Why Apple sends spyware victims to this nonprofit security lab


Before the elections, the cybersecurity team of U.S. vice president and then-presidential candidate Kamala Harris reached out to Apple asking for help, according to Forbes, after a tool that’s designed to detect spyware on iPhones flagged anomalies on two devices belonging to campaign staffers. Apple declined to forensically analyze the phones, per Forbes. 

The company’s response is no surprise to the digital defenders working with at-risk populations often targeted by spyware. 

In the last few years, Apple has been sending notifications to targets and victims of government spyware, alerting them that they may have been hacked, and directing them to get help. Crucially, Apple doesn’t tell the targets to get in touch with its own security engineers, but with the nonprofit Access Now, which runs a digital helpline for people in civil society who suspect they have been targets of government spyware. 

“Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple Account,” reads a recent alert, which Access Now shared with TechCrunch. “This attack is likely targeting you specifically because of who you are or what you do. Although it’s never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously.”

While it may look like Apple is abdicating its responsibility to protect its users, cybersecurity experts who work with human rights defenders, journalists, and dissidents generally agree that Apple’s approach in alerting victims to spyware attacks is the right one. 

Contact Us

Do you have more information about government spyware and its makers? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

“These notifications have been a game changer for spyware accountability research,” said John Scott-Railton, a senior researcher at the Citizen Lab, a nonprofit that investigates spyware and is housed at the University of Toronto Munk School of Global Affairs & Public Policy. 

“When I look back over the past few years, I see so many of the most important cases that we know about — Poland, Thailand, so many others — began with an Apple notification,” said Scott-Railton.

For people who investigate spyware, Apple sharing spyware notifications with victims represented a turning point. Before the notifications, “We were just like in the dark, not knowing who to check,” according to Access Now’s legal counsel Natalia Krapiva.

“I think it’s one of the greatest things that’s happened in the sphere of this kind of forensic investigations and hunting of sophisticated spyware,” Krapiva told TechCrunch. 

Now, when someone or a group of people get a notification from Apple, they are warned that something potentially anomalous is happening with their device, that someone is targeting them, and that they need to get help. And Apple tells them exactly where to get it, according to Scott-Railton, who said Access Now’s helpline is the right place to go because “the helpline is able to do good, systematic triage work and support.”

Krapiva said that the helpline is staffed by more than 30 people, supported by others who work in other departments of the nonprofit. So far in 2024, Krapiva said Access Now received 4,337 tickets through the helpline.

Scott-Railton, Krapiva, and security expert Runa Sandvik, who runs her own digital security consultancy Granitt for at-risk people and has been protecting journalists for a decade, all agree Apple should stop short of investigating individual attacks after notifying the victims. 

“Big tech companies don’t want to get into the business of doing forensics on people’s devices or accounts,” Sandvik told TechCrunch. “I think that should remain separate.”

Eva Galperin, the director of cybersecurity at the nonprofit Electronic Frontier Foundation, who has been investigating surveillance on the internet for more than a decade, said that Apple could still do more to combat spyware.

“[Apple] could write more detailed reports and file more lawsuits. These are the things that take massive amounts of money NGOs don’t have and telemetry NGOs don’t have,” Galperin told TechCrunch.

In its official page about mercenary spyware, last updated in October, Apple says that since 2012 it has sent notifications to users in more than 150 countries. 

Apple spokesperson Nadine Haija told TechCrunch that the “vast majority of users will never be the victims of such attacks, we sympathize deeply with the small number of users who are, and we continue to work tirelessly to protect them,” and reiterated that there are no known cases of mercenary spyware on Apple devices with Lockdown Mode. “Our security teams are constantly working to track mercenary spyware attackers, and we send threat notifications to inform and assist users who we believe were individually targeted.”

For anyone alerted by a notification, Apple tells those targets and victims of spyware to update their iOS software and all their apps. Apple also suggests the user switches on Lockdown Mode, an opt-in iOS security feature that has stopped spyware attacks in the past by limiting device features that are often exploited to plant spyware. Apple said last year that it is not aware of any successful spyware infection against someone who used Lockdown Mode. 

Scott-Railton called Lockdown Mode “a game changer in increasing the security of people’s devices, especially people who are at risk.” 

All the experts TechCrunch spoke with strongly recommend turning on Lockdown Mode if you think you may be a target, especially if you are a journalist, human rights defender, or dissident. 

