Stalkerware, The Master Key Into All Corporate Databases
When you compromise the security of connected computer equipment and mobile devices for any purpose, you are providing anybody with malicious intent(bad actor), easy access to virtually any company or government database on the planet. This article will show how this is a major problem that won’t go away.
Spying/Stalkerware Software Readily Available
When I was researching the methods by which cybercriminals get access to devices such as smartphones, I was surprised to find that it is surprisingly easy. All the bad actors have to is to subscribe to, or otherwise obtain, the technologies that are openly marketed as “aids to help parenting”, or as “services to help tracking and apprehension of criminals and terrorists”.
We already know that tracking and profiling is used prolifically by Google, Apple, Microsoft, Facebook, etc.
Spyware and stalkerware is the next level of tracking, where a bad actor is able monitor your keystrokes, camera, network activity, security settings, passwords, addressbook, etc. in real-time.
Back Door Access – Bypasses All Security
The services/tools provided by these companies, deliberately bypass the security on devices such as smartphones in such a way that the bad actor using the service has unrestricted access to keyboard, camera and private data such as passwords. Furthermore, once compromised, the bad actor is able to pretend, without detection, that they are actually the person who owns the device. Once this is possible, then it would be very easy to provide the correct user authentication when access is attempted to systems for which the user is responsible for, at work, even if two factor authentication is required!
The Market For Spyware Flourishing
While some attempts have been by some governments to prohibit the sale of these commercial apps or services, they still exist today and don’t look like ever going away. This is especially true for the larger companies such the NSO Group who charge massive amounts for their licences.
The table below gives some of the most prolific applications marketed in this way.
Commercial Services Still Available
| Company | Product/Service | Target Market | Reported Victims |
|---|---|---|---|
| mSpy | mSpy | Parents | stalking, domestic violence |
| Bark | Bark | Parents | stalking, domestic violence |
| ClevGuard | ClevGuard | Parents | stalking, domestic violence |
| Qoria | Qustodio | Parents | stalking, domestic violence |
| NSO Group | Pegasus | Government | journalists, activists, political leaders |
| Intellexa Group(Cytrox) | Predator | Government | journalists, activists, political leaders |
This table only shows the more commonly available services/apps. There are others available on the black market and listed on various security sites.
This article is not intended to debate the ethics of spying, rather to emphasise that there a many companies that exist solely to find a way to “hack” into a smartphone and install applications which allow remote access to critical items such as keyboard, camera, location services, address book, passwords, etc., WITHOUT the consent of the owner of the device and furthermore, to HIDE the presence of the modified, or new software.
The Smartphone Companies Losing The Race
Both smartphone giants, Apple (iOS) and Google (Android), have attempted to stop these companies from performing their functions, however, given the amount of money to be gained by providing these spying services, especially with products such as Pegasus and Predator, this is unlikely to ever stop. The complexity of the software and network infrastructure is simply too complicated to guarantee that it can be made bug free, secure or unhackable. They will always being playing “catch-up” to these companies.
Even if all governments on the planet were to ban commercial sales of any of this software, it would simply be made available, for a price, on the black market.
No Shortage Of Victims
As you can see from the table above, these services/apps already have countless victims. “Victims” in this context, are the people who are picked by the bad actors for reasons that fulfil a different need, other than what the service is marketed as.
The yearly increase in data breaches in very large corporations and government, shows us that the weakest link to security is the employees working for them. Now imagine if the choice of target for this spyware is one or more of these key employees working within these corporations. If a cybercriminal is able to monitor and control the employee’s smartphone, then they have real-time access to any security protocols that the employee has with their corporation.
Massive Return On Investment For Criminals
Cybercriminal organisations are not short of resources, including money, in order to utilise these stakerware and spyware facilities. If the target data is lucrative enough (eg databases of confidential financial information), then the reward will far exceed any outlay. Picking their victims and initiating the crime is only a matter of when, not if.
Potential Victims – Should Protect Themselves Now – Here’s How
The first thing to note in self-protection is to understand that it is unlikely that you will be aware that you are the target of a spying or stalking attempt. There are guides available on the Internet which give you steps to check to see if your smartphone is compromised, however, I would guess that by the time you look at the instructions, that the criminals and companies making this software have seen the videos as well and have long since worked out ways to make the preventative steps shown, obsolete.
So here is the current best practice for keeping your smartphone safe from the bad actors described in this article.
- Do a factory reset of your mobile device
- Apply all manufacturer’s updates, before you do anything else
- Restore your address book from backup
- Do not install Facebook, Messenger or other social media apps (they are constantly the target of software vulnerability attacks)
- Install a third-party privacy browser from the official apps store
- Access your social media accounts via browser such as Brave or DuckDuckGo
- Update your device with manufacturers at least once a week
- If you suspect that you are being spied on, then repeat the steps above. Remember that the bad actors and the companies making this software are always one step ahead of the phone manufacturers.
Staying Vigilant
The crimes described above are devastating, whether you are just being stalked, or if you end up becoming the key to corporate theft. Using a smartphone today for tasks other than making phone calls, has risks. Every app you download increases that risk. The distinction between tracking and spying gets smaller and smaller, as more companies are collecting more data about you, as you go about your day-to-day activities on your phone.
Amnesty International have worked diligently in helping to uncover some of the biggest stalking/spying instances and they have provided good references to methods used to help diagnose a compromised smartphone. I have used the tools on my own phone and they are very good, however, it does require some technology understanding to do this. I would therefore recommend shying away from attempting to follow their forensic analysis and to simply overwrite the compromised software system on your smartphone, as described in my instructions above.
I have another article which discusses tracking on your phone, which you should read as this too, is becoming big business with your data being used as the highly sought after commodity.