12 ms·

Spy agencies target mobile phones, app stores to implant spyware

126 points by etimberg 11y ago

EGreg 11y ago
Are journalists dripfeeding us Snowden revelations? Why are these revelations news now, long after the initial disclosure? The same question could apply to any new disclosure.
- forgottenpass 11y ago
  Yes, http://cryptome.org/2013/11/snowden-tally.htm http://cryptome.org/2013/11/snowden-tally.htm Because this leak wasn't a "publish everything at once" leak. Snowden wanted the journalists to decide what to release, and that requires work, which takes time.
  - chroem- 11y ago
    Two entire years, though? It's like they're trying to release them just slowly enough so that public outrage never quite reaches critical mass. They can still trickle all they want, but I would appreciate it if they released these stories a bit more regularly and closer together.
    - spada 11y ago
      or helping ensure that each story gets some play in the media vs. one period of outrage and then back to business as usual.
      - EGreg 11y ago
        Or different journalists looking to make a name for themselves after the other stories died down
        krapp 11y ago
        It's almost as if journalism was a business, and Snowden stories were a valuable commodity.
    - FLUX-YOU 11y ago
      >It's like they're trying to release them just slowly enough so that public outrage never quite reaches critical mass. That's a good way to generate a 'new normal'. I imagine there's pros/cons of that, but one of the biggest is probably not to be forgotten.
    - forgottenpass 11y ago
      You say that like there is a flow rate that would make public outrage reach critical mass. I'll contend that if the initial revelations weren't enough to reach critical mass, no rate will. The collective mass of self-serious commentators and politicians triangulate towards citizen apathy. FFS we now know without a doubt we tortured people and it didn't reach critical mass. What happened? No war crimes trails, just some blowhards on TV defending the practice to this day.
    - beagle3 11y ago
      I suspect it's the other way around - as long as people are not hungry or suffering, critical mass in (most of) the west is impossible; so they drip it slowly to keep it from dying. When Greenwald started publishing, he said something to the effect of "there's enough publishable material here for the next 10 years or so". Still a long way to go, I guess.
cdnsteve 11y ago
"The case raises questions about whether government agencies, even covert ones, should carry some responsibility for informing citizens of weaknesses they've unearthed in devices, operating systems and online infrastructure" It should be legislation that any government agency discovers a security issue that it must be disclosed, promptly to software vendors, then after patched, it must also disclose to the public. Accountability is the keyword here. A major security agency must be accountable to security issues it finds, crazy right? After all, these agencies are suppose to be protecting their own citizens, or one would hope so...
- Zigurd 11y ago
  Duh. They do. Not doing that is the same as not revealing, say, a microbe that would be useful for wiping out some disfavored population, or, worse still, genetically engineering such a microbe. The people who make and sell exploits to governments are no better than freelance biologists weaponizing microbes. It is hypocritical of them to rattle on about "cyber terror" and conduct their own cyber war with the same weapons.
3princip 11y ago
Sometimes I feel we miss the wood for the trees. Spy agencies implant SPYware, not that surprising. Surely the real story, the original Snowden story, was about PRISM the way large corporations do the bidding for spy agencies letting them tap information at the source. This was quickly drowned in a sea of other stories, and is hardly ever mentioned any more.
- jacquesm 11y ago
  The story is that agencies that are tasked with foreign spying are spying dragnet-fashion on their own citizens and citizens of allies.
  - 3princip 11y ago
    I'd say mass-surveillance (dragnet as you say) is always a bad thing, making distinctions based on the location of people isn't much protection since they already have a way around it: we do it to your people, you do it to us and we can "share" intel. My personal take from the whole Snowden saga was the degree of collusion with "do no evil" tech corporations, something which their PR teams have obviously effectively suppressed.
  - eternalban 11y ago
    I beg to differ. The real story here is the naiveté of the people at large.
  - CPLX 11y ago
    Yes this is the real story. We expect our spy agencies to spy on enemies, or violent and malicious individuals or organizations out to do us harm. It turns out they're spying on us. That's a big difference. And it's a problem.
  - tedunangst 11y ago
    ? Quoting the article: > Respecting agreements not to spy on each others' citizens, the spying partners focused their attention on servers in non-Five Eyes countries,
hackuser 11y ago
I'm not sure I know anyone using the UC Browser; are most users in China? According to Wikipedia, it routes all data through a proxy which modifies the data in order to improve performance on mobile platforms (e.g., by using compression). I think that proxy is a much more likely target for attacks than 500 million individual phones.
SeanDav 11y ago
By now, absolutely everyone knows that using a mobile phone is not secure if you really are trying to keep something safe.
CPLX 11y ago
Is anyone else struck by the "banality of evil" aspect to all these internal powerpoint style presentations? These documents are interchangeable with some plumbing and heating supply chain company marketing presentation, except they are spying on the planet.
- HCIdivision17 11y ago
  This sort of thing was lampshaded to hell and back in the Portal games. On the surface it's a hilarious first person shooter with a gun that harmlessly puts holes in things in almost exactly the way normal guns don't. Yet it's actually a place where human life and safety is meaningless, where unconciable acts of terror and horror happen everyday (or at least did). And their PowerPoint slides are just awful. It's clear there's a systemic problem in the facility with sustainable testing. Aperature Science may be the most evil corporation ever, and it ends up being funny simply because they're so incompetently banal about it. It's helpful to remember that giant machines chewing through our world and wreaking havoc on our lives are just side effects of lots of like-minded people working together for a common cause. Teamwork can bring you Star Trek or it can bring you Aperature Science. There's a moral to be had there, but I'll be damned if I know what it is...
  - lepht 11y ago
    For anyone else wondering about the use of "lampshaded", I believe HCIdivision17 is referring to http://tvtropes.org/pmwiki/pmwiki.php/Main/LampshadeHanging http://tvtropes.org/pmwiki/pmwiki.php/Main/LampshadeHanging
    - HCIdivision17 11y ago
      Absolutely. TVTropes has a real danger of adding its crazy vocabulary to your everyday life, especially on things unrelated to entertainment. (See also Idiot Ball, Fridge Logic, and Forensic Phlebotinum, which may be on topic.) Really, someone should write up some of these political stories in terms of TVTropes so I can know how I feel about how the plot's progressing. So far it seems like we're in a poorly written mockumentary.
Canada 11y ago
> it appears they didn't alert the companies or the public to these weaknesses. That potentially put millions of users in danger of their data being accessed by other governments' agencies, hackers or criminals. I don't care if the bug finder is a white hat researcher or a spy working for NSA: It's the writer of the bug who puts the user in danger, not the finder of it.
- shkkmo 11y ago
  It's not an either/or. The behavior of the bug finder directly impacts the amount of danger end users are put in. Selling 0 day exploits also puts the user in more danger. Posting exploits publicly without attempting to notify the maintainer also puts the user in more danger. Keeping exploits secret also puts the user in more danger (though less than selling them).