And if you get a notification from Apple, take it very seriously.



Source link

Related Posts

222 thoughts on “Why Apple sends spyware victims to this nonprofit security lab”

  1. Howdy! I realize this is somewhat off-topic but I had to ask.
    Does building a well-established blog such as yours take a massive amount work?
    I’m completely new to writing a blog but I do write in my journal
    on a daily basis. I’d like to start a blog so I can easily share my own experience and thoughts online.
    Please let me know if you have any kind of suggestions or
    tips for brand new aspiring blog owners. Thankyou!

    Reply

  3. May I simply say what a comfort to find somebody that actually understands what they are talking about on the net.
    You definitely realize how to bring an issue to light and make it important.

    More and more people should read this and understand this side
    of the story. It’s surprising you are not more popular since you most certainly have the gift.

    Reply

  5. حذف پزشکی، به معنای کنار گذاشتن یا حذف یک فرد از فعالیت‌ها، مسئولیت‌ها یا وظایف خاص به دلیل مشکلات جسمی یا روانی است که مانع از انجام صحیح وظایف محوله می‌شود.

    Reply

  10. دانا مدیو، وزارت آموزش و پرورش به منظور تسهیل دسترسی دانش‌آموزان به خدمات مختلف، سامانه‌های آنلاین متعددی از جمله سامانه دانا کارنامه امتحانات نهایی dana.medu.ir راه‌اندازی کرده است.

    Reply

  11. dana medu، وزارت آموزش و پرورش به منظور تسهیل دسترسی دانش‌آموزان به خدمات مختلف، سامانه‌های آنلاین متعددی از جمله سامانه دانا کارنامه امتحانات نهایی dana.medu.ir راه‌اندازی کرده است.

    Reply

  17. پزشکی تعهدی، در حال حاضر به عنوان یکی از پرطرفدارترین رشته‌ها در میان اقشار مختلف جامعه، توجه بسیاری از دانش‌آموزان و حتی افراد با سنین بالاتر که از رشته‌های متفاوت تحصیلی به دنبال ادامه تحصیل در این رشته هستند، جلب کرده است.

    Reply

  23. اردوی نوروزی کنکور غرب تهران، به عنوان یک فرصت طلایی برای داوطلبان کنکور سراسری، اهمیت ویژه‌ای دارند. این اردوها با ارائه برنامه‌های آموزشی فشرده و منظم، به داوطلبان کمک می‌کنند تا از تعطیلات نوروز به بهترین شکل ممکن استفاده کرده و آمادگی خود را برای کنکور افزایش دهند.

    Reply

  33. وب شاد، سامانه شاد به عنوان یک پلتفرم آموزش مجازی، با هدف ایجاد ارتباط بین دانش‌آموزان و معلمان و ارائه محتوای آموزشی در شرایطی که امکان حضور فیزیکی در مدارس وجود ندارد، راه‌اندازی شده است.

    Reply

  72. مایمیدیو، وزارت آموزش و پرورش به منظور تسهیل دسترسی کاربران به خدمات الکترونیکی، اقدام به راه‌اندازی سامانه‌های متعددی مانند سایت مای مدیو my.medu.ir نموده است.

    Reply

  86. eptamin.ir، سامانه نسخه الکترونیک تامین اجتماعی ep.tamin.ir یکی دیگر از سایت های سازمان تامین اجتماعی در جهت ترویج خدمات الکترونیکی می باشد

    Reply

  88. منابع دکتری روانشناسی بالینی وزارت بهداشت، شامل کتاب‌ها و مراجع معتبر در حوزه‌های مختلف روانشناسی، به‌ویژه روانشناسی بالینی، روان‌درمانی، آسیب‌شناسی روانی، آمار و روش تحقیق، نوروسایکولوژی، و روان‌سنجی هستند.

    Reply

  126. افتتاح حساب بانکی ویژه فرهنگیان در بانک صادرات ایران، در راستای حمایت از جامعه فرهنگیان کشور، بانک ها اقدام به ارائه خدمات مالی ویژه ای از جمله افتتاح حساب بانکی ویژه فرهنگیان در بانک صادرات ایران کرده اند.

    Reply

  128. کندو مای مدیو، سایت کندو به آدرس kandoo.medu.ir توسط مرکز توسعه ی آموزش مجازی، فناوری و امنیت اطلاعات وزارت آموزش و پرورش در جهت ارائه بستر آموزش مناسب در مقطع های مختلف تحصیلی راه اندازی شده است.

