DOCSLIB.ORG

Pandalabs Annual Report 2018 Panda Security | Pandalabs Annual Report 2018

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Pandalabs Annual Report 2018 Panda Security | Pandalabs Annual Report 2018 December, 2018 PandaLabs Annual Report 2018 Panda Security | PandaLabs Annual Report 2018 1. Introduction 3. Cyber-news 2018 2. PandaLabs: Threat Data in 2018 4. Data breaches - Pre-execution detections 5. Cybersecurity predictions 2019 - Examples of cases investigated by the laboratory - Malware incidents escalated to PandaLabs - The “Threat Mitigation Funnel” Panda Security | PandaLabs Annual Report 2018 Introduction: The State of Cybersecurity Panda Security | PandaLabs Annual Report 2018 4 Introduction: the State of Cybersecurity 2017 was the year when the word ransomware Most successful types of stopped being a term exclusive to cybersecurity attacks against companies experts and IT departments. The enormous media attention that attacks such as WannaCry and in 2018 Petya/GoldenEye received turned this type of threat into one of the key trends for businesses last year. However, as professionals in the sector know, highly publicized events must never serve as a risk indicator, nor influence on any security related decision. In this annual report, we at PandaLabs, Panda Security’s anti-malware laboratory, have reviewed the threat data gathered in the laboratory from our sensor sources. We include here data from endpoint security solutions deployed on our clients’ Prevalence of devices; the trends observed by our analysts whilst malware attacks they were providing file classification and threat hunting services; as well as the most relevant cybersecurity incidents reported around the world The information compiled in 2018 continues to reflect the prevalence of malware attacks, with 9 million malicious URLs and 2.4 million attacks blocked per million endpoints per month. 20.7% of machines studied experienced at least one malware attack during the period analyzed. Attacks utilizing RDP However, despite the continuous avalanche of attacks of this kind, which are, for the most part, opportunistic, PandaLabs can conclude that the eradication of infections due to file-based attacks is almost complete, with only residual levels at present. This is due to the expansion of the model of 100% classification of all executable files on systems, which can block any program that is unknown to Panda Security from running until it B has been classified. In return, cybercriminals are evolving towards more insidious attacks, abusing existing software tools once they manage to make Boom of their way onto the network. This leads us to believe cryptojacking and that this kind of attack will increase in the future. Ransomware as a It has once more been confirmed that signature- Service based security techniques, though cost-effective, are increasingly ineffective against this kind of attack, given the impossibility of covering the wide spectrum that these fileless threats have meant throughout 2018. Panda Security | PandaLabs Annual Report 2018 5 While traditional techniques – phishing, no surprise, therefore, that given this budgetary ransomware, Business Email Compromise – seem to limitation, most corporate endpoints are still be as fruitful as ever, the boom of attacks utilizing protected by “traditional” technologies, which are RDP, combined with other social engineering not suitable for the cybersecurity challenges of techniques, is consolidated as an entry vector today. for attackers. If we add to this the boom of cryptojacking and Ransomware as a Service that Neither is it surprising how successful many we have seen this year, we have the three main attackers are, given that on average it takes them attack types that have successfully undermined much less time to compromise systems than company networks in 2018. it takes for them to be discovered. This lack of balance, along with a chronic lack of professionals The main target for attackers is still the endpoint. in the sector, will, once again, continue to This is where the most sensitive information is represent the main challenges for organizations stored, and where they can abuse credentials that when it comes to cybersecurity. allow them to move about internally from one system to another. However, the security budget for endpoint protection is approximately one third of that provided for network security. It is Google trends: This chart confirms the fact that the GDPR has probably been the topic that has been of most interest in terms of search volume. GDPR Cambridge Analytica Meltdown & Spectre Panda Security | PandaLabs Annual Report 2018 PandaLabs: Threat Data in 2018 Panda Security | PandaLabs Annual Report 2018 7 PandaLabs: Threat Data in 2018 Panda Security’s endpoint solutions integrate In this report, we will present the threat data multiple layers of technologies and services corresponding to the most significant layers of designed to protect against malware of different protection, as reported by our installed base of types (file-based), and also against in-memory endpoint-based corporate products, which are: attacks, through exploits or fileless techniques. signatures (specific and generic), heuristics, Many attacks combine several techniques to behavior/context-based analysis, in-memory anti- maximize the chances of success while at the exploit, and services. These layers of protection same time minimizing costs for the attacker. are delivered locally at the endpoint agent, and from the cloud, as represented in figure 1. ATTACK METHOD STAGE Pre-execution Execution Post-execution Execution Execution Post-execution 100% Attestation Service Threat Hunting & Investigation Service Dynamic Anti-Exploit Threat Hunting & Investigation