If You Have a Smartphone, Fog Reveal Probably Has Your Number

What is Fog Reveal? A legal scholar explains the app some police forces are using to track people without a warrant...

Government agencies and private security companies in the U.S. have found a cost-effective way to engage in warrantless surveillance of individuals, groups and places: a pay-for-access web tool called Fog Reveal.

The tool enables law enforcement officers to see “patterns of life” – where and when people work and live, with whom they associate and what places they visit. The tool’s maker, Fog Data Science, claims to have billions of data points from over 250 million U.S. mobile devices.

The tool – made possible by smart device technology and that difference between data privacy and electronic surveillance law protections – allows domestic law enforcement and private entities to buy access to compiled data about most U.S. mobile phones, including location data. It enables tracking and monitoring of people on a massive scale without court oversight or public transparency. more

How to Hunt Down Malware on Mobile Devices

co-authored by Josh Hickman, Subject Matter Expert Collect and Review, Cellebrite

The ubiquity of mobile devices makes them prime targets for malware attacks. Despite the expertise in incident response and malware detection for PCs and Macs, mobile security, on the other hand, often remains uncharted territory for many organizations and users alike. No longer a question of if but when an attack is going to happen, there is a pertinent need for education in identification, resolution and bolstering defences against future attacks.

What Malware Looks Like and How it Gets There

Mobile malware manifests in various forms, from ransomware encrypting data to spyware surreptitiously monitoring activities. Understanding the modus operandi of mobile malware is critical for detection and mitigation efforts...How it lands on a device and what you can do... more

China’s Nuclear Battery Powers your Smartphone for 50 Years

A Chinese startup called Betavolt has cooked up this itty-bitty nuclear battery - about the size of a little coin - which they claim can crank out electricity for 50 years straight, with no charging pit stops needed.

As the company leaps from development to the pilot stage, they're gearing up for full-scale production and a grand entrance into the market pretty soon...

Zhang Wei, Chairman and CEO of Betavolt, said in a press release that the BV100 marks a groundbreaking achievement as the world's first mass-produced nuclear battery...

The company also deems these batteries safe for medical devices within the human body, such as pacemakers and cochlear's, with no external radiation. more

Ok, now think of this technology being applied to quick-plant eavesdropping bugs and voice recorders.

Your Smartphone: More Attentive Than Your Spouse?

via Joshua Brustein - Bloomberg Tech Daily

Eavesdropping ads: People have been telling me for years that their phones are listening to their conversations and sending them ads based on what they say. I've dutifully told them there’s no evidence this is a thing, which often turns into a long argument.

So I appreciated 404 Media’s scoop that Cox Media Group tells clients it actually can tap into the microphones of mobile devices to target ads. 

This sounds like the worst idea ever. But I’m at least looking forward to helping confirm my friends’ worst fears rather than trying to dissuade them.

Smartphone Security: Delete These Apps

Smartphone owners have been urged to remove certain apps that could be spying on their activity.

Some of the most popular apps you love and have come to rely on could be posing more of a danger than they're worth. Here's what you need to know. ...some of those apps that you love and have come to rely on could actually be putting you at risk... We’ve (Reader's Digest) collected information about some of the worst offenders so that you can make an educated decision about which apps you trust with your privacy and which ones need to go...

CamScanner
Ana Bera is a cybersecurity expert with Safe at Last. She identified CamScanner, an app meant to imitate a scanner with your phone, as one of the apps consumers should be concerned about. “Cybersecurity experts have found a malicious component installed in the app that acts as a Trojan Downloader and keeps collecting infected files,” she explains. “This kind of app can seriously damage your phone and should be de-installed instantly. Luckily, once you remove it from your phone, it is highly unlikely that it will continue harming you.”

Weather apps
“Check your weather app,” says Shayne Sherman, CEO of TechLoris. “There have been several different weather apps out there that have been laced with Trojans or other malwares.” While the most benign of these claims to take your information purely for weather accuracy, he calls that questionable. “Watch your local forecast instead, and if you have Good Weather, delete it now,” he advises. “That one is especially dangerous.”

