[New post] Appendix E – Pegasus Forensic Traces per Target Identified in the Aftermath of the Revelations of Pegasus Project

Syndicated posted: " This document is an appendix to the research report "Forensic Methodology Report: How to catch NSO Group's Pegasus", published as part of the Pegasus Project. It contains forensic analysis conducted by Amnesty Tech's Security Lab of the mobile devices o" New post on Changing World News Appendix E – Pegasus Forensic Traces per Target Identified in the Aftermath of the Revelations of Pegasus Project by Syndicated This document is an appendix to the research report "Forensic Methodology Report: How to catch NSO Group's Pegasus", published as part of the Pegasus Project. It contains forensic analysis conducted by Amnesty Tech's Security Lab of the mobile devices of individuals targeted with NSO Group's Pegasus spyware who were identified after the launch of the Pegasus Project on 18 July 2021. The analysis in this appendix has been published with the informed consent of the individuals whose phones were targeted. Forensic traces Forensic traces for HUJRN3 – Brigitta Csikász, Hungarian journalist Date (UTC) Event 2019-04-05 11:06:39 File Library/Preferences/com.apple.CrashReporter.plist created in RootDomain 2019-04-05 11:06:41 File Library/Preferences/com.apple.CrashReporter.plist modified in RootDomain 2019-04-05 11:06:57 File Library/Preferences/roleaccountd.plist created in RootDomain 2019-04-05 11:07:01 File Library/Preferences/roleaccountd.plist modified in RootDomain 2019-04-05 17:57:29 Process: logseld 2019-04-07 06:32:00 Process: logseld (IN: 0.71 MB, OUT: 0.40 MB) 2019-04-07 14:31:02 Process: logseld 2019-06-18 14:04:18 Process: roleaccountd (IN: 0.03 MB, OUT: 0.01 MB) 2019-06-18 14:04:22 Process: stagingd (IN: 8.55 MB, OUT: 0.41 MB) 2019-06-18 14:04:46 Process: bundpwrd 2019-06-21 05:14:41 Process: bundpwrd (IN: 4.37 MB, OUT: 2.24 MB) 2019-06-21 14:21:19 Process: bundpwrd 2019-07-12 14:10:39 iMessage lookup for account ex00x00adavies8266[@]gmail.com  (emmadavies8266[@]gmail.com) 2019-07-12 14:13:11 Process: roleaccountd 2019-07-12 14:13:39 Process: boardframed 2019-07-12 14:14:25 Process: stagingd 2019-07-13 10:09:47 iMessage lookup for account emmadavies8266[@]gmail.com 2019-07-31 13:33:30 Process: boardframed (IN: 21.00 MB, OUT: 13.58 MB) 2019-08-04 07:01:15 Process: boardframed 2019-11-18 08:16:31 Photostream lookup for account ameliehaggart[@]gmail.com 2019-11-18 08:18:50 Process: bh (IN: 4.43 MB, OUT: 0.16 MB) 2019-11-18 08:19:01 Process: bh 2019-11-18 08:20:44 Process: rolexd (IN: 8.96 MB, OUT: 23.01 MB) 2019-11-19 15:24:55 Process: rolexd Forensic traces for TRJRN1 - Ragip Soylu, Turkey Bureau Chief for Middle East Eye Date (UTC) Event 2021-02-09 07:26:27 Traces related to iMessage exploitation 2021-02-10 12:15:38 Process: tisppd 2021-02-12 07:25:17 Traces related to iMessage exploitation 2021-02-12 07:30:51 Process: CommsCenterRootHelper (IN: 1.74 MB, OUT: 0.23 MB) 2021-02-12 07:31:12 Process: CommsCenterRootHelper 2021-02-12 10:30:52 Process: launchrexd 2021-02-12 10:30:52 Process: boardframed 2021-02-19 05:26:06 Traces related to iMessage exploitation 2021-02-21 07:58:44 Traces related to iMessage exploitation 2021-03-22 05:39:06 Traces related to iMessage exploitation 2021-04-10 08:09:32 Traces related to iMessage exploitation 2021-04-13 20:39:16 Process: accountpfd 2021-04-14 04:41:05 Traces related to iMessage exploitation 2021-04-15 16:59:11 Process: xpccfd 2021-04-25 04:59:32 Traces related to iMessage exploitation 2021-04-26 23:52:27 Process: xpccfd 2021-05-02 07:12:23 Traces related to iMessage exploitation 2021-05-02 20:22:15 Process: faskeepd 2021-05-08 20:28:06 Traces related to iMessage exploitation 2021-05-09 12:51:05 Process: corecomnetd 2021-05-16 04:27:48 Traces related to iMessage exploitation 2021-05-19 11:04:07 Traces related to iMessage exploitation 2021-05-23 00:00:13 Process: roleaboutd 2021-07-05 12:41:48 Traces related to iMessage exploitation 2021-07-05 12:56:59 Process: ReminderIntentsUIExtension (IN: 1.89 MB, OUT: 0.22 MB) 2021-07-05 12:57:11 Process: ReminderIntentsUIExtension 2021-07-05 15:11:44 Process: neagentd 2021-07-05 15:11:44 Process: smmsgingd Forensic traces for UKHRL1 – David Haigh, human rights lawyer Date (UTC) Event 2020-08-03 04:01:01 iMessage lookup for account arvidamelia1[@]gmail.com 2020-08-03 07:37:49 Process: netservcomd (IN: 5.27 MB, OUT: 79.44 MB) 2020-08-04 15:27:47 Process: netservcomd Forensic traces for UKPOI1 - Anas Altikriti, CEO and Founder of The Cordoba Foundation Date (UTC) Event 2020-07-24 11:45:09 Process: otpgrefd (IN: 1.15 MB, OUT: 3.96 MB) 2020-07-24 18:45:05 Process: otpgrefd 2021-02-10 12:15:38 Process: tisppd 2021-02-12 10:30:5 Process: launchrexd 2021-02-12 10:30:52 Process: boardframed 2021-04-13 20:39:16 Process: accountpfd 2021-04-15 16:59:11 Process: xpccfd 2021-04-26 23:52:27 Process: xpccfd 2021-05-02 20:22:15 Process: faskeepd 2021-05-09 12:51:05 Process: corecomnetd 2021-05-23 00:00:13 Process: roleaboutd 2021-07-05 15:11:44 Process: neagentd 2021-07-05 15:11:44 Process: smmsgingd  Updates of the document 6 August 2021: first version of this appendix published (HUJRN3, TRJRN1, UKHRL1 and UKPOI1) Source / Read More: https://www.amnesty.org/en/latest/research/2021/08/appendix-e-pegasus-forensic-traces-per-target-identified-in-the-aftermath-of-the-revelations-of-pegasus-project/ Syndicated | August 6, 2021 at 4:30 pm | Categories: Critical Awareness, Human rights, Politics | URL: https://wp.me/p2RXDZ-gMB Unsubscribe to no longer receive posts from Changing World News. Change your email settings at Manage Subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://softmachine.net/appendix-e-pegasus-forensic-traces-per-target-identified-in-the-aftermath-of-the-revelations-of-pegasus-project/