10 ms·
How foreign governments spy using PowerPoint and Twitter
- pcr0 10y agoTook a look at DroidJack[0], and it's impressively nefarious. Seems like Android is Windows all over again when it comes to security. I already see people running virus scanners on their phones. [0]: http://www.symantec.com/connect/blogs/droidjack-rat-tale-how-budding-entrepreneurism-can-turn-cybercrime http://www.symantec.com/connect/blogs/droidjack-rat-tale-how...
- tdkl 10y agoOK, it's a RAT, but how do we get from receiving a supposed .ppt on email to having DroidJack .apk installed on the system ? Assuming user isn't tricked into confirming the install (not to mention disabling the manual apk install protection).
- Buge 10y agoI'm not sure if this was how it's done. But if the app is on the Play store, it can be remotely installed on your Android device via the Play website.
- tdkl 10y agoAh, it's all described perfectly here [1] and Android specifically [2]: [1] https://citizenlab.org/2016/08/group5-syria/ https://citizenlab.org/2016/08/group5-syria/ [2] https://citizenlab.org/2016/08/group5-syria/#part4 https://citizenlab.org/2016/08/group5-syria/#part4 Good old fake Flash update. But still relies on user to be installed, so nothing sophisticated or "Android is bad" here. If anything the Powerpoint malware looks interesting. The .ppsx extension kinda gives it away, since it's unusual for casual presentations, but that's hard to spot for Joe User.
- duaneb 10y agoThe fact that installing an app can give people arbitrary access to your phone without understanding WHAT you installed definitely implies Android app installation is broken in some way.
- tdkl 10y agoWell, it's exactly what the warning popup when enabling side-loading states ;] But it's still possible, so that's pretty fine in my book compared to the fruit company.
- duaneb 10y agoIt's a little too easy for non-technical users to accidentally enable it. The moms & pops of the world would probably never need to side-load.
- Nullabillity 10y agoWho is the right person to decide who "needs" to side-load? Besides, there are loads of legitimate reasons to, there's a reason Humble Bundles aren't a thing on iOS.
- duaneb 10y ago> Who is the right person to decide who "needs" to side-load? The person who decides to explicitly opt in to allowing side-loading. Just don't allow apps, web pages, etc etc to opt-in for you to ensure the technically non-adept have a difficult time getting themselves into trouble.
- Nullabillity 10y agoWhich is already the case...?
- mordocai 10y agoI can practically guarantee that iphone, windows phone, blackberry, etc also have similar exploits out there being used by nation state level attackers and the people who sell to them. But yes, android is a bit more "wild west"/less curated so that plus the fragmentation/lack of good update channels leads to lots of attack vectors.
- bitmapbrother 10y agoAnd yet the exploitation of Android phones is extremely low according to Google and their live analytics. Meanwhile, iOS devices not running OS 9.3.3 are susceptible to a TIFF image attack that requires no user interaction whatsoever and allows an attacker to steal all of the passwords on the device.
- gbl08ma 10y ago> I already see people running virus scanners on their phones. From what I've read and seen, those virus scanners are of little help, mainly because they are subject to the same sandbox restrictions as all the other apps (and aren't going to break the sandbox like the viruses). Most of them appear to be as good as those "Android cleanup" apps that do nothing but constantly clear caches (meaning they will be rebuilt unnecessarily) and bother the user with notifications and adverts.
- adrianN 10y agoExporting software to spy on people should be regulated similarly to weapons exports, I feel. I wonder what kind of programmer works for companies that produce this spyware...
- pjc50 10y ago> regulated similarly to weapons exports i.e. only sold to friendly oppressive regimes? :(
- mtgx 10y agoI have a feeling tech companies would oppose that, because there is little difference between "governments spying on people" like this, and companies tracking people everywhere, and building shadow profiles of them (like what Facebook Like and Google Analytics are doing). This is why Schneier is calling it "surveillance as a business model": https://www.schneier.com/blog/archives/2013/11/surveillance_as_1.html https://www.schneier.com/blog/archives/2013/11/surveillance_...