    Reply

  132. سامانه پذیرش استعدادهای برتر ملی دانشگاه فرهنگیان، دانشگاه فرهنگیان، به منظور جذب نخبگان و استعدادهای درخشان، سامانه پذیرش استعدادهای برتر ملی دانشگاه فرهنگیان را به نشانی reg.cfu.ac.ir راه‌اندازی نموده است.

    Reply

  161. It’s actually a nice and helpful piece of information. I am satisfied that you shared this useful
    info with us. Please stay us up to date like this.
    Thanks for sharing.

    Reply

  164. iranesp.ir، سامانه اطلاعات مصرف کنندگان انرژی با نام اختصاری ساما به آدرس اینترنتی iranesp.ir برای مدیریت مصرف کنندگان برق و گاز که دارای تعرفه های صنعتی و کشاورزی می باشد راه اندازی شده است.

    Reply

  176. اعتراض به نتایج آزمون ورودی مدارس تیزهوشان، پس از اعلام نتایج آزمون ورودی مدارس تیزهوشان، دانش‌آموزانی که می خواهند نسبت به اعتراض به نتایج آزمون ورودی مدارس تیزهوشان اقدام نمایند، می‌توانند از طریق سامانه مای مدیو به نشانی my.medu.ir اقدام به ثبت اعتراض نمایند.

    Reply

  177. زمان برگزاری آزمون ورودی دبیرستان ماندگار البرز، با توجه به آمار قابل توجه موفقیت دانش‌آموزان این دبیرستان در آزمون‌های سراسری و المپیادهای علمی، آگاهی از زمان برگزاری آزمون ورودی دبیرستان ماندگار البرز، دغدغه‌ای مهم برای بسیاری از دانش‌آموزان و اولیاء محسوب می‌شود.

    Reply

  185. ثبت‌نام در آزمون ورودی دوره اول متوسطه مدارس علامه طباطبایی، به منظور تسهیل فرآیند ثبت‌نام در آزمون ورودی دوره اول متوسطه مدارس علامه طباطبایی، دانش‌آموزان مستعد و علاقه‌مند می‌توانند در بازه زمانی تعیین‌شده به وب‌سایت‌های رسمی این مجموعه به نشانی‌های alameh.ir و mat.ir مراجعه نمایند.

    Reply

  188. رشته‌های قابل انتخاب در کنکور کاردانی به کارشناسی، کنکور کاردانی به کارشناسی، فرصتی مهم برای فارغ‌التحصیلان و دانشجویان ترم آخر مقطع کاردانی است تا با شرکت در آن، سطح تحصیلات خود را به کارشناسی ناپیوسته ارتقا دهند.

    Reply

  195. Wow that was odd. I just wrote an extremely long comment but after I clicked submit my comment didn’t show up.
    Grrrr… well I’m not writing all that over again. Anyway,
    just wanted to say wonderful blog!

    Reply

  203. دفتر گزارش‌های آماری سامانه سیدا ویژه مدارس، به عنوان یک منبع اطلاعاتی جامع شامل داده‌های کلیدی دانش‌آموزان از جمله مشخصات فردی، آدرس دقیق و پایه تحصیلی آنان، در دسترس مدیران مدارس از طریق سامانه مای مدیو قرار دارد.

    Reply

  206. There just isn’t an unlimited amount of knowledge regarding the connection between anabolic
    steroid use and kidney injury. We know that
    when utilized in a scientific setting with low to moderate doses, Anavar doesn’t usually
    produce harmful unwanted effects. You can buy Var using a number
    of fee methods including Moneygram, RIA, Zelle, crypto (Bitcoin), bank
    wire transfers, debit, and bank cards. IFBB certified professionals on our site provide free coaching
    to all bodybuilders. You will receive your order in a discreet, safe
    manner and we ensure a quick supply of all orders to the U.S and abroad.
    We supply 100% pharma grade Var products equipped by high internationally famend pharmaceutical firms.

    Anavar is hepatotoxic by nature and exceedingly prolonged cycles might end in liver-related health points.