Service Context & Behavior Analysis Context & Behavior Anlys Context & Behavior Analysis TECHNIQU ES Traditional Detection Figure 1. Protection technologies, attack methods and stages. Pre-execution detections Most malware detected on protected endpoints On average, over 2.4 million malware files were in companies is identified using signatures and detected and over 9 million malware-related URLs heuristics. However, most malware is stopped prior were blocked monthly per million endpoints. Most to running on the endpoint because phishing emails of them were only seen once. and URLs related to malware are blocked. While the total amount of malware files that arrive at Analyzing the malware, the attack vectors and the endpoint is constantly growing (over 60% malicious codes on the rise in 2018, we can see from the start to the end of the period), the risk that the prevalence of the malware categories that file-based threats pose for our clients has detected in this stage hasn’t changed much over reduced dramatically, to marginal levels. This is the last year. Trojans and ransomware represent due to the efficiency of the integrated services, most of these threats. Relative to this, the via products and services, and in particular due blocking of Malware-related URLs (through direct to the “100% attestation” approach that Panda web interactions or through embedded URLs in Security has taken, which, by default, prevents emails) happens at over 3.7 times the rate of the execution of unknown executables until they malware file detections, representing the biggest are classified by PandaLabs. vector of entry for threats to the endpoint, together with brute-force attacks against RDP, an attack vector predicted at the start of the year. Panda Security | PandaLabs Annual Report 2018 8 Malware URLs Malware blocked every 2.4 files month per million 9 MILLION endpoints MILLION We believe Internet-facing RDP connectivity Pre-execution classifications. represents a growing risk today for many organizations, which are unaware of their exposure. Since new types of malware are created and Falling victim to this attack technique means published more quickly than detection capabilities continually being scanned by cybercriminals are added, there is always a detection gap. This in search of easy opportunities to get onto generates inevitable infections of some “patient the company’s networks. The data recorded by zero” users who don’t have a more robust or PandaLabs corroborates the fact that 70% of our complete protection. mid to large clients are subject to this kind of RDP attack every month. In order to close that gap and minimize infection risk for customers, in 2015, Panda Security As for the most common entry vectors and introduced a “100% Attestation Service”, which malicious codes this year, email continues to be ensures that all Portable Executable (PE) files the most popular vector for attack campaigns, trying to execute on the endpoints must be although many of them end up in the spam folder classified as trusted by PandaLabs before being before they get to the endpoint. Users, particularly allowed to run. This security service acts as the when using mobile devices, are more exposed to last line of defense against file-based malware. malicious URLs or infected websites. In the period January-November, a monthly In this regard, websites infected with Coinhive average of approximately 5.8 million different code are becoming a more pervasive threat, as a executable files were observed per million less aggressive form of cryptomining. Coinhive, endpoints. While most of the files are repeated initially designed to allow website owners to earn from month to month, approximately 20% of extra income without running advertisements, them each month were untrusted or unknown. has emerged as a leading threat this year, with Out of those, an average of 1.3% ended up being its code being installed on hacked sites without classified as malware. the knowledge of the
Load more

Recommended publications
  • Submission of the Citizen Lab (Munk School of Global Affairs and Public Policy, University of Toronto) to the United Nations
    Submission of the Citizen Lab (Munk School of Global Affairs and Public Policy, University of Toronto) to the United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression on the surveillance industry and human rights February 15, 2019 For all inquiries related to this ​submission​, please contact: Dr. Ronald J. Deibert Director, the Citizen Lab, Munk School of Global Affairs and Public Policy Professor of Political Science, University of Toronto [email protected] Contributors to this report: Siena Anstis, Senior Legal Advisor, Citizen Lab Dr. Ronald J. Deibert, Professor of Political Science; Director, Citizen Lab Jon Penney, Research Fellow, Citizen Lab; Associate Professor and Director, Law & Technology Institute, Schulich School of Law Acknowledgments: We would also like to thank Miles Kenyon (Communications Specialist, Citizen Lab) and Adam Senft (Operations Manager, Citizen Lab) for their support in reviewing this submission. 1 Table of Contents Executive Summary 3 About the Citizen Lab 5 Citizen Lab Research on the Use of Private Surveillance Technology Against Human Rights Actors 6 1. NSO Group’s Pegasus 6 The case of Ahmed Mansoor in the United Arab Emirates 7 Targeting civil society, journalists, politicians, and others in Mexico 7 Mapping Pegasus infections and the case of Omar Abdulaziz in Canada 8 Additional cases of targeting 8 2. Cyberbit’s PC Surveillance System 9 3. FinFisher and FinSpy 9 4. Hacking Team’s Remote Control System 10 Common Trends among Private Companies in the Surveillance Industry 11 ​ 1. Sales to states with poor human rights records 11 ​ 2.
