Where Smartphones Became Spyware Piñatas

A spying scandal in Mexico widened after it was confirmed by experts that several of the country’s top opposition leaders — along with journalists and human rights advocates — were targeted by high-tech spyware exclusively sold to governments.

The Internet watchdog group Citizen Lab exposed the scandal (in June) in a report that showed that spyware known as Pegasus had been used in recent years to infiltrate the cellphones of 12 prominent journalists and rights activists, all of whom had been critical of the Mexican government...

The victims received messages with links to the malware, which, when activated, allows outsiders to remotely access a phone’s data as well as activate its camera and microphone. more

Android Malware - Steals Personal Data, Then Covers its Tracks

A new variant of Android malware is making rounds in the Google Play store and it is bad news all around.

According to Trend Micro, a Trojan dubbed Xavier, which is embedded in more than 800 applications on Android’s app store, clandestinely steals and leaks personal data.

Mobile malware is not new to the Android platform, but Xavier is a little more clever. It downloads codes from a remote server, executes them, and uses a string encryption, Internet data encryption, emulator detection, and a self-protect mechanism to cover its tracks. more

FlexiSpy Spyware Hacked - Other Spyware is Next They Say

After blitzing FlexiSpy, hackers declare war on all stalkerware makers: 'We're coming for you'

A Brit biz selling surveillance tools that can be installed on phones to spy on spouses, kids, mates or employees has been comprehensively pwned by hackers – who promise similar stalkerware peddlers are next.

The miscreants, supposedly Brazilian and dubbing themselves the Decepticons, have explained how they, allegedly, easily infiltrated FlexiSpy before snatching its source code and other files, and wiping as many servers as they could. That code has now leaked online, and the gang say they are on the warpath.

"We're just, like, this group of guys, you know? We can hack these people, and we can expose their secrets, but it's up to everyone to make a difference," the team said on Monday.

"If you're a spouseware vendor, we're coming for you. Stop, rethink your life, kill your company, and be a better person."

FlexiSpy is one of a number of creepy outfits making a living selling borderline-legal code to people who are paranoid that their significant other is cheating on them, or that their kids or staff are up to no good. more

They Always Blame the IT Guys and the Cops – Shocking

Malicious software bought by a London Police Officer can remotely hack users...

One of the officers of UK’s Metropolitan Police Service was caught in possession of a malicious software used for infecting computers and smartphones after gaining physical access to them.

It’s unclear as of yet whether this software was bought for official or personal use, but it does raise a question that why would an MPS’s officer need to buy a malware that can do things like intercepting phone calls, turning on microphones and taking pictures remotely via the infected device’s camera. Especially if the use of this malware wasn’t allowed, which would make it illegal. more


Former Expedia IT tech gets 15 months in jail for insider trading, stealing information from execs...

“This was not a one-time lapse in judgement – this defendant used his technology skills to repeatedly invade the email accounts of Expedia executives so that he could enrich himself at the expense of others,” U.S. Attorney Annette L. Hayes said in a statement. “Even after he moved on to a better paying position at a different technology firm he continued his crimes, all while trying to make it look like other employees were at fault...

As a “senior IT support technician” based in San Francisco, Ly routinely had access to Hotwire and Expedia employee login information and devices. Ly used those credentials to break into company files to get information he later used in stock transactions....

Ly tried to cover his tracks by using login credentials of other employees when using the service to look at sensitive information... Ly’s acts didn’t end when he left the company in April 2015. Ly kept a company-issued laptop that could connect to Expedia’s network, and he used other employees’ login information to continue breaking into Expedia files and emails. more

400 Google Play Store Apps Have Been Compromised with BankBot

A new Malware has been spotted in the wild targeting Google Play Store apps.

The malware has been dubbed as “BankBot” by security researchers... So far at least 400 Google Play Store apps have been compromised. 

The attacking mechanism: Once downloaded, the malware tricks users into gaining administrative privileges before removing the icon of the app, letting the user think that the app has been deleted. In reality, however, the app continues to work in the background!

That’s not all; the Botnet is designed to display fake screens disguised as banking apps, encouraging the users to put credit card information and other login credentials. As soon as the app gets what it wants, the credentials are then passed on to the hacker through a control and command (C&C) server. more

Smartphone Malware Up 400% in 2016

Mobile device malware infections reached an all-time high last year, according to a new Nokia Threat Intelligence Report, released Monday.