Facebook
Look, we all love our social networking apps. But cybersecurity expert Raffi Jafari, cofounder and creative director of Caveni Digital Solutions, says, “If you are looking for apps to delete to protect your information, the absolute worst culprit is Facebook. The sheer scale of their data collection is staggering, and it is often more intrusive than companies like Google. If you had to pick one app to remove to protect your data, it would be Facebook.”

WhatsApp
“This is a call to action for users who may be living under a rock and unaware of the vulnerabilities that were disclosed earlier this year,” says Michael Covington, VP of Product for mobile security leader Wandera. “The vulnerabilities with WhatsApp—both iOS and Android versions—allowed attackers to target users by simply sending a specially crafted message to their phone number. Once successfully exploited, the attackers would be granted access to the same things WhatsApp had access to, including the microphone, the camera, the contact list, and more.”

Instagram
Whatsapp and Instagram are both owned by Facebook, which is part of what makes them all a risk. Dave Salisbury, director of the University of Dayton Center for Cybersecurity and Data Intelligence, says that Instagram “requests several permissions that include but are not limited to modifying and reading contacts and the contents of your storage, locating your phone, reading your call log, modifying system settings, and having full network access.” Plus Nine More

U.S. Blacklists 2 Firms - Built Meta, iOS and Android Spyware

The Commerce Department blacklisted two European cyber firms that build spyware software, the Commerce Department announced Tuesday, including technology hawked by both firms that was used to surveil Meta users and reportedly at least one Meta employee.

The software exploited vulnerabilities in Android and iOS software and deployed hundreds of spoof Meta accounts to surveil activists, politicians and journalists around the world.

The firms — Intellexa and Cytrox — were described jointly as traffickers of “exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide” in a Bureau of Industry and Security press release. more

France Set To Allow Police To Spy Through Phones

French police should be able to spy on suspects by remotely activating the camera, microphone and GPS of their phones and other devices, lawmakers agreed late Wednesday.

Part of a wider justice reform bill, the spying provision has been attacked by the left and rights defenders as an authoritarian snoopers' charter, though Justice Minister Eric Dupond-Moretti insists it would affect only "dozens of cases a year".

Covering laptops, cars and other connected objects as well as phones, the measure would allow geolocation of suspects in crimes punishable by at least five years' jail.

Devices could also be remotely activated to record sound and images of people suspected of terror offenses, as well as delinquency and organized crime. more

The First Digital Security Rule of Traveling

(We know our clients already know this, but reminders help.)

The first digital security rule of traveling is to leave your usual personal devices at home. Go on your trip with “burner” travel devices instead.

Aside from the potential for compromise or seizure by authorities, you also run the gamut of risks ranging from having your devices lost or stolen during your trip. It’s typically way less dangerous to just leave your usual devices behind, and to bring along devices you only use when traveling. This doesn’t need to be cost prohibitive: You can buy cheap laptops and either inexpensive new phones or refurbished versions of pricier models. (And also get privacy screens for your new phones and laptops, to reduce the information that’s visible to any onlookers.)

Your travel devices should not have anything sensitive on them. If you’re ever coerced to provide passwords or at risk of otherwise having the devices be taken away from you, you can readily hand over the credentials without compromising anything important. more

Qphone Claims to Secure Communications

Highly Secure Communications Platform Enables Encrypted, End-to-End Voice, Messaging, and Video

Global Integrity announced the immediate availability of Qphone, a secure communications software platform that encrypts and protects voice, text, and video conversations between mobile devices, laptops, and desktop computers. Supporting iOS and Android, the Qphone app ensures total privacy of communications using end-to-end quantum-resistant encryption.

