4 ms·

The title needs to be updated to say “Android”

sizzle 4y ago
There are surreptitious ways to achieving covert monitoring on iOS. To say this applies to Android only is simply untrue. You can do things via MDM on iOS for example and install spyware “monitoring” apps/set OS level permissions that are invisible to non tech saavy users. Also if you have access to the device and the iCloud password/device pin (e.g. abusive partner scenario, etc.) then non tech saavy people don’t stand a chance against being secretly monitored.
- CharlesW 4y ago
  > To say this applies to Android only is simply untrue. To be fair, this particular issue — the creative abuse of Android APIs by "stalkerware" apps — applies to Android only. Also, MDMs on iPhones can't do the kinds of covert monitoring that this paper discusses. They can't access texts, emails, photos or other personal messages or data within apps on a device.
  - paulmd 4y ago
    well, thanks to the EU, it's going to apply to Apple real soon too. This is one of the things app store review and fully enforcable permissioning prevents (prevented). https://9to5mac.com/2022/12/13/apple-alternative-app-stores-iphone/ https://9to5mac.com/2022/12/13/apple-alternative-app-stores-... So much for the "app store is like 1984" marketing spin that Epic put out lol. Now you have the freedom to have spyware installed on your phone... which is what I and many others have been saying all along. Not just abusive spouses but Facebook and others will be all over this. https://www.youtube.com/watch?v=euiSHuaw6Q4 https://www.youtube.com/watch?v=euiSHuaw6Q4 As I said previously... Facebook and others already have this sort of spyware ready to go, because they were already using their developer credentials to get users to sideload it for data mining. Now it won't be optional/"we'll give you a gift card", it'll just be mandatory if you want to use Facebook on a ios device. Sorry this device is not supported via web, please install the native app. https://arstechnica.com/gadgets/2019/01/facebook-and-google-offered-gift-cards-for-root-level-access-to-ios-users-data/ https://arstechnica.com/gadgets/2019/01/facebook-and-google-...
  - sizzle 4y ago
    honestly all they need to monitor people is built into Apple products out of the box. Sync a dummy iCloud enabled AppleID, and clear all the prompts and emails that the device was added to the account. You now have access to everything via iCloud and FindMy app for location tracking. You can even sign into another device and have real-time iMessage and other private data without installing any spyware apps. I will admit this is outside the scope of the paper, but arguably harder to mitigate if you are not ever checking your iCloud settings.
- baxtr 4y ago
  I don’t think it’s black and white. But the two systems are pretty much on opposite end of the spectrum.
- cyberbanjo 4y ago
  TFA: We focus on Android-based spyware because most of the mobile spyware market appears to be focused there. Since curated app stores like Google Play do not permit the sale of such apps, in practice they must be side-loaded off-store, a process that Apple does not support. As a result, consumer mobile spyware only operates on “rooted” iPhones. Rooting an iPhone can be a technically involved operation (one popular guide to jailbreaking the iPhone involves 41 distinct steps [17]) and one that can take significant time to complete — both requirements at odds with the broad, non-technical customer base such apps are marketed to. We also focus on leading spyware apps as they are the apps that more people are exposed to and they are more likely to be innovative (new features could potentially bring them more customers).
  - scarface74 4y ago
    And you think the Google Play Store (or the App Store) for that matter could even know what apps are doing? With iOS, the protection comes from its tighter permissions model and sandboxing
    - kramerger 4y ago
      Are those two really significantly different in sandboxing and permission model? Should also point out that neither app store is perfect and both have let malicious app slip through. Thanks to the Epic lawsuit we also know that they have tried to hide major incidents ( as in 500M installs of potential malware) from consumers.
      - scarface74 4y ago
        Yes, there is no API on iOS that allows most of the things listed in the article that apps can use even it tried to use non documented APIs. > After installation, they covertly record the victim’s device activities — including any text messages, emails, photos, or voice calls — and allow abusers to remotely review this information through a web portal And the “malware” that was installed was because people were using hacked XCode versions that didn’t come from Apple and they still didn’t escape the sandbox.
