Here we are again: another example of government surveillance related to smartphones from Apple and Google has emerged, and shows how sophisticated government – backed attacks can be and why there are good reasons to keep mobile platforms completely locked.
I do not intend to focus too much on the news, but in brief it is as follows:
- Google Threat Analysis Group published information exposing the hack.
- The attack was created by Italian surveillance firm RCS Labs.
- The attack was used in Italy and Kazakhstan, and possibly elsewhere.
- Some generations of the attack get the help of ISPs.
- On iOS, attackers misused Apple’s enterprise certification tools that enable in – house app deployment.
- Approximately nine different attacks were used.
The attack works like this: A unique link is sent to the target that aims to lure them in to download and install a malicious app. In some cases, the spooks worked with an ISP to disable data connectivity to entice targets to download the app to retrieve that link.
The zero day episodes used in these attacks were fixed by Apple. It was previously warned that actors are bad abuse its systems that allow businesses to distribute apps internally. The revelation is related to recent news from Lookout Labs regarding an enterprise – grade Android spy called Hermit.
What’s at risk?
The problem here is that surveillance technologies like this have been commercialized. It means that capabilities that have historically only been available to governments are also being used by private contractors. And that is a risk, because very secret tools could be exposed, exploited, back-engineered and misused.
Mar Google said: “Our findings highlight the extent to which commercial surveillance vendors have increased capabilities that have historically only been used by governments with the technical expertise to develop and operate labor. This makes the Internet less secure and jeopardizes the confidence that users rely on. ”
Not only that, but these private surveillance companies are enabling the proliferation of dangerous hacking tools, making these high-tech snooping facilities available to governments – some of which seem to enjoy spying on dissidents, journalists, political opponents , and human rights workers.
There is an even greater risk that Google is already tracking at least 30 espionage makers, suggesting that the commercial-as-a-service surveillance industry is strong. It also means that it is now theoretically possible for even the least credible government to access tools for such purposes – and in view of the many identified threats to the use of cybercrime-exploited exploits, It’s logical to think that this is another revenue stream that encourages malice. research.
What are the risks?
The problem: these close links between private surveillance providers and cybercrime will not always work in one direction. These events – some of which are at least difficult enough to discover that only governments would have the resources to do so – will eventually leak.
And while Apple, Google, and everyone else are still committed to a cat – and – mouse game to prevent such crime, shutting down heroes where they can, there’s a risk that any security fault will slip on a door or device under the mandate of the government into commerce in the end. markets, from which it reaches the criminal ones.
The European data protection regulator has warned: “Disclosures of Pegasus spyware have raised very serious questions about the potential impact of modern spying tools on fundamental rights, in particular privacy and data protection rights. . ”
That is not to say that there are no legitimate reasons for security research. There are flaws in any system, and we need to encourage people to recognize them; security updates would not exist at all without the efforts of various types of security researchers. Apple pays up to six figures for researchers who identify vulnerabilities in their systems.
What happens next?
The EU data protection supervisor has called for the use of the Renowned Pegasus Group NSO software earlier this year. In fact, the call went further, completely calling for “a ban on the development and deployment of Pegasus-capable spyware.”
NSO Group is now apparently for sale.
The IS The EU also said where such cultivars would be used in exceptional cases, companies should require such use as NSO which is subject to regulatory supervision. As part of this, they must respect EU law, judicial review, respect the rights of criminal procedure and agree not to import illegal information, to avoid any political abuse of national security and to support civil society.
That is to say, these companies need to introduce.
What you can do
Following a revelation about NSO Group last year, Apple published the following best practice recommendations to help mitigate such risks.
- Update devices to the latest software, including the latest security settings.
- Protect devices with passcode.
- Use two-factor authentication and a strong password for Apple ID.
- Install apps from the App Store.
- Use strong unique passwords online.
- Do not click on links or attachments from unknown senders.
Copyright © 2022 IDG Communications, Inc.
The surveillance-as-a-service industry needs to be stepped up
Source link The surveillance-as-a-service industry needs to be stepped up