Amazon kicks NSO off cloud after cyber spy reports

By Laura Berrill
Pegasus hacking tool used AWS as part of its cyber spyware services to government clients

Amazon has now deactivated the cloud computing accounts that researchers say have been associated with NSO Group, a cyber hacking tools company that reportedly used Amazon Web Services as part of spyware systems. These were in turn used by governments to surveil phones.

The removal came about as a result of research by forensic investigators at Amnesty International, who discovered the Israeli company’s Pegasus software on journalists’ and activists’ phones and at times using AWS systems to operate. The researchers at Citizen Lab, which analyses spyware at the University of Toronto, confirmed Amnesty’s discovery that the hacking tools were operating on AWS’ CloudFront - a content delivery network product.

Amnesty’s report reveals Amazon had told its researchers back in May that it had moved fast to get the hacking activity off its systems. According to a report in the New York Times, the Pegasus spyware can access and record texts, videos, photos and web activity; as well as recording and scraping passwords on a device. It is designed to work both on iPhones and some Android.

Cyber spyware aimed at targeting journalists and activists

An NSO Group spokesperson said that the claims were false then added it referred to the claim that AWS had removed its accounts. NSO added it would investigate the findings that its products had been used to spy on activists and journalists. Some phones which were reviewed showed signs they had been breached with the spyware multiple times.

The spyware worked by redirecting the phones’ owners to websites that would automatically download the spyware, away from the original common website they had initially visited. Some targets’ devices were infected when they received a text message containing a ‘zero-click’ attack, meaning the owner doesn’t have to click on a malicious link for the hack to take place. The reported attacks took place through iMessage, a method previously reported to have been used to hack the phones of Al-Jazeera journalists. The NSO had denied these claims.

Amazon’s decision to end support for the hacking activity comes in the same year that AWS removed accounts belonging to social media service, Parler which it said had contained various slurs.


Featured Articles

TECH LIVE LONDON: An overview of the hybrid technology show

We take a look at the first day of Tech Live London with insights from technology leaders from companies such as IBM, Microsoft and Vodafone

TECH LIVE LONDON: Begins tomorrow at 10am!

Our marquee technology event is nearly here. There's still time to claim your free ticket (worth £295). Look forward to welcoming you to the Tobacco Dock!

Executive Q&A: Marc Lueck, CISO EMEA, Zscaler

As we prepare to welcome the Zero Trust leaders to TECH LIVE LONDON this June 23-24, we take the opportunity to chat to Zscaler CISO of EMEA, Marc Lueck

TECH LIVE LONDON: Registering, networking and logistics

Digital Transformation

New speaker from Infosys announced for TECH LIVE LONDON!

Digital Transformation

New speaker from Bernadette announced for TECH LIVE LONDON!

Digital Transformation