    [Show full text]
  • DOCUMENT RESUME ED 052 058 SE 012 062 AUTHOR Kohn, Raymond F. Environmental Education, the Last Measure of Man. an Anthology Of
    DOCUMENT RESUME ED 052 058 SE 012 062 AUTHOR Kohn, Raymond F. TITLE Environmental Education, The Last Measure of Man. An Anthology of Papers for the Consideration of the 14th and 15th Conference of the U.S. National Commission for UNESCO. INSTITUTION National Commission for UNESCO (Dept. of State), Washington, D.C. PUB DATE 71 NOTE 199p. EDRS PRICE EDRS Price MF-$0.65 HC-$6.58 DESCRIPTORS Anthologies, *Ecology, *Environment, EnVironmental Education, Environmental Influences, *Essays, *Human Engineering, Interaction, Pollution IDENTIFIERS Unesco ABSTRACT An anthology of papers for consideration by delegates to the 14th and 15th conferences of the United States National Commission for UNESCO are presented in this book. As a wide-ranging collection of ideas, it is intended to serve as background materials for the conference theme - our responsibility for preserving and defending a human environment that permits the full growth of man, physical, cultural, and social. Thirty-four essays are contributed by prominent authors, educators, historians, ecologists, biologists, anthropologists, architects, editors, and others. Subjects deal with the many facets of ecology and the environment; causes, effects, and interactions with man which have led to the crises of today. They look at what is happening to man's "inside environment" in contrast to the physical or outside environment as it pertains to pollution of the air, water, and land. For the common good of preserving the only means for man's survival, the need for world cooperation and understanding is emphatically expressed. (BL) U.S. DEPARTMENT OF HEALTH. EDUCATION & WELFARE OFFICE OF EDUCATION THIS DOCUMENT HAS BEEN REPRO- DUCED EXACTLY AS RECEIVED FROM THE PERSON OR ORGANIZATION ORIG- INATING IT.
    [Show full text]
  • Wannacry Two Years Later: How Did We Get the Data?
    WANNACRY TWO YEARS LATER: HOW DID WE GET THE DATA? WANNACRY TWO YEARS LATER: HOW DID WE GET THE DATA? – © 2019 ARMIS, INC. WANNACRY TWO YEARS LATER: How Did We Get the Data? DNS Cache Probing WannaCry’s Kill Switch Domain The DNS cache probing technique was first introduced in a 2004 paper titled “Snooping the ​ Cache for Fun and Profit." The technique is used to identify domain names in use by users of a ​ specific ISP by identifying poorly configured DNS servers and probing their domain cache. By sending specific queries to these DNS servers, it is possible to ascertain if a specific domain name was previously queried by one (or more) of the ISP’s clients. This results in that domain becoming registered on the DNS server’s domain cache for a limited amount of time, depending on the TTL of the domain. In a recent study, the Citizen Lab group used this technique to identify ISPs in which NSO’s ​ ​ Pegasus spyware was in use. For.our research, we adapted this technique to track ISPs that have WannaCry’s main kill switch domains in their DNS servers’ cache. The technical implementation details of this technique were largely detailed in previous works, but these are the steps we conducted: 1. We set up four servers, in different parts of the world and conducted a full IPv4 scan to create a current database of all the DNS servers worldwide. This resulted in approximately 5 million DNS servers. 2. From this initial list, we needed to identify the servers which supported cache snooping, but in a trustworthy way which would enable us to query their cache for the kill switch domain, and verify whether it is present in the cache.