“Every day there are new instances of eavesdropping, corporate espionage, and compromised systems initiated from bad actors, leaving organizations vulnerable,” explained Bill Marlow, CEO of Global Integrity. “Messaging apps and cybersecurity infrastructure available today are mostly compromised in some fashion. Qphone offers a new approach, delivering a native phone app that is easy to use yet highly secure. In short, Qphone makes privacy simple.” more

New "RatMilad" Android Malware—Steals Data and Spies on Victims

"RatMilad", a new type of Android malware, is now being used within the Middle East to spy on victims via their smartphones and steal data. RatMilad is a kind of spyware, which are malware programs used to spy on victims through their devices. RatMilad is capable of recording both video and audio, giving the attackers the ability to listen in on private conversations and conduct remote surveillance.

On top of this, RatMilad allows malicious actors to change application permissions on victims' devices.

RatMilad is infecting devices via a phony VPN and number spoofing apps Text Me and NumRent. These apps are being spread through links on social media, meaning almost anyone could be exposed to RatMilad. Once the phony app is installed onto the device, RatMilad can start stealing data and spying on victims. It is being used in this campaign by an Iranian hacker group known as AppMilad. more

A Warning Worth Repeating — iPhone's Spying Feature

iPhone’s ‘spying’ feature lets you eavesdrop on conversations without people knowing...

The Apple iPhone is packed full of secret tools and tricks. But one feature is possibly the sneakiest of them all.

The iPhone's 'Live Listen' feature was originally intended to help people with hearing difficulties better manage conversations in noisy environments.

It lets you listen to a live audio feed through your AirPod earphones using the iPhone's microphone from a distance.

However, if used correctly, it means you could listen in on any conversation from outside a room without anybody else knowing. All you'd have to do is hide your iPhone somewhere in the room. more

Some Thoughts on Mobile Spyware

It really is a great time to be a mobile threat. As mobile devices become ever more critical in our daily lives, hackers are seizing on a vulnerable blindspot in the enterprise attack surface...

Mobile threats often emanate from app stores, where many types of mobile malware hide as legitimate apps...

As Sun Tzu once said, “There is no place where espionage is not possible.” Spyware exemplifies that statement perfectly. Spyware turns a personal mobile device into a corporate espionage bug just by entering an office, nestled in someone’s pocket...

To secure this largely-unrecognized vector, enterprises can look to mobile threat defense. When incorporated as part of a zero trust approach, MTD technology can examine the security of individual mobile devices, alerting the enterprise to threats and blocking access. It can ensure the device hasn’t been infected, jailbroken or compromised and act to protect corporate data if a threat arises. more

iPhone Malware Tactic Causes Fake Shutdowns: Enables Spying

The ‘NoReboot’ technique is the ultimate in persistence for iPhone malware, preventing reboots and enabling remote attackers to do anything on the device while remaining completely unseen.

In the world of mobile malware, simply shutting down a device can often wipe out any bad code, given that persistence after rebooting is a challenge for traditional malicious activity. But a new iPhone technique can hijack and prevent any shut-down process that a user initiates, simulating a real power-off while allowing malware to remain active in the background.

The stealthy technique, dubbed “NoReboot” by researchers, is “the ultimate persistence bug,” according to a ZecOps analysis this week... 

Is There a Patch for NoReboot?

ZecOps researchers noted that even though they call the issue a “persistence bug,” it can’t actually be patched because “it’s not exploiting any…bugs at all — only playing tricks with the human mind.” Via Twitter, the firm said that the technique works on every version of iPhone, and to prevent it, Apple would need to build in a hardware-based indicator for iPhone sleep/wake/off status.

To protect themselves, iPhone users should run standard checks for malware and trojanized apps, and take the usual vetting precautions when downloading and installing new apps. more

Khashoggi's Wife's Phone Bugged With Spyware Before Killing

The mobile phone of Hanan Elatr, the wife of Saudi dissident and journalist Jamal Khashoggi was reportedly bugged by United Arab Emirates agents.  

The cell phone of Hanan Elatr was infected several months before he was killed in 2018. 

