DOCSLIB.ORG

Assessing the State of Mobile App Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Assessing the State of Mobile App Security ● Assessing the State of Mobile App Security Abhinav Kumar Abstract All IT-enabled businesses today are moving toward Artificial Intelligence (AI) driven personalized digital experiences for their customers. This implies a critical need for customers’ trust in the underlying technology. At the same time, it has been observed that cybercrime is growing at an alarming rate and is shaking customers’ trust in enterprise applications. In the BFSI domain, mobile devices have emerged as soft targets. They often carry high value, confidential data of upper-end users, can be connected to the Internet, and have powerful processors to run the apps. Such attributes make mobile phones easy targets for professional hackers. Organizations must have a robust incident monitoring and response plan to minimize damages and recover from cybersecurity incidents. www.coforgetech.com Cybersecurity: Current State b. Application file system and database (SQLite etc.) c. Configuration profiles, digital certificates etc. As per Identity Theft Resource Center’s (ITRC) report, the total number of reported data breaches increased by 40% from 781 incidents in 2015 to 980 incidents in Major Threats 2016. The number of incidents is already at 1022 as There are primarily three attack vectors for mobile of September 21, 2017. The total number of records apps: Network, OS vulnerabilities, and Malware. These compromised in the financial sector during 2017 is are used to launch attacks on larger groups of targets already touching 2,780,837 from mere 71,912 last year. and have far-reaching implications. Today, malware This clearly indicates that the financial sector is now a programs are the most commonly used mode for focused target for cybercriminals. cyberattacks. Mobile: Hackers’ Prime Focus Threats on Android Cybercriminals today are highly skilled and resourceful. is an Android malware that tampers with They primarily target mobile phone users for data, Hiddad legitimate apps published on third-party stores. Attackers identity, and gaining remote access for further attacks. use it to gain access to user data. The goal of a hacker is to identify logical flaws and weakness in technologies for unauthorized access using HummingBad is another Android malware that uses various techniques including: rootkit method to install malicious applications such as keylogger, and can even penetrate enterprises security 1. Binary Code Analysis to access confidential email. a. Reverse engineering to understand the binary b. Embedded identities and key-generation routines Ztorg is a Trojan that uses privilege escalation to install applications without the user’s knowledge. 2. OS Exploits and Vulnerabilities a. Embedding malware b. Mobile botnets Threats on iOS 3. Network Communication AceDeceiver is an iOS malware developed to exploit a. Data being sent or received from a server design flaw in FairPlay (Apple’s DRM system) and 4. Log Files install malicious apps on iOS devices. This “FairPlay a. Crash logs, network, and system error logs Man-In-The-Middle” attack was initially used in 2013 for 5. Data Storage pirated apps, but has now transformed into a channel for a. Key stores used for encryption spreading malware. Pegasus is an iOS malware that scans the target device and installs additional software for listening to calls, capturing camera, recording login keys, and accessing contacts, emails, and messages. It is like a Swiss army knife for hacking. Its capability can be judged by the fact that it can disguise itself and even destroy itself if it finds the target to be uninteresting. Few Noteworthy Cases of Mobile Data Breach Some of the major data breach incidents on mobile are outlined below, providing a glimpse into the extent of compromised security and underlying threats. ● Gooligan is a variant of the “Ghost Push” family of malware that uses Towelroot and VROOT Android OS exploits to inject malicious code into Android system processes in order to gain root access. It is known to affect various versions of Android OS 4 and 5, which made up 74% of the devices in the market during fall of 2016. ● FalseGuide attack started in November 2016 but became evident in April 2017. It was found embedded in guide applications for popular mobile games, including Pokémon Go, and is known to have affected two million users. Over 600,000 users 2 2 were tricked by it into joining Android botnet that sensitizing users on information security is important, could be used to launch DDOS attacks. it is also necessary to implement mobile application ● BankBot is a banking Trojan that targeted customers security in a way that is both strong and easy to use. of over 400 banks including Citibank, ING, ABN, Rabobank, ASN, RegioBank, and BinckBank, Security vs. Usability among others. BankBot was also able to intercept text messages and delete them from the victim’s The bulk of mobile apps these days has a deficient mobile in order to bypass 2FA security implemented approach to addressing information security, because the by