- gbin 10y agoI don't agree, the intent has to be taken into account: hackers working at Vupen for example don't work to make a better Google analytics, they work exclusively to circumvent existing protections to expose private data to random third parties whatever the human consequences are as long as they profit from it.
- posterboy 10y ago> the intent has to be taken into account no offense intended, but ...
- mc32 10y agoWith very few exceptions, even "peace-loving" post colonial soft power countries like France, Sweden, Brazil sell arms to just about anyone. Only top secret weapons are reserved for friends... So basically you're saying it should be an open market with few exceptions.
- Matt3o12_ 10y ago> Among the malware was a malicious spyware, including a remote access tool called “Droidjack,” that allows attackers to silently control a mobile device. When Droidjack is installed, a remote user can turn on the microphone and camera, remove files, read encrypted messages, and send spoofed instant messages and emails. How is this even possible? I have always considered phones to be more secure then PC due to additional security measures (such as sandboxing for every app as well as more fine granted permission systems). I'm aware that malware can be installed on a phone but I always though I was required to explicitly allow that (at least on android) and I thought it was impossible on iOS without jail breaking. Or does this app use some zero days, that have been discovered years ago but have not been patched because of androids broken update policy? More information on how this works would be highly appreciated.
- fhood 10y agoI don't know about droidjack specifically, but your phone is not at all secure, particularly for android. All it takes is a little bit of bad C code to cause an overflow of some sort. Combine that with widely available unencrypted firmware and you have a real vulnerability.
- bitmapbrother 10y agoAre you implying that you could create an Android exploit with "little bit of bad C code"? If so, I'm not sure you understand how exploits work and the work required to get around all of the mitigations in place.
- girvo 10y agoDepends. Once you get root--and as others have noted above, that's far easier than it should be on most handsets--all bets are off really.
- Mahn 10y agoMost likely they are exploiting a security hole to quickly gain root access. Over the years a number of "one-click" root exploits have appeared for Android, so it's not unthinkable that they are rooting on the fly. Besides, most Android phones aren't particularly up-to-date, so in a lot of cases it's not like they would even need an undisclosed zero day exploit.
- grecy 10y agoI like the word "foreign" in the title, which I assume is to imply the US government is not doing this. It's also neat how they point out examples of all the "bad" countries doing this, but of course none of the "good" ones. Given I'm not American, so the US government is "foreign" to me.
- cmdrfred 10y agoIt's been feeling pretty foreign to us Americans lately as well.
- rrggrr 10y agoI'll tell you what the USGOV isn't doing. They're not jailing twitter dissidents. They're not sniping protestors from rooftops. They aren't destroying the credit ratings of political dissenters. They aren't even doing a very good job of using Twitter or other technologies to communicate all the good humanitarian work the USGOV does in the world. There are times I wish the US would disengage from the world so humanity can be reminded of what its like to live without a generally benevolent hegemonic power.
- thansharp 10y agoThey are forcing countries to extradite accused citizens while refusing to do the same. They have gitmo. They're asking companies like MSFT to collect data that even MSFT is not legally allowed to do. So, yeah, they're more 'covert' than others, but not necessarily more benevolent.
- rrggrr 10y agoAs I said, I'd like you to live in a world without US humanitarian and foreign aid for awhile. A world where the USGOV doesn't project its power in all the places that offend you. I give it four to six weeks before the world devolves into a nasty, brutish chaos.
- funkysquid 10y ago
- themodelplumber 10y agoHow do the Twitter attacks work? Just malware links on the Twitter service that are working via the spear phish? The article didn't seem to go into any detail there.