Smartphones were by far the most vulnerable devices, with infections that rose nearly 400% in 2016. Attacks on smartphones represented 85% of all mobile device infections in the second half of the year, according to the report. more

Macbook Anti-Spyware App - Reveals Video & Audio Spying

After reading about how hackers have taken control of a MacBook's iSight camera to spy on the person sitting in front of it, you might start to get a feeling that someone is watching you... Making matters worse, hackers have been able to spy on people without triggering the little green light that tells you your iSight camera is active...
...monitor your iSight camera so you know when it's being used. MacOS doesn't let you do this natively, so you'll need to turn to a third-party app: OverSight.

OverSight is a free app that installs quickly and places an icon in your menu bar to let you know it's running. more  Other security apps from the same developer.

Security Director Alert: The USB Leach

If you see this, call us...

"The LAN Turtle is a covert Systems Administration and Penetration Testing tool providing stealth remote access, network intelligence gathering, and man-in-the-middle monitoring capabilities.

Housed within a generic "USB Ethernet Adapter" case, the LAN Turtle’s covert appearance allows it to blend into many IT environments."
----

"This is insane. No one at my work would notice this!"
-Pentest with Hak5 Student

more

Flexi Morality - Expanded Cell Phone Spyware Laws Introduced

On three occasions this week, I asked a FlexiSpy salesperson a simple question: If I wanted to, could I use their spyware to snoop on my wife's cellphone without her knowing? The answer each time was yes. 

When asked if it was legal, they responded with a canned disclaimer explaining it was necessary to get the permission of the target. But what if I didn't want my wife to know? They could help me anyway...

Detect phone warming caused by spyware. (for clients only)

Even though I started each conversation telling the FlexiSpy salesperson I was a FORBES reporter, they were happy to offer suggestions about how one could install the app without permission of the target. One said I could "sneak to get her phone" and then install, a process that FlexiSpy would guide me through. He sought to allay any fears about getting caught, noting there was no icon and it would operate silently...

Meanwhile, lawmakers are seeking to expand laws that punish unwarranted, secret surveillance. Last week, Senators Ron Wyden, Jason Chaffetz and John Conyers introduced The Geolocation Privacy and Surveillance (GPS) Act. Specifically, it creates criminal penalties for "surreptitiously using an electronic device to track a person's movements that parallel the penalties that exist for illegal wiretapping." more  other cell phone spy gadgets

Business Espionage: Operation BugDrop - Major Eavesdropping Operation Using PC Microphones to Bug Targets

Researchers have uncovered an advanced malware-based operation that siphoned more than 600 gigabytes from about 70 targets in a broad range of industries, including critical infrastructure, news media, and scientific research.

The operation uses malware to capture audio recordings of conversations, screen shots, documents, and passwords, according to a blog post published last week by security firm CyberX.

Targets are initially infected using malicious Microsoft Word documents sent in phishing e-mails. Once compromised, infected machines upload the pilfered audio and data to Dropbox, where it's retrieved by the attackers. The researchers have dubbed the campaign Operation BugDrop because of its use of PC microphones to bug targets and send the audio and other data to Dropbox.

"Operation BugDrop is a well-organized operation that employs sophisticated malware and appears to be backed by an organization with substantial resources," the CyberX researchers wrote. more (Heads up. This hasn't hit hard in the Western Hemisphere yet, but be prepared.) 

Spybusters Tip #832: First line of defense... Disable macros on your Word software. Don't turn it back on if prompted to do so by something arriving in your email. ~Kevin

Recent Spy Camera News

A radiologist at a private practice has been spared jail after stashing his mobile phone in an air vent to record patients using the unisex toilet. more

An Orleans Parish judge dealt several setbacks late Tuesday to a prominent New Orleans breast reconstruction surgeon who faces rape and video voyeurism charges. Dr. Alireza Sadeghi, 41, is accused of raping and surreptitiously filming his now-estranged wife and of videotaping four nude patients in the operating room without their consent. In at least one instance, prosecutors claim, Sadeghi forwarded the footage to a friend. His trial is scheduled for March 20. more

