Connect with us

Hi, what are you looking for?

Technology News

Google Warns of New Spyware Targeting iOS and Android Users


In hearings this week, the notorious spyware vendor NSO group told European legislators that at least five EU countries have used its powerful Pegasus surveillance malware. But as ever more comes to light about the reality of how NSO’s products have been abused around the world, researchers are also working to raise awareness that the surveillance-for-hire industry goes far beyond one company. On Thursday, Google’s Threat Analysis Group and Project Zero vulnerability analysis team published findings about the iOS version of a spyware product attributed to the Italian developer RCS Labs.

Google researchers say they detected victims of the spyware in Italy and Kazakhstan on both Android and iOS devices. Last week, the security firm Lookout published findings about the Android version of the spyware, which it calls “Hermit” and also attributes to RCS Labs. Lookout notes that Italian officials used a version of the spyware during a 2019 anti-corruption probe. In addition to victims located in Italy and Kazakhstan, Lookout also found data indicating that an unidentified entity used the spyware for targeting in northeastern Syria.

“Google has been tracking the activities of commercial spyware vendors for years, and in that time we have seen the industry rapidly expand from a few vendors to an entire ecosystem,” TAG security engineer Clement Lecigne tells WIRED. “These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house. But there is little or no transparency into this industry, that’s why it’s critical to share information about these vendors and their capabilities.”

TAG says it currently tracks more than 30 spyware makers that offer an array of technical capabilities and levels of sophistication to government-backed clients.

Advertisement. Scroll to continue reading.

In their analysis of the iOS version, Google researchers found that attackers distributed the iOS spyware using a fake app meant to look like the My Vodafone app from the popular international mobile carrier. In both Android and iOS attacks, attackers may have simply tricked targets into downloading what appeared to be a messaging app by distributing a malicious link for victims to click. But in some particularly dramatic cases of iOS targeting, Google found that attackers may have been working with local ISPs to cut off a specific user’s mobile data connection, send them a malicious download link over SMS, and convince them to install the fake My Vodafone app over Wi-Fi with the promise that this would restore their cell service.

Attackers were able to distribute the malicious app because RCS Labs had registered with Apple’s Enterprise Developer Program, apparently through a shell company called 3-1 Mobile SRL, to obtain a certificate that allows them to sideload apps without going through Apple’s typical AppStore review process.

Apple tells WIRED that all of the known accounts and certificates associated with the spyware campaign have been revoked. 

“Enterprise certificates are meant only for internal use by a company, and are not intended for general app distribution, as they can be used to circumvent App Store and iOS protections,” the company wrote in an October report about sideloading. “Despite the program’s tight controls and limited scale, bad actors have found unauthorized ways of accessing it, for instance by purchasing enterprise certificates on the black market.”



Source link

Advertisement. Scroll to continue reading.
Advertisement

You May Also Like

Technology News

The ad reads like an offer of salvation: Cancer kills many people. But there is hope in Apatone, a proprietary vitamin C–based mixture, that...

Manufacturing News

93% of OT Organizations Experienced an Intrusion in Past 12 Months, and 78% Experienced More than Three Fortinet® (NASDAQ: FTNT), a global leader in...

Technology News

Cybersecurity Service Provider Aligns with Excelerate Systems to Expand Offerings Press Release – Jun 24, 2022 09:00 MST PHOENIX, June 24, 2022 (Newswire.com) –...

Business News

SENSITIVE MATERIAL. THIS IMAGE MAY OFFEND OR DISTURB Abortion rights protesters participate in nationwide demonstrations following the leaked Supreme Court opinion suggesting the possibility...

Technology News

You may never have heard of Hikvision, but chances are you’ve already been captured by one of its millions of cameras. The Chinese company’s...

Government News

Press Release – Jun 21, 2022 13:37 EDT GENEVA, June 21, 2022 (Newswire.com) – Gathering on the sidelines of the 50th session of the...

Advertisement