The spyware maker is accused of sending carefully crafted data over the internet to select people's phones that, via a vulnerability in the chat app's VoIP stack, allowed malicious code to silently run on those devices, code that in turn allowed victims' conversations and other sensitive information to be accessed remotely. NSO marketed this surveillance service to governments around the world. Judge Hamilton's ruling covers Pegasus and other relevant NSO spyware during the period from April 29, 2018 to May 10, 2020. And it represents a significant legal setback for NSO Group which has been fighting tooth and nail not to be held accountable for providing surveillance tools to government clients. The court order is not a complete rout, however: The judge allowed NSO to withhold its client list and details about its server architecture. NSO Group, which reorganized in 2022, declined to comment on the record. During the period from January 2018 through May 2019, NSO Group allegedly created WhatsApp messaging accounts, set up a series of proxy and relay servers using cloud service providers, and used this infrastructure to s...