A Utah man and student at BYU-Idaho has been accused of placing a small camera in the bathroom of a Rexburg apartment where six female students live... Rexburg police say a small camera was found hidden inside a towel hook mounted in the bathroom. more

A handyman who was jailed for 24 weeks after he hid a spy camera in a woman's bathroom after being invited round to fix her banisters is appealing his conviction... The court had heard Burnett, 41, planted the covert device in a vase in the victim's bathroom and could control it using an app on his mobile phone. When the victim went to change the flowers in the bathroom two months later she discovered the device and contacted the police. more

Some Indiana lawmakers suggest drone users with nefarious intentions could be flying under the radar under existing laws. ...the proposal creates a “remote aerial voyeurism” crime and addresses penalties for sex offenders operating drones inappropriately. more

Shaun Turner accessed his victims’ personal webcams but was caught by the Eastern Regional Operations Unit (ERSOU) following a tip-off. Turner, 29, of Race Course View, Cottenham, was used a malware system known as a Remote Access Trojan or ‘RAT’, a court heard. The RATs used by Turner enabled him to download all files held on his victims’ computers – including personal pictures, videos and identity documents. In addition, he deployed software to victims’ computers that streamed live images taken by their webcam to his own computer to view. more

More Bad Security News for Android

A team from CSIRO's Data 61, University of NSW (Australia) and UC Berkley in the US found a whole bunch of Android VPN apps contain viruses, spyware and other adware.

Researchers analyzed the apps available for Android to look for nasties like trojans, spyware and adware — giving each an "anti-virus rank (AV)" based on what they found. The lower the rank, the better.

They found of the 283 apps they analyzed, 38 per cent contained malware or malvertising (malicious advertising containing viruses). more

-----

Check Point’s mobile security researchers have discovered a new ransomware in Google Play, dubbed Charger. 

Charger was found embedded in an app called EnergyRescue. The infected app steals contacts and SMS messages from the user’s device and asks for admin permissions. If granted, the ransomware locks the device and displays a message demanding payment. more

A tip of the hat to our Blue Blaze Irregulars who submitted these news items. ~Kevin

Ex-Boyfried Charged - Common Smartphone Eavesdropping

NY - A Rome man has been charged with felony eavesdropping,

according to the Oneida County Sheriff's Office.

Deputies charged Anthony Swancot, 33, after an investigation revealed he installed an app on his ex-girlfriend's cell phone that tracked her location and forwarded copies to his cell phone of each text message she sent from her phone, authorities said.

The app was allegedly installed on Nov. 3, without the victim's knowledge, officials said. more

Security Director Alert - Russian Cyber Activity, GRIZZLY STEPPE

The Department of Homeland Security (DHS) has released a Joint Analysis Report (JAR) that details Russian malicious cyber activity, designated as GRIZZLY STEPPE. 

This activity by Russian civilian and military intelligence services (RIS) is part of an ongoing campaign of cyber-enabled operations directed at the U.S. Government and private sector entities.

DHS recommends that network administrators review the Security Publication for more information and implement the recommendations provided.

Android Phones (700 Million) Have Spying Firmware Pre-installed

The term “mobile phone security” is something of a joke these days, with the number of exploits, bugs, and breaches that are endlessly assaulting us and putting our personal information at risk. So, when security outfit Kryptowire sounded the alarm on Chinese company Adups for using its pre-installed apps to spy on Android users with Blu smartphones, it wasn’t exactly a shock.

Now, however, the impact of Adups alleged spying is growing in magnitude, and it’s dragging other Android device manufacturers into the quagmire.

Adups is a company that facilitates over-the-air updates for mobile devices, so its firmware is pre-installed on lots of devices. However, the firmware does much more than it claims, and has the ability to snoop in areas that it shouldn’t, and without the user ever knowing. That information can then be collected by Adups for whatever purposes it desires.