Jamal Khashoggi was killed in Saudi Arabia’s consulate in Istanbul, reported Sputnik citing The Washington Post. The phone of Elatr was reportedly infected when she was questioned by UAE officials.  more

Millions of Android Phones Vulnerable Over ‘Eavesdropping’ Scare

MILLIONS of people around the world have been exposed to snoopers by dodgy microchips loaded into Android smartphones.

According to security experts, vulnerabilities in processors produced by Taiwanese firm MediaTek could have allowed malicious apps to spy on their users.

MediaTek, one of the world's leading chip-makers, last month issued a fix for four bugs disclosed by researchers at cyber firm Check Point.

Its circuitry is found in one in three of the world’s smartphones, including high-end handsets from Xiaomi, Oppo, Realme, Vivo and more.

Check Point detailed the vulnerabilities exposed by its crack team of cyber buffs in a blog post last week. more

 

A New "Mobile" Phone - Complete with No Apps

Ever wish you had a mobile phone that would really turn heads?
One where you could call your friends, real or imaginary?
One that would look at you with loving eyes? 

Your past is now your future...  

FutureWatch - Spycam Detection using Phone Time-of-Flight Sensors

via theregister.com
"Sriram Sami, Bangjie Sun, and Sean Rui Xiang Tan, from National University of Singapore, and Jun Han from Yonsei University, describe how this might be done in a paper [PDF] titled "LAPD: Hidden Spy Camera Detection using Smartphone Time-of-Flight Sensors"... 

...smartphones are commonplace these days, so adding an app like LAPD is likely to be more convenient than carrying a dedicated bug or signal detector at all times. LAPD's goal is to be accessible, usable, and accurate, and to judge by the results reported in the paper, it hits those marks...

"The 'attackers' have all the power to place hidden cameras anywhere, and the public is, in contrast, generally defenseless," he explained. "That's why we're doing this work, and why we hope hidden camera detection can become more commonplace." Sami said he intends to release the source code for LAPD but has to coordinate that with his colleagues." more

Security Director Alert: Check for Spyware When Execs Travel

Smartphone, laptop, etc. device check service for traveling users.  

Detect Pegasus and other 0-click and 1-click spywares. Check before and after executives enter high-risk countries to determine their exposure and perform remediation. Prevent introducing foreign threats to your network. Service is a ZecOps product. more

Pegasus: How The Spyware Invades Phones & What It Does

What is Pegasus?
Is Pegasus a hacking software or spyware? It is pipped as the best version of both worlds that was developed, marketed, and licensed to governments around the world by the Israeli company NSO Group. This is because of the intrusive nature it possesses where it can infect and silent surveillance on billions of phones running either iOS or Android operating systems. 

Pegasus was first discovered in 2016 in a group of mobile devices which were infected via a spear phishing campaign which tricked users into clicking on malicious links which would install the spying software. However, recent versions of the spyware are much more sophisticated and require zero interaction from the victim for delivery and execution.

How it works?
The spyware executes via a zero-click exploit. This means that a victim does not need to interact with the initial delivery vector of the spyware for the malicious code to be executed. The victim receives a message on SMS, WhatsApp, iMessage or any other messaging application. As soon as the message is received the spyware is executed and all traces of the message are deleted. This implies that the user’s device will be infected with the spyware, without the user being aware of even receiving any suspicious message. more

BlackBerry Updates SecuSUITE to Secure Phone Calls from Eavesdropping

BlackBerry has announced that its SecuSUITE for Government offering now provides certified end-to-end encryption of all group phone calls and instant messages for governments and enterprises alike.

As a result of the global pandemic, millions of employees are working from home, with many teams turning to group calling methods to ensure business continuity. However, enterprises and government officials around the world are increasingly being targeted by coordinated eavesdropping attacks. SecuSUITE protects these individuals against identity spoofing, metadata harvesting and communications interceptions, which can compromise sensitive discussions and major operations. more  infographic