- strictnein 10y agoNot entirely sure how that system worked, but a Russian attack used Twitter as a sort of Command and Control system: https://www.fireeye.com/blog/threat-research/2015/07/hammertoss_stealthy.html https://www.fireeye.com/blog/threat-research/2015/07/hammert... PDF has more details here: https://www2.fireeye.com/APT29-HAMMERTOSS-WEB-2015-RPT.html https://www2.fireeye.com/APT29-HAMMERTOSS-WEB-2015-RPT.html
- walrus01 10y agoFrom an endpoint security perspective, 'activists' really need to be trained not to just click on everything blindly and to open everything suspicious in a sandbox. Yes it's possible to escape from a VM, but it's significantly harder to code executable malware that will escape from, for example, a Windows 10 VM running inside Virtualbox on an XUbuntu/XFCE4 host laptop.
- sandworm101 10y agoPuff piece. Despite "twitter" being in the title, the article doesn't discuss twitter. The title's use of the word "how" also suggested i might read something about the technology involved, something like a backdoor in the twitter api. Nope. No discussion whatsoever about the hows. In short: Governments use spyware. Thank you Washington post for that important public service announcement.
- justinlardinois 10y ago> Despite "twitter" being in the title, the article doesn't discuss twitter. From the article: > In May 2016, we uncovered a Twitter-based digital malware campaign seemingly orchestrated by the United Arab Emirates, which resulted in the arrest and torture of numerous activists and journalists there.
- sandworm101 10y agoYes. One mention. No discussion. No indication as to why Twitter is in the title, as opposed to any other service. This is puff/clickbait.
- codelitt 10y agoI've been volunteering teaching Latin American journalists how to research, communicate, and store data privately to protect themselves and their sources against attackers. The threat against freedom of expression there is just as real as it is with oppressive regimes in other parts of the world although they don't get nearly as much attention as the Middle East. This article doesn't highlight enough the need for volunteers and professionals to lend a hand. Most recently I've been working with journalists in Venezuela. If you know anything about Venezuela you should know that they have an incredibly oppressive government and they also have had massive inflation further eliminating their buying power. Things like a $3 (USD) a month VPN are hard for a middle class citizen to afford. I'm trying to remember where I saw it, but there was a journalist who showed over the past year how much food 1000 bolivars bought. At the beginning of the photo essay, she could have fed a family for a week. By the end, it was barely enough for 1 person for a meal. Anyone can really help out and make a difference too. Not just in LATAM, but around the world. The amount of knowledge about cybersecurity, threat models, and risks associated with electronic communications spans a wide range. Of course you have civil society groups who know how to use PGP, but there are others who still rely on Facebook Messenger to communicate with sources and keep passwords sticky noted to their computer screen. Edit: Also wanted to note that it's pretty great what Citizen Labs is doing. Other great resources for learning/teaching/staying updated ( in both English and Spanish and several others) can be found on the EFF's website - https://ssd.eff.org/en/playlist/journalist-move https://ssd.eff.org/en/playlist/journalist-move
- slr555 10y agoThe malware known as PowerPoint has infected millions of systems worldwide and has cost businesses, NGO’s and governments untold billions in lost productivity. PowerPoint files seem to be self-spawning and capable of infinite replication in the wild. Small variations in the PowerPoint files forces administrators to keep endless permutations of these highly virulent files. PowerPoint is often introduced into an organization by highly sophisticated threat actors using deeply customized versions of the software. McKinsey, BCG, and Bain deploy the PowerPoint malware to a multiplicity of customers whose human capital and infrastructure become mired in endless recursive loops known as PowerPoint cycles. The actual introduction of PowerPoint is typically merely incidental to these threat actors ambitions. Most often they derive substantial portions of their income by reselling organizations intellectual property which they already own. Once the organizations systems become bogged in ever more bloated PowerPoint files productivity plummets. Morale drops among employees and management often re-engages the threat actors to attempt to right the ship. The PowerPoint Malware is seemingly unstoppable at this point. Any computers that contain it should be air gapped and protected by highly restricted physical access.
- dbalan 10y agoThe original report has much detailed explanation with all the facts[1]. I was left wondering how an ppt downloaded an app into an Android phone. [1] https://citizenlab.org/2016/08/group5-syria/ https://citizenlab.org/2016/08/group5-syria/
- walter_bishop 10y agoIt's amusing watching tech reports try and discuss computer hacking without once mentioning Microsoft Windows.