banks. It is reported that BankBot’s code was apps offer neither reliable protection nor an aesthetically leaked through an underground forum, and experts pleasing interface. According to Verizon, 63% of the fear a spike in the number of mobile attacks based attacks in 2016 involved compromised passwords. We on enhanced versions of the leaked code. see that, passwords can turn problematic as they can be stolen in scalable attacks. As an alternative, stronger security methods like OTP are safe but inconvenient. Implications of Data Breach The divide between security and UX can be addressed It is hard to put a dollar figure against any data breach by mobile device’s hardware features like fingerprint because the loss is more than monetary. It includes scanner. This implies that users are compelled to trust associated intangible losses such as those of reputation, original equipment manufacturers (OEMs) like Apple brand value, and customer trust. Experts are of the and Google. This may be debatable from a privacy opinion that less-obvious costs like increased insurance perspective because Google gathers a good deal of our premium start showing up a little late. data for monetization, whereas Apple’s business model relies on selling phones rather than data, thus allowing better balance of security in its design. The security Case of Sony Data Breach challenge then moves to taking reliability to the service The Sony data breach included employee login details, provider authentication at the backend. e-mails exchanged between employees that revealed their viewpoint on prominent personalities, information about executive salaries in the company, and critical App Security by Design details on company strategy. Two employees also filed Mobile apps must have security in the design and this a Federal court complaint against Sony Pictures for not must be built earlier in the development cycle, not as an taking enough precautions to keep employee data safe. aftermath of penetration testing result. Mobile developers Analysts at Macquarie Research put the estimated cost should adapt to secure coding practices and leverage of the data breach at USD 83 million, but the loss that the recommended approach to deliver trustworthy apps. went unaccounted was Sony’s strained relations with The goal of mobile app design for the enterprise must people and businesses that it worked with. be focused on mitigating the risk of exposing sensitive data through a compromised mobile app. This can be Case of Yahoo Data Breach achieved by minimizing the amount of data exposed through the functionality delivered to the user. “Secure In the last quarter of 2016, Yahoo reported that over yet easy to use” is a crucial ingredient of great mobile 500 million user accounts were compromised, causing apps. a major embarrassment for the company. Following the breach discloser, Yahoo’s valuation dropped from USD In order to eliminate the risk, designers can always list 4.8 billion to USD 4.48 billion during its sale agreement down the design choices in code—protocols, algorithms, with Verizon. data formats—and prepare a security implementation checklist mapped with identified mobile vulnerabilities. Mobile Security Trends Mobile App Security: Some Best practices According to Gartner, mobile attacks are increasing and the biggest concern is mobile malware, as a majority of Countering cybersecurity threats requires an such attacks is attributed to malicious software. Mobile understanding of vulnerabilities in the current technology users often visit compromised websites and install apps and in the ways in which people use that technology. from sources other than Apple and Google stores. While Listed below are some best practices for building secure 3 mobile apps: ● Minimum Privilege Policy ● Developer Awareness A mobile app must always obtain the minimum Mobile developers must be trained and sensitized privilege level necessary to execute its functions. about implications of an app security breach. They Higher-level privileges must be denounced must remain cognizant of security controls like immediately after the use is over. Cryptography, TLS, and Keychain storage. ● Secure Coding Practices ● Secure Data Storage All application code review processes must include Sensitive data must be identified and not stored a checklist for secure coding practices for Android anywhere unless necessary. If it becomes as well as iOS. necessary to store sensitive information, it must first ● Binary Hardening be encrypted using password-based algorithms, Third-party tools like Arxan—Application Protection and the password should be combined with salt and for Mobile—or IBM Security Trusteer Mobile SDK pepper and kept in a different data store than the must be considered for binary protection. secure information itself. ● Code Obfuscation ● Secure Communication Code obfuscation tools must be used to prevent Any data exchange over the network must be reverse engineering. executed using protocols like TLS 3 or later. When ● Security Audit communication is with a known server, certificate Code auditors must be employed to help identify pinning check must be implemented.