Trustlook, another digital security firm, dug deeper on what devices utilize Adups and could be used by the Chinese company to scrape your private information, and the list is absolutely massive. Trustlook says that over 700 million Android smartphones have Adups firmware installed that puts the user at risk of having text messages, call histories, and device information collected without their knowledge or consent. more

Reality Spyware Documentary - Find My Phone

What happens to a smartphone after it's stolen? That was the question that a film student in Amsterdam had in mind when he produced a short documentary about a smartphone thief and their stolen goods. On the surface, it might not sound like the most avant-garde idea out there. But here's what made it interesting: the student procured material for his documentary by spying on the thief using a bugged smartphone.

The student, a certain Anthony van der Meer, intentionally had a phone of his stolen – one that he loaded with software called "Cerberus."

As The Next Web reported, the software gave him access to the device location, its features, and its contents – all of which he could retrieve when he wanted. The software also allowed him to make use of the phone's camera and microphone so he could spy on the thief.


For 2 weeks, that's exactly what der Meer did. He spied on the thief, tracking his moves, which resulted in the documentary posted above called Find My Phone – almost the namesake of the Apple app "Find My iPhone" used to find one's phone or disable it after being stolen. more

Excellent work, Anthony! ~Kevin

Turn Any Computer Into an Eavesdropping Device

Researchers at Israel’s Ben-Gurion University of the Negev have devised a way to turn any computer into an eavesdropping device by surreptitiously getting connected headphones or earphones to function like microphones.

In a paper titled "SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit," the researchers this week described malware they have developed for re-configuring a headphone jack from a line-out configuration to a line-in jack, thereby enabling connected headphones to work as microphones.

The exploit works with most off-the-shelf headphones and even when the computer doesn’t have a connected microphone or has a microphone that has been disabled, according to the researchers. more

 Spoiler Alert: It ain't easy to do, or likely to happen to you. ~Kevin

China Secretly Spying on Android Devices

According to Cybersecurity firm Kryptowire, some Android phones, including those from American phone manufacturer BLU, are being preinstalled with software that monitors where users go, who they call, and what they text. The information is then sent back to Chinese servers.

A software dedicated to spying on users is the trojan horse hidden inside some phones manufactured in China. Kryptowire, a Cybersecurity consulting firm, has released a report stating that such malware is being used to gather sensitive information such as GPS locations, text messages, etc. to send back to Chinese servers every 72 hours.

The piece of code has been lurking inside the Android operative system. As such, the program managed to conceal itself from the user’s perspective.

Tom Karygiannis from Kryptowire revealed that the malicious program was created by the Chinese company Adups, with the sole purpose of spying, stating that it isn’t the result of an error. Karygiannis said that the malware’s goal may be is to perform state espionage or to merely to sell advertising data....

Adups has over 700 million active users, and a market share exceeding 70% across 200+ countries and regions. 

The company’s software is used in phones, cars, and other devices. American phone manufacturer, BLU Products, said that 120,000 of its phones had been affected, promptly stating that it had released an update to remove Adups’ spyware. more

Wiretapping & Electronic Surveillance - The IT Spy Guy v. Estranged Wife

PA - An employee of a midstate county faces charges of spying on his estranged wife.

36-year-old David Randall Maurer - who works for the Dauphin County information technology department - is charged with violating the wiretapping and electronic surveillance act.

State Attorney General Bruce Beemer alleges that Maurer installed spyware monitoring software that captured key strokes, screenshots and websites that his estranged wife visited on her laptop.

He allegedly used the information to log into her private email and Facebook accounts. more

Bugging Devices Found at Iran Nuclear Talks Hotel, Say Swiss Officials

A number of computers at a five-star Geneva hotel that has hosted sensitive talks, including Iranian nuclear negotiations, were found to be infected with malware used for espionage, Swiss prosecutors have revealed...

The long-running nuclear talks were a magnet for the world’s intelligence agencies as they sought to find out more about the Iranian nuclear programme and the negotiating positions of the six nations involved.

When the talks shifted to a luxury hotel in Vienna, the microwave radiation from the surveillance efforts of competing intelligence agencies was so intense that diplomats had to walk some distance from the venue to use their mobile phones.

The US secretary of state, John Kerry, would take walks with his Iranian counterpart, Mohammad Javad Zarif, in what was seen as a publicity stunt, but which was also a practical means of dodging electronic bugs.

When diplomats attending talks in Lausanne wanted to call their capitals, they would stroll around the grounds of the venue, another five-star hotel, rather than call from their rooms. more