    [Show full text]
  • October 2011 Vol
    NoSQL GREG BURD Hypervisors and Virtual Machines: Implementation Insights on the x86 Architecture DON REVELLE Conference Reports from the 2011 USENIX Annual Technical Conference, HotPar, and more OCTOBER 2011 VOL. 36, NO. 5 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION THE ADVANCED COMPUTING SYSTEMS ASSOCIATION usenix_login_oct11_covers.indd 1 9.9.11 5:55 PM UPCOMING EVENTS 23rd ACM Symposium on Operating Systems 9th USENIX Symposium on Networked Systems Principles (SOSP 2011) Design and Implementation (NSDI ’12) SPONSORED BY ACM SIGOPS IN COOPERATION WITH USENIX SPONSORED BY USENIX IN COOPERATION WITH ACM SIGCOMM AND ACM SIGOPS October 23–26, 2011, Cascais, Portugal April 25–27, 2012, San Jose, CA http://sosp2011.gsd.inesc-id.pt http://www.usenix.org/nsdi12 ACM Symposium on Computer Human Interac- tion for Management of Information Technology 2012 USENIX Federated Conferences Week (CHIMIT 2011) June 12–15, 2012, Boston, MA, USA http://www.usenix.org/fcw12 SPONSORED BY ACM IN ASSOCIATION WITH USENIX December 4–5, 2011, Boston, MA 2012 USENIX Annual Technical Conference http://chimit.acm.org/ (USENIX ATC ’12) June 13–15, 2012, Boston, MA 25th Large Installation System Administration http://www.usenix.org/atc12 Conference (LISA ’11) Paper titles and abstracts due January 10, 2012 SPONSORED BY USENIX IN COOPERATION WITH LOPSA December 4–9, 2011, Boston, MA 21st USENIX Security Symposium http://www.usenix.org/lisa11 (USENIX Security ’12) August 6–10, 2012, Bellevue, WA ACM/IFIP/USENIX 12th International Middleware Conference (Middleware 2011)
    [Show full text]
  • Lols, Lulz, and ROFL: the Culture, Fun, and Serious Business of Internet Memes
    LOLs, Lulz, and ROFL: The Culture, Fun, and Serious Business of Internet Memes by Noah David Levinson Bachelor of Philosophy, University of Pittsburgh, 2012 Submitted to the Faculty of The University of Pittsburgh Honors College in partial fulfillment of the requirements for the degree of Bachelor of Philosophy University of Pittsburgh 2012 UNIVERSITY OF PITTSBURGH University Honors College This thesis was presented by Noah David Levinson It was defended on July 30, 2012 and approved by Gabriella Coleman, PhD, Department of Art History & Communications, McGill University Dana Och, PhD, Film Studies Program Annette Vee, PhD, English Department Thesis Advisor: Daniel Morgan, PhD, Film Studies Program ii Copyright © by Noah David Levinson 2012 iii LOLs, Lulz, and ROFL: The Culture, Fun, and Serious Business of Internet Memes Noah David Levinson, BPhil University of Pittsburgh, 2012 This thesis takes an analytical look into the workings of Internet Memes and the culture that surrounds and nourishes them. Through a selection of Internet Meme case studies, a list of cultural qualities are compiled and then used to identify the attitudes of Internet Meme Culture. Then by comparing the relationship between Internet Memes and advertising, film, and television, a contrast between Old and New Media is established. Alongside using political Memes to find connections between Internet Memes and general expression and communication, the final hope is to understand Internet Meme Culture and where it might take Mass and Popular Culture as the digital millennial becomes the new digital citizens. iv TABLE OF CONTENTS 1.0 INTRODUCTION: WHY STUDY INTERNET MEMES? ............................................. 1 1.1 WEB 3.33333333… AND BRONIES ......................................................................
    [Show full text]
  • Operating from the Shadows Inside Nso Group’S Corporate Structure
    OPERATING FROM THE SHADOWS INSIDE NSO GROUP’S CORPORATE STRUCTURE A briefing by Amnesty International, Privacy International and The Centre for Research on Multinational Corporations (SOMO) Amnesty International is a movement of 10 million people which mobilizes the humanity in everyone and campaigns for change so we can all enjoy our human rights. Our vision is of a world where those in power keep their promises, respect international law and are held to account. We are independent of any government, political ideology, economic interest or religion and are funded mainly by our membership and individual donations. We believe that acting in solidarity and compassion with people everywhere can change our societies for the better. Privacy International was founded in 1990 and is based in London, UK. It was the first organization to campaign at an international level on privacy issues. It is committed to protecting people’s privacy, dignity and freedoms from abuses by companies and governments. Through research, litigation and advocacy, it works to build a better future where technologies, laws, and policies contain modern safeguards to protect people and their data from exploitation. SOMO investigates multinationals. Independent, factual, critical and with a clear goal: a fair and sustainable world, in which public interests outweigh corporate interests. We conduct action-oriented research to expose the impact and unprecedented power of multinationals. Cooperating with hundreds of organisations around the world, we ensure that our information arrives where it has the most impact: from communities and courtrooms to civil society organisations, media and politicians. © Amnesty International, Privacy International, and The Centre for Research on Multinational Corporations (SOMO) 2021 Except where otherwise noted, content in this document is licensed Cover illustration: © Toscanabanana 2021 under a Creative Commons (attribution, non-commercial, no derivatives, international 4.0) licence.