Load more

Recommended publications
  • Submission of the Citizen Lab (Munk School of Global Affairs and Public Policy, University of Toronto) to the United Nations
    Submission of the Citizen Lab (Munk School of Global Affairs and Public Policy, University of Toronto) to the United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression on the surveillance industry and human rights February 15, 2019 For all inquiries related to this ​submission​, please contact: Dr. Ronald J. Deibert Director, the Citizen Lab, Munk School of Global Affairs and Public Policy Professor of Political Science, University of Toronto [email protected] Contributors to this report: Siena Anstis, Senior Legal Advisor, Citizen Lab Dr. Ronald J. Deibert, Professor of Political Science; Director, Citizen Lab Jon Penney, Research Fellow, Citizen Lab; Associate Professor and Director, Law & Technology Institute, Schulich School of Law Acknowledgments: We would also like to thank Miles Kenyon (Communications Specialist, Citizen Lab) and Adam Senft (Operations Manager, Citizen Lab) for their support in reviewing this submission. 1 Table of Contents Executive Summary 3 About the Citizen Lab 5 Citizen Lab Research on the Use of Private Surveillance Technology Against Human Rights Actors 6 1. NSO Group’s Pegasus 6 The case of Ahmed Mansoor in the United Arab Emirates 7 Targeting civil society, journalists, politicians, and others in Mexico 7 Mapping Pegasus infections and the case of Omar Abdulaziz in Canada 8 Additional cases of targeting 8 2. Cyberbit’s PC Surveillance System 9 3. FinFisher and FinSpy 9 4. Hacking Team’s Remote Control System 10 Common Trends among Private Companies in the Surveillance Industry 11 ​ 1. Sales to states with poor human rights records 11 ​ 2.
    [Show full text]
  • DOCUMENT RESUME ED 052 058 SE 012 062 AUTHOR Kohn, Raymond F. Environmental Education, the Last Measure of Man. an Anthology Of
    DOCUMENT RESUME ED 052 058 SE 012 062 AUTHOR Kohn, Raymond F. TITLE Environmental Education, The Last Measure of Man. An Anthology of Papers for the Consideration of the 14th and 15th Conference of the U.S. National Commission for UNESCO. INSTITUTION National Commission for UNESCO (Dept. of State), Washington, D.C. PUB DATE 71 NOTE 199p. EDRS PRICE EDRS Price MF-$0.65 HC-$6.58 DESCRIPTORS Anthologies, *Ecology, *Environment, EnVironmental Education, Environmental Influences, *Essays, *Human Engineering, Interaction, Pollution IDENTIFIERS Unesco ABSTRACT An anthology of papers for consideration by delegates to the 14th and 15th conferences of the United States National Commission for UNESCO are presented in this book. As a wide-ranging collection of ideas, it is intended to serve as background materials for the conference theme - our responsibility for preserving and defending a human environment that permits the full growth of man, physical, cultural, and social. Thirty-four essays are contributed by prominent authors, educators, historians, ecologists, biologists, anthropologists, architects, editors, and others. Subjects deal with the many facets of ecology and the environment; causes, effects, and interactions with man which have led to the crises of today. They look at what is happening to man's "inside environment" in contrast to the physical or outside environment as it pertains to pollution of the air, water, and land. For the common good of preserving the only means for man's survival, the need for world cooperation and understanding is emphatically expressed. (BL) U.S. DEPARTMENT OF HEALTH. EDUCATION & WELFARE OFFICE OF EDUCATION THIS DOCUMENT HAS BEEN REPRO- DUCED EXACTLY AS RECEIVED FROM THE PERSON OR ORGANIZATION ORIG- INATING IT.
    [Show full text]
  • Wannacry Two Years Later: How Did We Get the Data?
    WANNACRY TWO YEARS LATER: HOW DID WE GET THE DATA? WANNACRY TWO YEARS LATER: HOW DID WE GET THE DATA? – © 2019 ARMIS, INC. WANNACRY TWO YEARS LATER: How Did We Get the Data? DNS Cache Probing WannaCry’s Kill Switch Domain The DNS cache probing technique was first introduced in a 2004 paper titled “Snooping the ​ Cache for Fun and Profit." The technique is used to identify domain names in use by users of a ​ specific ISP by identifying poorly configured DNS servers and probing their domain cache. By sending specific queries to these DNS servers, it is possible to ascertain if a specific domain name was previously queried by one (or more) of the ISP’s clients. This results in that domain becoming registered on the DNS server’s domain cache for a limited amount of time, depending on the TTL of the domain. In a recent study, the Citizen Lab group used this technique to identify ISPs in which NSO’s ​ ​ Pegasus spyware was in use. For.our research, we adapted this technique to track ISPs that have WannaCry’s main kill switch domains in their DNS servers’ cache. The technical implementation details of this technique were largely detailed in previous works, but these are the steps we conducted: 1. We set up four servers, in different parts of the world and conducted a full IPv4 scan to create a current database of all the DNS servers worldwide. This resulted in approximately 5 million DNS servers. 2. From this initial list, we needed to identify the servers which supported cache snooping, but in a trustworthy way which would enable us to query their cache for the kill switch domain, and verify whether it is present in the cache.
    [Show full text]
  • October 2011 Vol
    NoSQL GREG BURD Hypervisors and Virtual Machines: Implementation Insights on the x86 Architecture DON REVELLE Conference Reports from the 2011 USENIX Annual Technical Conference, HotPar, and more OCTOBER 2011 VOL. 36, NO. 5 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION THE ADVANCED COMPUTING SYSTEMS ASSOCIATION usenix_login_oct11_covers.indd 1 9.9.11 5:55 PM UPCOMING EVENTS 23rd ACM Symposium on Operating Systems 9th USENIX Symposium on Networked Systems Principles (SOSP 2011) Design and Implementation (NSDI ’12) SPONSORED BY ACM SIGOPS IN COOPERATION WITH USENIX SPONSORED BY USENIX IN COOPERATION WITH ACM SIGCOMM AND ACM SIGOPS October 23–26, 2011, Cascais, Portugal April 25–27, 2012, San Jose, CA http://sosp2011.gsd.inesc-id.pt http://www.usenix.org/nsdi12 ACM Symposium on Computer Human Interac- tion for Management of Information Technology 2012 USENIX Federated Conferences Week (CHIMIT 2011) June 12–15, 2012, Boston, MA, USA http://www.usenix.org/fcw12 SPONSORED BY ACM IN ASSOCIATION WITH USENIX December 4–5, 2011, Boston, MA 2012 USENIX Annual Technical Conference http://chimit.acm.org/ (USENIX ATC ’12) June 13–15, 2012, Boston, MA 25th Large Installation System Administration http://www.usenix.org/atc12 Conference (LISA ’11) Paper titles and abstracts due January 10, 2012 SPONSORED BY USENIX IN COOPERATION WITH LOPSA December 4–9, 2011, Boston, MA 21st USENIX Security Symposium http://www.usenix.org/lisa11 (USENIX Security ’12) August 6–10, 2012, Bellevue, WA ACM/IFIP/USENIX 12th International Middleware Conference (Middleware 2011)
    [Show full text]
  • Lols, Lulz, and ROFL: the Culture, Fun, and Serious Business of Internet Memes
