Slashdot Mirror
UAE Used Cyber Super-Weapon To Spy on iPhones of Foes (reuters.com)
Reuters reports: A team of former U.S. government intelligence operatives working for the United Arab Emirates hacked into the iPhones of activists, diplomats and rival foreign leaders with the help of a sophisticated spying tool called Karma, in a campaign that shows how potent cyber-weapons are proliferating beyond the world's superpowers and into the hands of smaller nations. The cyber tool allowed the small Gulf country to monitor hundreds of targets beginning in 2016, from the Emir of Qatar and a senior Turkish official to a Nobel Peace laureate human-rights activist in Yemen, according to five former operatives and program documents reviewed by Reuters. The sources interviewed by Reuters were not Emirati citizens.
Karma was used by an offensive cyber operations unit in Abu Dhabi comprised of Emirati security officials and former American intelligence operatives working as contractors for the UAE's intelligence services. The existence of Karma and of the hacking unit, code named Project Raven, haven't been previously reported. Raven's activities are detailed in a separate story published by Reuters today. The ex-Raven operatives described Karma as a tool that could remotely grant access to iPhones simply by uploading phone numbers or email accounts into an automated targeting system. The tool has limits -- it doesn't work on Android devices and doesn't intercept phone calls. But it was unusually potent because, unlike many exploits, Karma did not require a target to click on a link sent to an iPhone, they said.
Karma was used by an offensive cyber operations unit in Abu Dhabi comprised of Emirati security officials and former American intelligence operatives working as contractors for the UAE's intelligence services. The existence of Karma and of the hacking unit, code named Project Raven, haven't been previously reported. Raven's activities are detailed in a separate story published by Reuters today. The ex-Raven operatives described Karma as a tool that could remotely grant access to iPhones simply by uploading phone numbers or email accounts into an automated targeting system. The tool has limits -- it doesn't work on Android devices and doesn't intercept phone calls. But it was unusually potent because, unlike many exploits, Karma did not require a target to click on a link sent to an iPhone, they said.
... now considered to be a Cyber Super-weapon?
Check your premises.
Anyone have an idea what specific iMessage bug allowed malware to run on the device? Because that sounds like an absolute doozy of a hole.
Karma is a bitch.
Irony: Agile development has too much intertia to be abandoned now.
Don't use an off the shelf smart phone. People are concerned about this stuff, but the root cause is them putting too much trust in the device and therefore the people behind it. I really don't know what the UAE internal laws say about this sort of thing, and if it is illegal, of course they should stop it, but would you really trust them to do so, even if directed by a judge? If you are the kind of person the government is going to be interested in, you really need to take care with your communications.
Else one could think this might be illegal.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No, they send the email or phone number of the targeted phone to a 'targeting system'. That system then performs the exploit that grants access.