Turn off your cell phone five minutes a day to protect yourself from viruses. That is the advice that Pedro Sánchez told in La Revuelta that he had received from those responsible for Moncloa Systems after the spying with Pegasus. But its usefulness as a cybersecurity measure is limited and depends on the type of threat, as Josep Albors, head of Research and Awareness at ESET Spain, explains to 20minutos: “It only applies to specific cases in which the malware is present in the RAM, which is deleted when you restart the device.”
The specialist distinguishes these cases from common threats: “For the majority of users, who face more mundane threats, this advice, in terms of cybersecurity, is of little use,” he points out. This does not mean, however, that restarting is useless and Albors comments that performing this small action “from time to time” “never hurts”, since “you free up memory and close background applications that could be consuming resources, thus, in many cases, making the smartphone run more smoothly”.
What can kill a reboot and what can survive
Some malicious programs remain only in the temporary memory of the device. In those cases, rebooting may remove the active infection. Others achieve “system persistence”: they remain installed and can turn off again after turning the phone off and on. According to Albors, it is this second situation that affects the common threats of the average user.
The advice to turn your phone off and on is not new. As we already told in 20bits, the NSA recommends doing it at least once a week and the justification is the same as that indicated by the person responsible for Research and Awareness at ESET Spain: interrupting certain malicious programs that only remain in the temporary memory of the mobile. Upon reboot, they disappear and the attacker would have to infect you again. But this gesture does not close the security breach through which they entered nor eliminate all threats.
Let's think, for example, of a malicious application that we have installed without realizing it. Turning off the phone does not uninstall it: it may still be there when we turn it on again. Therefore, disconnecting it for a few minutes is not enough to resolve any infection and there are other ways to act against mobile malware. The important thing is to identify what has happened and act on the cause, without assuming that the problem has disappeared because the mobile starts up normally again.
What is Pegasus and how does it work?
Pegasus is a spy program developed by NSO Group. Allows you to access information on your phone and use functions such as the camera or microphone. Albors explains that he can use different techniques. In some versions, the spyware remains only in RAM to leave less trace. A reboot may remove it, but that does not fix the vulnerability that allowed the attacker to enter. “Even if the spyware is removed with a reboot, if the exploited vulnerability is not patched, simply knowing the victim's phone number could re-infect that device,” he warns.
The specialist remembers that certain attacks do not require any interaction from the victim. The attacker can try to compromise the phone again without the owner clicking a link or downloading a file, as long as the security flaw is still available.
In specific versions, Albors adds, spyware can also gain persistence in the system and survive a reboot, although that increases the risk of leaving fingerprints on the device. Therefore, turning it off and on does not guarantee eliminating an infection.
Are we all vulnerable to Pegasus?
Albors insists that the Pegasus case should not be confused with the everyday risk of any user: these tools are directed at selected targets and are generally used by state agencies in espionage operations. “The only thing that needs to be clear is that this software is not aimed at ordinary users,” he emphasizes.
That is to say: most people face security threats related to fraudulent links or malicious applications, so the recommendations they should follow do not have to be the same as those directed to someone exposed to surveillance, as is the case of those affected by Pegasus.
Three simple gestures to protect your mobile
For the regular user, Albors proposes prioritizing three measures:
