Citizen Lab senior researcher Bill Marczak said that while the organization has achieved some important wins against spyware proliferation, the progress is inevitably hindered by vendors that continually adapt their technologies and practices.
The Citizen Lab at the University of Toronto's Munk School has become one of the foremost authorities on commercial spyware and surveillance technology for mobile devices.
One of the main challenges Citizen Lab faces, he said, is vendors constantly adapting and changing tactics to allow the continuation of spyware use.
NSO Group was one significant spyware player he highlighted, known for developing the Pegasus spyware used against U.K. government officials in 2022.
In 2014, for example, a hacker leaked files allegedly stolen from Gamma Group International, a surveillance software vendor behind the FinFisher spyware product.
The spyware vendors must be on hand to aid customers in their attempts to target specific individuals and bypass security features while remaining undetected.
Although spyware is marketed for use against criminals and terrorists, Marczak said it's often abused for political purposes.
That's where mercenary spyware comes in, Marczak said.
A lawsuit filed by Khashoggi's widow claimed that the Saudi government and NSO Group deployed spyware to intercept her husband's communications.
Citizen Lab investigations often involve tracking NSO spyware through IP address scans and fingerprinting.
Another challenge with spyware vendors is how they assist customers in circumventing precautions that the target is taking on their own or protections that are built into users' devices.
Targets receive SMS messages with links to spyware vendors' infrastructure, which Citizen Lab analyzes.
Marczak emphasized the importance of log analysis in the spyware fight.
Commercial spyware vendors aren't the only companies to change their technology or practices.
Another significant threat to mobile devices is zero-click exploits, which require no user interaction for attackers to deploy spyware.
Pegasus is one example of spyware that uses zero-click exploits for Android or Apple devices.
In the 2021 lawsuit, Apple claimed that the zero-click exploit was used to spread spyware through its servers.
Mobile technology companies have made some progress in curbing the spyware threat.
Though victims can still be targeted, Marczak said it prevents many types of spyware infections.
In response to ForcedEntry in 2021, Apple started sending out notifications to warn users if they were targeted by mercenary spyware and nation-state threats.
This Cyber News was published on www.techtarget.com. Publication date: Tue, 30 Jan 2024 00:43:04 +0000