- scarface74 4y ago
  Even with someone’s iCloud password and physical access to your phone, a normal app can’t access your phone logs, your camera while running in the background, record your screen etc, even with an MDM.
- bartvk 4y ago
  > You can do things via MDM on iOS for example and install spyware “monitoring” apps Can you name one?
  - sizzle 4y ago
    I mentioned a different scenario involving iCloud, please see my comment above.
- randomwebuser 4y ago
  Thank you for saying this. I agree with OP concerning the article. I work in finance and if people knew just how clueless even we are when it comes to devices being compromised they would never use an app or website for banking again. Even if we can tell it wasn’t the account holder it’s extremely hard to do much more than that. No one knows what to tell the poor person either. I take a hit and get in trouble for my hour call giving instructions but rather that than see someone suffer. Also bad for people with stalkers/abusive partners. I don’t know why everyone says it’s so hard to compromise a device/number (either platform) when it’s not. Or maybe I’m just in a position where I see it more often and overall it is hard? My day job minimum of 2 a day, confirmed not counting otherwise. Volunteer work, its not as frequent but also don’t deal with same volume of people. It is creepier though and no one knows what to do. One case working w a big agency as it involves a high dollar amount and is ongoing and THEY can’t seem to give advice that works either. Person at this point went to a flip phone. Reset the phone? Didn’t work. Abandon all accounts, reset phone, cool. Didn’t work. K now all of the above and dump the number, and/or replace entire phone, latter usually works but not always. Sorry this is long here is my point in commenting. I wish someone with knowledge would take the time to do a solid write up for people with zero tech knowledge not just how to protect themselves but how to determine if/how they are compromised, log proof if possible (court etc) get rid of it and move forward safely, or as safe as possible for both android and IOS, a comprehensive write up. They would be a super hero. Literally help countless. It would help people like the 83 y/o grandma who got cleaned out THREE TIMES and cried to me begging for help on how to stop it, the women whose abusive exes show up at shelters because they have accessed sms or location despite the women using precautions given to them as the precautions are not up to date with what’s possible. Forgive me, it gets to me some of the most vulnerable people are dealing with this at an alarming rate and the people they are told to get help from genuinely don’t know what to do, while I know some it’s not enough to truly be of help say if someone has a well versed ex determined to hunt them down. These people could care less about the Gov knowing all, they just want to be safe.
photochemsyn 4y ago
This quote in the article seems overly optimistic: > "While Google does not permit the sale of such apps on its Google Play app store, Android phones commonly allow such invasive apps to be downloaded separately via the Web. The iPhone, in comparison, does not allow such “side loading” and thus consumer spyware apps on this platform tend to be far more limited and less invasive in capabilities." Recommended: https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents... > "After confirming forensic traces of Pegasus on Nour’s iPhone, we identified the presence of additional spyware, which we attribute with high confidence to Cytrox. We further conclude with high confidence that it is unrelated to Pegasus spyware."
- CharlesW 4y ago
  Once an iPhone is jailbroken, yes — anything goes. The paper describes an Android attack that just requires an app install that "[does] not require specialized technical know-how to deploy or operate".
  - paulmd 4y ago
    or more generally when you're going up against nation-state level actors, such as in your link. In that case yeah all bets are off, NSA and Mossad (and places commercializing technology developed for them) are gonna get in your phone if they want to. But this is still qualitatively different from android where the threat model is "connect USB cable and run ADB command", if even that much.
    - hot_gril 4y ago
      At the end of the day, tech-illiterate people are gonna get spyware onto their Android phones much more easily. If a website tells them to download some app directly and ignore any warnings about it being untrusted, they'll do it.