    LOLs, Lulz, and ROFL: The Culture, Fun, and Serious Business of Internet Memes by Noah David Levinson Bachelor of Philosophy, University of Pittsburgh, 2012 Submitted to the Faculty of The University of Pittsburgh Honors College in partial fulfillment of the requirements for the degree of Bachelor of Philosophy University of Pittsburgh 2012 UNIVERSITY OF PITTSBURGH University Honors College This thesis was presented by Noah David Levinson It was defended on July 30, 2012 and approved by Gabriella Coleman, PhD, Department of Art History & Communications, McGill University Dana Och, PhD, Film Studies Program Annette Vee, PhD, English Department Thesis Advisor: Daniel Morgan, PhD, Film Studies Program ii Copyright © by Noah David Levinson 2012 iii LOLs, Lulz, and ROFL: The Culture, Fun, and Serious Business of Internet Memes Noah David Levinson, BPhil University of Pittsburgh, 2012 This thesis takes an analytical look into the workings of Internet Memes and the culture that surrounds and nourishes them. Through a selection of Internet Meme case studies, a list of cultural qualities are compiled and then used to identify the attitudes of Internet Meme Culture. Then by comparing the relationship between Internet Memes and advertising, film, and television, a contrast between Old and New Media is established. Alongside using political Memes to find connections between Internet Memes and general expression and communication, the final hope is to understand Internet Meme Culture and where it might take Mass and Popular Culture as the digital millennial becomes the new digital citizens. iv TABLE OF CONTENTS 1.0 INTRODUCTION: WHY STUDY INTERNET MEMES? ............................................. 1 1.1 WEB 3.33333333… AND BRONIES ......................................................................
    [Show full text]
  • Operating from the Shadows Inside Nso Group’S Corporate Structure
    OPERATING FROM THE SHADOWS INSIDE NSO GROUP’S CORPORATE STRUCTURE A briefing by Amnesty International, Privacy International and The Centre for Research on Multinational Corporations (SOMO) Amnesty International is a movement of 10 million people which mobilizes the humanity in everyone and campaigns for change so we can all enjoy our human rights. Our vision is of a world where those in power keep their promises, respect international law and are held to account. We are independent of any government, political ideology, economic interest or religion and are funded mainly by our membership and individual donations. We believe that acting in solidarity and compassion with people everywhere can change our societies for the better. Privacy International was founded in 1990 and is based in London, UK. It was the first organization to campaign at an international level on privacy issues. It is committed to protecting people’s privacy, dignity and freedoms from abuses by companies and governments. Through research, litigation and advocacy, it works to build a better future where technologies, laws, and policies contain modern safeguards to protect people and their data from exploitation. SOMO investigates multinationals. Independent, factual, critical and with a clear goal: a fair and sustainable world, in which public interests outweigh corporate interests. We conduct action-oriented research to expose the impact and unprecedented power of multinationals. Cooperating with hundreds of organisations around the world, we ensure that our information arrives where it has the most impact: from communities and courtrooms to civil society organisations, media and politicians. © Amnesty International, Privacy International, and The Centre for Research on Multinational Corporations (SOMO) 2021 Except where otherwise noted, content in this document is licensed Cover illustration: © Toscanabanana 2021 under a Creative Commons (attribution, non-commercial, no derivatives, international 4.0) licence.