126 points by etimberg 11y ago

EGreg 11y ago

Are journalists dripfeeding us Snowden revelations? Why are these revelations news now, long after the initial disclosure? The same question could apply to any new disclosure.

forgottenpass 11y ago
Yes, http://cryptome.org/2013/11/snowden-tally.htm http://cryptome.org/2013/11/snowden-tally.htm Because this leak wasn't a "publish everything at once" leak. Snowden wanted the journalists to decide what to release, and that requires work, which takes time.
- chroem- 11y ago
  Two entire years, though? It's like they're trying to release them just slowly enough so that public outrage never quite reaches critical mass. They can still trickle all they want, but I would appreciate it if they released these stories a bit more regularly and closer together.
  - spada 11y ago
    or helping ensure that each story gets some play in the media vs. one period of outrage and then back to business as usual.
    - EGreg 11y ago
      Or different journalists looking to make a name for themselves after the other stories died down
      - krapp 11y ago
        It's almost as if journalism was a business, and Snowden stories were a valuable commodity.
  - FLUX-YOU 11y ago
    >It's like they're trying to release them just slowly enough so that public outrage never quite reaches critical mass. That's a good way to generate a 'new normal'. I imagine there's pros/cons of that, but one of the biggest is probably not to be forgotten.
  - forgottenpass 11y ago
    You say that like there is a flow rate that would make public outrage reach critical mass. I'll contend that if the initial revelations weren't enough to reach critical mass, no rate will. The collective mass of self-serious commentators and politicians triangulate towards citizen apathy. FFS we now know without a doubt we tortured people and it didn't reach critical mass. What happened? No war crimes trails, just some blowhards on TV defending the practice to this day.
  - beagle3 11y ago
    I suspect it's the other way around - as long as people are not hungry or suffering, critical mass in (most of) the west is impossible; so they drip it slowly to keep it from dying. When Greenwald started publishing, he said something to the effect of "there's enough publishable material here for the next 10 years or so". Still a long way to go, I guess.

cdnsteve 11y ago

"The case raises questions about whether government agencies, even covert ones, should carry some responsibility for informing citizens of weaknesses they've unearthed in devices, operating systems and online infrastructure" It should be legislation that any government agency discovers a security issue that it must be disclosed, promptly to software vendors, then after patched, it must also disclose to the public. Accountability is the keyword here. A major security agency must be accountable to security issues it finds, crazy right? After all, these agencies are suppose to be protecting their own citizens, or one would hope so...

