The National Counterintelligence and Security Center (NCSC) has warned of the risks of smartphones and other devices being compromised by surveillance tools, and tweeted a link to NCSC tips on how to protect yourself from cyber attacks …
The tweet pointed to a joint NCSC and State Department security bulletin.
Commercial surveillance tools are also being used in ways that pose a serious counterintelligence and security risk to U.S. personnel and systems. Today’s @NCSCgov and @StateDept bulletin offers cybersecurity practices that may mitigate risks.
The brief bulletin comprises a warning about the existence of tools like NSO’s Pegasus spyware, though the company is not named.
Companies and individuals have been selling commercial surveillance tools to governments and other entities that have used them for malicious purposes. Journalists, dissidents, and other persons around the world have been targeted and tracked using these tools, which allow malign actors to infect mobile and internet-connected devices with malware over both WiFi and cellular data connections. In some cases, malign actors can infect a targeted device with no action from the device owner. In others, they can use an infected link to gain access to a device.
These surveillance tools can record audio, including phone calls; track phone’s location; access and retrieve virtually all content on a phone, including text messages, files, chats, commercial messaging app content, contacts, and browsing history.
It goes on to provide some very basic advice on minimizing the risk of falling victim to such attacks.
- Regularly update device operating systems and mobile applications.
- Be suspicious of content from unfamiliar senders, especially those which contain links or attachments.
- Don’t click on suspicious links or suspicious emails and attachments.
- Check URLs before clicking links, or go to websites directly.
- Regularly restart mobile devices, which may help damage or remove malware implants.
- Encrypt and password protect your device.
- Maintain physical control of your device when possible.
- Use trusted Virtual Private Networks.
- Disable geo-location options and cover camera on devices.
- While these steps mitigate risks, they don’t eliminate them. It’s always safest to behave as if the device is compromised, so be mindful of sensitive content.
Pegasus is especially dangerous as it employs so-called zero-click attacks, in which simply sending a carefully crafted text can compromise an iPhone or Android smartphone without any user interaction. This led the US government to declare the company a national security risk, and to ban the import and sale of its spyware.
Apple also sued the company, and began checking iPhones for signs of Pegasus attacks, notifying users whose devices appeared to have been compromised.
The good news is that NSO appears to be going out of business following the US ban and Apple notifications. There are, however, states attempting similar attacks using their own resources.
FTC: We use income earning auto affiliate links. More.