    [Show full text]
  • How Does the Pegasus Spyware Work, and Is My Phone at Risk
    How does the Pegasus spyware work, and is my phone at risk Paul Haskell-Dowland, Edith Cowan University and Roberto Musotto, Edith Cowan University A major journalistic investigation has found evidence of malicious software being used by governments around the world, including allegations of spying on prominent individuals. From a list of more 50,000 phone numbers, journalists identified more than 1,000 people in 50 countries reportedly under surveillance using the Pegasus spyware. The software was developed by the Israeli company NSO Group and sold to government clients. Among the reported targets of the spyware are journalists, politicians, government officials, chief executives and human rights activists. Reports thus far allude to a surveillance effort reminiscent of an Orwellian nightmare, in which the spyware can capture keystrokes, intercept communications, track the device and use the camera and microphone to spy on the user. How did they do it? The Pegasus spyware can infect the phones of victims through a variety of mechanisms. Some approaches may involve an SMS or iMessage that provides a link to a website. If clicked, this link delivers malicious software that compromises the device. Others use the more concerning “zero-click” attack where vulnerabilities in the iMessage service in iPhones allows for infection by simply receiving a message, and no user interaction is required. The aim is to seize full control of the mobile device’s operating system, either by rooting (on Android devices) or jailbreaking (on Apple iOS devices). Usually, rooting on an Android device is done by the user to install applications and games from non- supported app stores, or re-enable a functionality that was disabled by the manufacturer.
    [Show full text]
  • Unexplored Warfare of 21 Century
    Unexplored Warfare of 21st Century Esha Chadha, Kartik Verma, Monika Arora Abstract: The world has gone through huge technological-advancement in recent years. With the increased usage of technology, there is a rise in cybercrime too. Advanced methods are being used to commit cybercrime in recent times. One of the recent methods being used is malware. Malware, also known as malicious software, is a software that can damage the system it is installed in it. Malware is a software that is used to compromise a computer, steal data and cause harm to a computer. Few types of malware are viruses, worms, ransomware, spyware, adware etc. Another tool that’s been used by black hat hackers is called Spyware. Spyware is a software that infects a device and steals all the personal information available on that device. Spyware, if once installed in a device like mobile phone allows the hacker to completely clone the attacker’s device as spyware then access each and every information that’s stored in the phone. Spyware is also capable of accessing the camera and microphone of the targets phone. One such spyware is Pegasus. Pegasus made by an Israeli group, can hack into any person’s system by just clicking on a link or worse by just receiving a call from a random number. Pegasus can jailbreak into devices and access their messages, camera, microphone, applications and much more. Keywords: Malware, Spyware, Pegasus, Chrysaor. 1. Introduction In the 21st century, it is almost impossible to even imagine life without technology. Everything from mobile phones to cars everything has embedded systems and computers installed in it which allows the devices to function smartly and fast.
    [Show full text]
  • Fighting Targeted Malware in the Mobile
    FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM Megan Ruthven Andrew Blaich 1 Agenda • Introductions • Background on Chrysaor • How it Works • Hunting for Chrysaor • Hunting beyond Chrysaor • Conclusions / Special Thanks • Questions 2 Who are we? Megan Ruthven - Software Engineer on Google's Android Security Team, uses device and application data to combat malware on a global scale. Andrew Blaich, Ph.D. - Security Researcher and Head of Device Intelligence at Lookout specializing in threat hunting and vulnerability research. 3 What is Chrysaor? • Mobile espionage software believed to be created by NSO Group Technologies • Believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout. 4 Background Pegasus for iOS August 2016 Discovery: Citizen Lab & Lookout Exploited: three zero-day vulns 5 How it works if able to Surveillance root Elevated + Privileges Data Exfiltration if not able Framaroot to root exploit Data Exfiltration C2 Server CHRYSAOR EXPLOIT CHAIN SEQUENCE 6 Feature comparison iOS Android Process Hooking Yes Yes SMS Command and Control Yes Yes Zero-Day Exploits Yes No (Not these samples) Audio Surveillance Yes Yes Functionality without device No Yes compromise Standalone App No Yes Suicide Functionality Yes Yes Targets Popular Apps and Yes Yes built-in Device Features Disables System Updates Yes Yes Screenshot Capture No Yes 7 Searching for Chrysaor Where do we start • Did not exist in Google Play or any other Android app store • Did not exist on VirusTotal • Expected
