Slashdot Mirror
Malware Sold To Governments Helped Them Spy on iPhones (washingtonpost.com)
One of the world's most evasive digital arms dealers is believed to have been taking advantage of three security vulnerabilities in popular Apple products in its efforts to spy on dissidents and journalists, reports The New York Times. (Editor's note: the link could be paywalled, here's an alternate source). From the report: Investigators discovered that a company called the NSO Group, an Israeli outfit that sells software that invisibly tracks a target's mobile phone, was responsible for the intrusions. The NSO Group's software can read text messages and emails and track calls and contacts. It can even record sounds, collect passwords and trace the whereabouts of the phone user. In response, Apple on Thursday released a patched version of its mobile software, iOS 9.3.5. Users can get the patch through a normal software update.The Washington Post reports that these "zero-day" flaws were previously used by the governments to take over victims' phones by tricking them into clicking on a link to a text message. Motherboard says that this is the first time anyone has uncovered such an attack in the wild. "Until this month, no one had seen an attempted spyware infection leveraging three unknown bugs, or zero-days, in the iPhone. The tools and technology needed for such an attack, which is essentially a remote jailbreak of the iPhone, can be worth as much as one million dollars."
Every time Richard talks about closed-source phones being used to surreptitiously track users' movements, take photos, and listen in on their conversations he sounds like a madman. But he's right.
The more we depend on technology, the more vulnerable we become to those that use it to erode our freedoms and privacy. I enjoy the benefits of using technology, it has made many things more convenient, and has also stolen more of my time than I care to admit...
It seems though, that now, no matter where you are, and who you are, the leash attached to our connected technology is tied to an increasingly meaner and nastier junk yard dog that is very hungry.
waiter waiter, theres a jew in my freedoms!!!
Are you trying to say, governments haven't spied on and persecuted opponents before these modern-day conveniences appeared?
We can live without them, but the life will be, wait for it, less convenient.
They make living more comfortable. For everyone — including the spies.
In Soviet Washington the swamp drains you.
http://arstechnica.com/apple/2...
"[...] tricking user to click link in SMS" In other words, PEBKAC.
Maybe it's time to pass a new Constitutional Amendment:
1. Requires all government agencies (public or secret) to disclose all vulnerabilities known or discovered; immediately to the vendor of the product, and after 30 days to the public at large.
2. Requires the government to immediately break all treaties with countries whose government policy AND practice does not include #1.
Remember back in the day when law enforcement abided by laws and followed evidence using people called "detectives" to prevent or solve crimes. No wonder reruns of The Shield, Law and order and all those CSI shows don't make sense to my kids.
... Pedantic, but it effects the readability and meaning (mistake in summary not article).
Some us gov agencies heaved crackberries for iphones so someone is casting a wide net perhaps
Replicant
Android. Fork of Cyannogen Mod that is fully Open source. Even the drivers and firmware. Latest phone supported is the international version of the Galaxy S III (I9300) (2G and 3G but no 4G LTE). (Note: The U.S. version of Galaxy S III is a different motherboard and chip - the same model number on a different device.)
Stable release is a couple years old (4.2) due to thinning of the development crew. But the project got new blood (post-Snowden) and a 6.0 port (for the 19300 so far) is in alpha.
Some devices (WiFI, Bluetooth, user-facing camera) require closed firmware, which you can load separately. (It's supported but not distributed with the base distribution.
Some (3-D graphics acceleration, GPS) are just not supported. (Use 2-D graphics and, if you really want your phone to know where you are, a plugin GPS device based on a different chip.) GPS is not supported because the phone's GPS chip also requires a proprietary CPU-land driver, which is an open-source no-no.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Latest phone supported is the international version of the Galaxy S III (I9300) ... Note: The U.S. version of Galaxy S III is a different motherboard and chip - the same model number on a different device.
The same model NAME on a different device. Model number is different, which is how you tell for sure you got the right one.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
"Replicant is a fully free Android distribution running on several devices ...
Several? Wow.
Curious though how you think the fact that it's OSS means it won't have any zero day flaws. Because, the OSS community is spending it's nights and weekends statically analyzing this particular OSS project?
Some (3-D graphics acceleration, GPS) are just not supported. (Use 2-D graphics and, if you really want your phone to know where you are, a plugin GPS device based on a different chip.) GPS is not supported because the phone's GPS chip also requires a proprietary CPU-land driver, which is an open-source no-no.
No 3-d graphics? No GPS? Plugin a GPS dongle? The awesomeness continues.
What are you still doing using an Apple product years after PRISM?
The cost of collect it all access is down from NSA, GCHQ budgets to been per case cheap for a city, state or local gov task forces.
If you have to have a new cell phone to be part all local culture, be seen with it as a no battery fashion accessory.
A never powered decoy phone seen in surveillance images could induce a sneak and peak investigation uncovering gov interest that the phone.
Tracking a networked phone is easy nationally, having a van or car drive up and team enter a home to find a mystery phone is more difficult to hide in very closed communities. A few strangers that don't fit the area at the front door with "keys", down the side of a home or in the back yard will often not go unnoticed by the local community.
Too many contractors, ex mil, ex gov staff have the keys to phone networks and consumer grade telco ready OS's.
The ability to push malware, track from servers is a great service to rent per investigation to any level of city, state, federal government.
Domestic spying is now "Benign Information Gathering"