    [Show full text]
  • How Does the Pegasus Spyware Work, and Is My Phone at Risk
    How does the Pegasus spyware work, and is my phone at risk Paul Haskell-Dowland, Edith Cowan University and Roberto Musotto, Edith Cowan University A major journalistic investigation has found evidence of malicious software being used by governments around the world, including allegations of spying on prominent individuals. From a list of more 50,000 phone numbers, journalists identified more than 1,000 people in 50 countries reportedly under surveillance using the Pegasus spyware. The software was developed by the Israeli company NSO Group and sold to government clients. Among the reported targets of the spyware are journalists, politicians, government officials, chief executives and human rights activists. Reports thus far allude to a surveillance effort reminiscent of an Orwellian nightmare, in which the spyware can capture keystrokes, intercept communications, track the device and use the camera and microphone to spy on the user. How did they do it? The Pegasus spyware can infect the phones of victims through a variety of mechanisms. Some approaches may involve an SMS or iMessage that provides a link to a website. If clicked, this link delivers malicious software that compromises the device. Others use the more concerning “zero-click” attack where vulnerabilities in the iMessage service in iPhones allows for infection by simply receiving a message, and no user interaction is required. The aim is to seize full control of the mobile device’s operating system, either by rooting (on Android devices) or jailbreaking (on Apple iOS devices). Usually, rooting on an Android device is done by the user to install applications and games from non- supported app stores, or re-enable a functionality that was disabled by the manufacturer.
    [Show full text]
  • Assessing the State of Mobile App Security
    ● Assessing the State of Mobile App Security Abhinav Kumar Abstract All IT-enabled businesses today are moving toward Artificial Intelligence (AI) driven personalized digital experiences for their customers. This implies a critical need for customers’ trust in the underlying technology. At the same time, it has been observed that cybercrime is growing at an alarming rate and is shaking customers’ trust in enterprise applications. In the BFSI domain, mobile devices have emerged as soft targets. They often carry high value, confidential data of upper-end users, can be connected to the Internet, and have powerful processors to run the apps. Such attributes make mobile phones easy targets for professional hackers. Organizations must have a robust incident monitoring and response plan to minimize damages and recover from cybersecurity incidents. www.coforgetech.com Cybersecurity: Current State b. Application file system and database (SQLite etc.) c. Configuration profiles, digital certificates etc. As per Identity Theft Resource Center’s (ITRC) report, the total number of reported data breaches increased by 40% from 781 incidents in 2015 to 980 incidents in Major Threats 2016. The number of incidents is already at 1022 as There are primarily three attack vectors for mobile of September 21, 2017. The total number of records apps: Network, OS vulnerabilities, and Malware. These compromised in the financial sector during 2017 is are used to launch attacks on larger groups of targets already touching 2,780,837 from mere 71,912 last year. and have far-reaching implications. Today, malware This clearly indicates that the financial sector is now a programs are the most commonly used mode for focused target for cybercriminals.
    [Show full text]
  • Unexplored Warfare of 21 Century
    Unexplored Warfare of 21st Century Esha Chadha, Kartik Verma, Monika Arora Abstract: The world has gone through huge technological-advancement in recent years. With the increased usage of technology, there is a rise in cybercrime too. Advanced methods are being used to commit cybercrime in recent times. One of the recent methods being used is malware. Malware, also known as malicious software, is a software that can damage the system it is installed in it. Malware is a software that is used to compromise a computer, steal data and cause harm to a computer. Few types of malware are viruses, worms, ransomware, spyware, adware etc. Another tool that’s been used by black hat hackers is called Spyware. Spyware is a software that infects a device and steals all the personal information available on that device. Spyware, if once installed in a device like mobile phone allows the hacker to completely clone the attacker’s device as spyware then access each and every information that’s stored in the phone. Spyware is also capable of accessing the camera and microphone of the targets phone. One such spyware is Pegasus. Pegasus made by an Israeli group, can hack into any person’s system by just clicking on a link or worse by just receiving a call from a random number. Pegasus can jailbreak into devices and access their messages, camera, microphone, applications and much more. Keywords: Malware, Spyware, Pegasus, Chrysaor. 1. Introduction In the 21st century, it is almost impossible to even imagine life without technology. Everything from mobile phones to cars everything has embedded systems and computers installed in it which allows the devices to function smartly and fast.