There are surreptitious ways to achieving covert monitoring on iOS. To say this applies to Android only is simply untrue. You can do things via MDM on iOS for example and install spyware “monitoring” apps/set OS level permissions that are invisible to non tech saavy users. Also if you have access to the device and the iCloud password/device pin (e.g. abusive partner scenario, etc.) then non tech saavy people don’t stand a chance against being secretly monitored.

CharlesW 4y ago
> To say this applies to Android only is simply untrue. To be fair, this particular issue — the creative abuse of Android APIs by "stalkerware" apps — applies to Android only. Also, MDMs on iPhones can't do the kinds of covert monitoring that this paper discusses. They can't access texts, emails, photos or other personal messages or data within apps on a device.
- paulmd 4y ago
  well, thanks to the EU, it's going to apply to Apple real soon too. This is one of the things app store review and fully enforcable permissioning prevents (prevented). https://9to5mac.com/2022/12/13/apple-alternative-app-stores-iphone/ https://9to5mac.com/2022/12/13/apple-alternative-app-stores-... So much for the "app store is like 1984" marketing spin that Epic put out lol. Now you have the freedom to have spyware installed on your phone... which is what I and many others have been saying all along. Not just abusive spouses but Facebook and others will be all over this. https://www.youtube.com/watch?v=euiSHuaw6Q4 https://www.youtube.com/watch?v=euiSHuaw6Q4 As I said previously... Facebook and others already have this sort of spyware ready to go, because they were already using their developer credentials to get users to sideload it for data mining. Now it won't be optional/"we'll give you a gift card", it'll just be mandatory if you want to use Facebook on a ios device. Sorry this device is not supported via web, please install the native app. https://arstechnica.com/gadgets/2019/01/facebook-and-google-offered-gift-cards-for-root-level-access-to-ios-users-data/ https://arstechnica.com/gadgets/2019/01/facebook-and-google-...
- sizzle 4y ago
  honestly all they need to monitor people is built into Apple products out of the box. Sync a dummy iCloud enabled AppleID, and clear all the prompts and emails that the device was added to the account. You now have access to everything via iCloud and FindMy app for location tracking. You can even sign into another device and have real-time iMessage and other private data without installing any spyware apps. I will admit this is outside the scope of the paper, but arguably harder to mitigate if you are not ever checking your iCloud settings.
baxtr 4y ago
I don’t think it’s black and white. But the two systems are pretty much on opposite end of the spectrum.
cyberbanjo 4y ago
TFA: We focus on Android-based spyware because most of the mobile spyware market appears to be focused there. Since curated app stores like Google Play do not permit the sale of such apps, in practice they must be side-loaded off-store, a process that Apple does not support. As a result, consumer mobile spyware only operates on “rooted” iPhones. Rooting an iPhone can be a technically involved operation (one popular guide to jailbreaking the iPhone involves 41 distinct steps [17]) and one that can take significant time to complete — both requirements at odds with the broad, non-technical customer base such apps are marketed to. We also focus on leading spyware apps as they are the apps that more people are exposed to and they are more likely to be innovative (new features could potentially bring them more customers).
- scarface74 4y ago
  And you think the Google Play Store (or the App Store) for that matter could even know what apps are doing? With iOS, the protection comes from its tighter permissions model and sandboxing
  - kramerger 4y ago
    Are those two really significantly different in sandboxing and permission model? Should also point out that neither app store is perfect and both have let malicious app slip through. Thanks to the Epic lawsuit we also know that they have tried to hide major incidents ( as in 500M installs of potential malware) from consumers.
    - scarface74 4y ago
      Yes, there is no API on iOS that allows most of the things listed in the article that apps can use even it tried to use non documented APIs. > After installation, they covertly record the victim’s device activities — including any text messages, emails, photos, or voice calls — and allow abusers to remotely review this information through a web portal And the “malware” that was installed was because people were using hacked XCode versions that didn’t come from Apple and they still didn’t escape the sandbox.
scarface74 4y ago
Even with someone’s iCloud password and physical access to your phone, a normal app can’t access your phone logs, your camera while running in the background, record your screen etc, even with an MDM.
bartvk 4y ago
> You can do things via MDM on iOS for example and install spyware “monitoring” apps Can you name one?
- sizzle 4y ago
  I mentioned a different scenario involving iCloud, please see my comment above.
randomwebuser 4y ago
Thank you for saying this. I agree with OP concerning the article. I work in finance and if people knew just how clueless even we are when it comes to devices being compromised they would never use an app or website for banking again. Even if we can tell it wasn’t the account holder it’s extremely hard to do much more than that. No one knows what to tell the poor person either. I take a hit and get in trouble for my hour call giving instructions but rather that than see someone suffer. Also bad for people with stalkers/abusive partners. I don’t know why everyone says it’s so hard to compromise a device/number (either platform) when it’s not. Or maybe I’m just in a position where I see it more often and overall it is hard? My day job minimum of 2 a day, confirmed not counting otherwise. Volunteer work, its not as frequent but also don’t deal with same volume of people. It is creepier though and no one knows what to do. One case working w a big agency as it involves a high dollar amount and is ongoing and THEY can’t seem to give advice that works either. Person at this point went to a flip phone. Reset the phone? Didn’t work. Abandon all accounts, reset phone, cool. Didn’t work. K now all of the above and dump the number, and/or replace entire phone, latter usually works but not always. Sorry this is long here is my point in commenting. I wish someone with knowledge would take the time to do a solid write up for people with zero tech knowledge not just how to protect themselves but how to determine if/how they are compromised, log proof if possible (court etc) get rid of it and move forward safely, or as safe as possible for both android and IOS, a comprehensive write up. They would be a super hero. Literally help countless. It would help people like the 83 y/o grandma who got cleaned out THREE TIMES and cried to me begging for help on how to stop it, the women whose abusive exes show up at shelters because they have accessed sms or location despite the women using precautions given to them as the precautions are not up to date with what’s possible. Forgive me, it gets to me some of the most vulnerable people are dealing with this at an alarming rate and the people they are told to get help from genuinely don’t know what to do, while I know some it’s not enough to truly be of help say if someone has a well versed ex determined to hunt them down. These people could care less about the Gov knowing all, they just want to be safe.

photochemsyn 4y ago

This quote in the article seems overly optimistic: > "While Google does not permit the sale of such apps on its Google Play app store, Android phones commonly allow such invasive apps to be downloaded separately via the Web. The iPhone, in comparison, does not allow such “side loading” and thus consumer spyware apps on this platform tend to be far more limited and less invasive in capabilities." Recommended: https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents... > "After confirming forensic traces of Pegasus on Nour’s iPhone, we identified the presence of additional spyware, which we attribute with high confidence to Cytrox. We further conclude with high confidence that it is unrelated to Pegasus spyware."

CharlesW 4y ago
Once an iPhone is jailbroken, yes — anything goes. The paper describes an Android attack that just requires an app install that "[does] not require specialized technical know-how to deploy or operate".
- paulmd 4y ago
  or more generally when you're going up against nation-state level actors, such as in your link. In that case yeah all bets are off, NSA and Mossad (and places commercializing technology developed for them) are gonna get in your phone if they want to. But this is still qualitatively different from android where the threat model is "connect USB cable and run ADB command", if even that much.
  - hot_gril 4y ago
    At the end of the day, tech-illiterate people are gonna get spyware onto their Android phones much more easily. If a website tells them to download some app directly and ignore any warnings about it being untrusted, they'll do it.