    [Show full text]
  • Kaspersky Lab Threat Predictions for 2018
    Kaspersky Security Bulletin: KASPERSKY LAB THREAT PREDICTIONS FOR 2018 Version 1.1. KASPERSKY SECURITY BULLETIN: THREAT PREDICTIONS FOR 2018 CONTENTS Introduction ..................................................................................................3 Advanced Persistent Threat Predictions by the Global Research and Analysis Team (GReAT) .....................4 Introduction .............................................................................................5 Our record ................................................................................................6 What can we expect in 2018? ...........................................................7 Conclusion .............................................................................................18 Industry and Technology Predictions .............................................19 Introduction ..........................................................................................20 Threat Predictions for Automotive ..........................................21 Threat Predictions for Connected Health ........................... 26 Threat Predictions for Financial Services ............................30 Threat Predictions for Industrial Security ........................... 35 Threat Predictions for Cryptocurrencies ........................... 39 Conclusion ............................................................................................42 This report was updated on December 6, 2017 – with additional content for Threat Predictions for Financial Services
    [Show full text]
  • THE MILLION DOLLAR DISSIDENT NSO Group’S Iphone Zero-Days Used Against a UAE Human Rights Defender
    THE MILLION DOLLAR DISSIDENT NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender By Bill Marczak and John Scott-Railton AUGUST 24, 2016 RESEARCH REPORT #78 Copyright © The Citizen Lab Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike licence). Electronic version first published in 2016 by the Citizen Lab. This work can be accessed through https://citizenlab.ca/2016/08/million- dollar-dissident-iphone-zero-day-nso-group-uae/. Document Version: 1.0 The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix, transform, and build on it, as long as you: • give appropriate credit; • indicate whether you made changes; and • use and link to the same CC BY-SA 4.0 licence. However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and product names and associated logos remain with their respective owners. Uses of these that are protected by copyright or trademark rights require the rightsholder’s prior written agreement. Suggested Citation Bill Marczak and John Scott-Railton. “The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender,” Citizen Lab Research Report No. 78, University of Toronto, August 2016. Acknowledgements Special thanks to the team at Lookout that we collaborated with in our investigation, especially: Max Bazaliy, Andrew Blaich, Kristy Edwards, Michael Flossman, Seth Hardy, and Mike Murray. Very special thanks to our talented Citizen Lab colleagues, especially: Ron Deibert, Sarah McKune, Claudio Guarnieri, Adam Senft, Irene Poetranto, and Masashi Nishihata.
    [Show full text]
  • The Great Ipwn Journalists Hacked with Suspected NSO Group Imessage ‘Zero-Click’ Exploit
    The Great iPwn Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit By Bill Marczak, John Scott-Railton, Noura Al-Jizawi, Siena Anstis, and Ron Deibert DECEMBER 20, 2020 RESEARCH REPORT #135 Copyright © Citizen Lab Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike licence). Electronic version first published in 2020 by the Citizen Lab. This work can be accessed through https://citizenlab.ca/2020/12/the-great-ipwn- journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/. Document Version: 1.0 The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix, transform, and build on it, as long as you: • give appropriate credit; • indicate whether you made changes; and • use and link to the same CC BY-SA 4.0 licence. However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and product names and associ- ated logos remain with their respective owners. Uses of these that are protected by copyright or trademark rights require the rightsholder’s prior written agreement. Suggested Citation Bill Marczak, John Scott-Railton, Noura Al-Jizawi, Siena Anstis, and Ron Deibert. "The Great iPwn: Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit," Citizen Lab Research Report No. 135, University of Toronto, December 2020. ii Acknowledgements Bill Marczak’s work on this report was supported, in part, by the International Computer Science Institute and the Center for Long-Term Cyber Security at the University of California, Berkeley. The authors would like to thank Bahr Abdul Razzak for review and assistance.
    [Show full text]