    [Show full text]
  • Fighting Targeted Malware in the Mobile
    FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM Megan Ruthven Andrew Blaich 1 Agenda • Introductions • Background on Chrysaor • How it Works • Hunting for Chrysaor • Hunting beyond Chrysaor • Conclusions / Special Thanks • Questions 2 Who are we? Megan Ruthven - Software Engineer on Google's Android Security Team, uses device and application data to combat malware on a global scale. Andrew Blaich, Ph.D. - Security Researcher and Head of Device Intelligence at Lookout specializing in threat hunting and vulnerability research. 3 What is Chrysaor? • Mobile espionage software believed to be created by NSO Group Technologies • Believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout. 4 Background Pegasus for iOS August 2016 Discovery: Citizen Lab & Lookout Exploited: three zero-day vulns 5 How it works if able to Surveillance root Elevated + Privileges Data Exfiltration if not able Framaroot to root exploit Data Exfiltration C2 Server CHRYSAOR EXPLOIT CHAIN SEQUENCE 6 Feature comparison iOS Android Process Hooking Yes Yes SMS Command and Control Yes Yes Zero-Day Exploits Yes No (Not these samples) Audio Surveillance Yes Yes Functionality without device No Yes compromise Standalone App No Yes Suicide Functionality Yes Yes Targets Popular Apps and Yes Yes built-in Device Features Disables System Updates Yes Yes Screenshot Capture No Yes 7 Searching for Chrysaor Where do we start • Did not exist in Google Play or any other Android app store • Did not exist on VirusTotal • Expected
    [Show full text]
  • Kaspersky Lab Threat Predictions for 2018
    Kaspersky Security Bulletin: KASPERSKY LAB THREAT PREDICTIONS FOR 2018 Version 1.1. KASPERSKY SECURITY BULLETIN: THREAT PREDICTIONS FOR 2018 CONTENTS Introduction ..................................................................................................3 Advanced Persistent Threat Predictions by the Global Research and Analysis Team (GReAT) .....................4 Introduction .............................................................................................5 Our record ................................................................................................6 What can we expect in 2018? ...........................................................7 Conclusion .............................................................................................18 Industry and Technology Predictions .............................................19 Introduction ..........................................................................................20 Threat Predictions for Automotive ..........................................21 Threat Predictions for Connected Health ........................... 26 Threat Predictions for Financial Services ............................30 Threat Predictions for Industrial Security ........................... 35 Threat Predictions for Cryptocurrencies ........................... 39 Conclusion ............................................................................................42 This report was updated on December 6, 2017 – with additional content for Threat Predictions for Financial Services
    [Show full text]
  • THE MILLION DOLLAR DISSIDENT NSO Group’S Iphone Zero-Days Used Against a UAE Human Rights Defender
    THE MILLION DOLLAR DISSIDENT NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender By Bill Marczak and John Scott-Railton AUGUST 24, 2016 RESEARCH REPORT #78 Copyright © The Citizen Lab Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike licence). Electronic version first published in 2016 by the Citizen Lab. This work can be accessed through https://citizenlab.ca/2016/08/million- dollar-dissident-iphone-zero-day-nso-group-uae/. Document Version: 1.0 The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix, transform, and build on it, as long as you: • give appropriate credit; • indicate whether you made changes; and • use and link to the same CC BY-SA 4.0 licence. However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and product names and associated logos remain with their respective owners. Uses of these that are protected by copyright or trademark rights require the rightsholder’s prior written agreement. Suggested Citation Bill Marczak and John Scott-Railton. “The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender,” Citizen Lab Research Report No. 78, University of Toronto, August 2016. Acknowledgements Special thanks to the team at Lookout that we collaborated with in our investigation, especially: Max Bazaliy, Andrew Blaich, Kristy Edwards, Michael Flossman, Seth Hardy, and Mike Murray. Very special thanks to our talented Citizen Lab colleagues, especially: Ron Deibert, Sarah McKune, Claudio Guarnieri, Adam Senft, Irene Poetranto, and Masashi Nishihata.
    [Show full text]