Zigurd 11y ago
Duh. They do. Not doing that is the same as not revealing, say, a microbe that would be useful for wiping out some disfavored population, or, worse still, genetically engineering such a microbe. The people who make and sell exploits to governments are no better than freelance biologists weaponizing microbes. It is hypocritical of them to rattle on about "cyber terror" and conduct their own cyber war with the same weapons.

3princip 11y ago

Sometimes I feel we miss the wood for the trees. Spy agencies implant SPYware, not that surprising. Surely the real story, the original Snowden story, was about PRISM the way large corporations do the bidding for spy agencies letting them tap information at the source. This was quickly drowned in a sea of other stories, and is hardly ever mentioned any more.

jacquesm 11y ago
The story is that agencies that are tasked with foreign spying are spying dragnet-fashion on their own citizens and citizens of allies.
- 3princip 11y ago
  I'd say mass-surveillance (dragnet as you say) is always a bad thing, making distinctions based on the location of people isn't much protection since they already have a way around it: we do it to your people, you do it to us and we can "share" intel. My personal take from the whole Snowden saga was the degree of collusion with "do no evil" tech corporations, something which their PR teams have obviously effectively suppressed.
- eternalban 11y ago
  I beg to differ. The real story here is the naiveté of the people at large.
- CPLX 11y ago
  Yes this is the real story. We expect our spy agencies to spy on enemies, or violent and malicious individuals or organizations out to do us harm. It turns out they're spying on us. That's a big difference. And it's a problem.
- tedunangst 11y ago
  ? Quoting the article: > Respecting agreements not to spy on each others' citizens, the spying partners focused their attention on servers in non-Five Eyes countries,

hackuser 11y ago

I'm not sure I know anyone using the UC Browser; are most users in China? According to Wikipedia, it routes all data through a proxy which modifies the data in order to improve performance on mobile platforms (e.g., by using compression). I think that proxy is a much more likely target for attacks than 500 million individual phones.

SeanDav 11y ago

By now, absolutely everyone knows that using a mobile phone is not secure if you really are trying to keep something safe.

CPLX 11y ago

Is anyone else struck by the "banality of evil" aspect to all these internal powerpoint style presentations? These documents are interchangeable with some plumbing and heating supply chain company marketing presentation, except they are spying on the planet.

HCIdivision17 11y ago
This sort of thing was lampshaded to hell and back in the Portal games. On the surface it's a hilarious first person shooter with a gun that harmlessly puts holes in things in almost exactly the way normal guns don't. Yet it's actually a place where human life and safety is meaningless, where unconciable acts of terror and horror happen everyday (or at least did). And their PowerPoint slides are just awful. It's clear there's a systemic problem in the facility with sustainable testing. Aperature Science may be the most evil corporation ever, and it ends up being funny simply because they're so incompetently banal about it. It's helpful to remember that giant machines chewing through our world and wreaking havoc on our lives are just side effects of lots of like-minded people working together for a common cause. Teamwork can bring you Star Trek or it can bring you Aperature Science. There's a moral to be had there, but I'll be damned if I know what it is...
- lepht 11y ago
  For anyone else wondering about the use of "lampshaded", I believe HCIdivision17 is referring to http://tvtropes.org/pmwiki/pmwiki.php/Main/LampshadeHanging http://tvtropes.org/pmwiki/pmwiki.php/Main/LampshadeHanging
  - HCIdivision17 11y ago
    Absolutely. TVTropes has a real danger of adding its crazy vocabulary to your everyday life, especially on things unrelated to entertainment. (See also Idiot Ball, Fridge Logic, and Forensic Phlebotinum, which may be on topic.) Really, someone should write up some of these political stories in terms of TVTropes so I can know how I feel about how the plot's progressing. So far it seems like we're in a poorly written mockumentary.

Canada 11y ago

> it appears they didn't alert the companies or the public to these weaknesses. That potentially put millions of users in danger of their data being accessed by other governments' agencies, hackers or criminals. I don't care if the bug finder is a white hat researcher or a spy working for NSA: It's the writer of the bug who puts the user in danger, not the finder of it.

shkkmo 11y ago
It's not an either/or. The behavior of the bug finder directly impacts the amount of danger end users are put in. Selling 0 day exploits also puts the user in more danger. Posting exploits publicly without attempting to notify the maintainer also puts the user in more danger. Keeping exploits secret also puts the user in more danger (though less than selling them).