    Winstrol is more likely to cause virilization effects in girls, including voice hoarseness30,
    zits, adjustments in menstrual durations, and growth of facial hair.
    Females would need to use very low doses of Winstrol to avoid these results, within the 4mg to 10mg every day range.
    Anavar excels at providing you with important improvements in aesthetics
    – leanness, hardness, dryness, and, in brief, getting ripped
    and shredded. Anavar will help keep your performance and energy capacity even on essentially the most
    restricted of calorie-deficit diets.
    Thus with 1-Andro you get a prohormone that will improve your androgen to
    estrogen ratio, with out including in additional metabolites that you may not want in your system.

    This prohormone is great for adding in a dry prohormone to a cycle or used alone
    to offset the environmental estrogens in your diet.
    Lastly, Anavar® uses Epiandrosterone, which is an endogenous steroid hormone found in Anavar® with an androgenic exercise.
    Epiandrosterone and is produced in the physique as a metabolite of testosterone.

    Epiandrosterone is legal because it has been found naturally occurring and is excreted in urine as
    a standard a half of human metabolism. Being a 5alpha-reduced
    androgen (a DHT derivative) it merely can not aromatize to estrogens.
    This makes Epiandrosterone unique compared to other now banned
    prohormones — all of which may both aromatize directly, convert to a product that aromatizes,
    or each.
    This means that a a hundred and fifty mg capsule of Androstenolone would only ship 2.25-6mg biologically energetic
    milligrams, which is less than your physique naturally produces
    day by day. Conversely, a single dose of 150 mg Androstenolone in Anavar® delivers
    between biologically active milligrams. Hi-Tech researchers have been the first to start to make use of these
    potent compounds — long before the recent steroid legal guidelines have been revamped
    to add nearly each prohormone known to be a managed substance.
    Due To This Fact, our expertise to getting the highly effective prohormones into the bloodstream by far surpasses any other firm in the business.
    We have worked on completely different applied sciences for
    over a decade whereas everyone else enjoyed the fruits of promoting illegal compounds.
    Because it’s an oral steroid, Anavar could be toxic to the liver when used over lengthy
    periods of time at extreme dosages.
    In right now’s world where the medical area is practically
    converging with cosmetics, drugs with body enhancement appeals should be given front-row attention. For athletic efficiency enhancement, males might take Anavar in doses of 20 to 40 mg daily, and girls may acquire advantage from 5 to 10 mg.
    These reasonable dosages are designed to improve strength and
    endurance with out leading to extreme muscle improvement.

    Ladies who’re snug with greater doses of Anavar and who don’t undergo virilization effects can consider adding another
    5-10mg to the Anavar dose suggestion above. Masteron is thought to be
    a greater mood enhancer than Anavar, but this impact may be very individual-dependent.
    Most Masteron customers will also see a higher
    boost to the libido than is usually skilled with Anavar.
    On the draw back for Masteron, it dries out the joints and can cause joint ache,
    whereas Anavar can be joint supportive to a degree. Masteron is good for operating for a whole cycle, while Anavar is finest used as a finishing steroid within the final weeks.

    It’s potential to retain the positive aspects made through the cycle with a correct post-cycle regime and a disciplined food plan and
    train routine. Cycles generally vary from 4 to 12 weeks, based on an individual’s goals and previous expertise
    with related dietary supplements. Bear in thoughts that confirming the legality, making certain authenticity, and
    prioritizing quality are surefire ways to safe a protected and fruitful experience with Anavar in Australia.

    This could be significantly beneficial for athletes and bodybuilders striving to achieve their health goals and surpass private
    limitations. The key to Anavar 50 mg’s effectiveness lies
    in its distinctive ability to retain lean muscle mass whereas aiding in fats discount.
    By binding to androgen receptors, Anavar stimulates protein synthesis and will increase nitrogen retention, which supports muscle development and accelerates restoration.
    This anabolic compound works through distinct mechanisms
    that contribute to muscle development, fat reduction, and enhanced physical efficiency.
    Androstenolone and Epiandrosterone are multi-functional steroids that have been implicated in a broad vary of
    organic effects in humans. Recent research demonstrated that these compounds act genomically via the androgen receptor (AR) along with its well-known results on cell floor receptors.
    The Androgen binding is what has given Anavar® its stellar status for helpful muscle features, lack of unwanted side effects, and incredible strength gains.

    Packed with Oxandrolone, this formulation delivers a higher dose in every tablet – 50
    mg. It comes in a a hundred capsule package deal, with a value point between A$390 to A$400.

    Given the strength of the dose, prescription and usage must be tailored
    to your individual needs and tolerance. The advantage of the
    drug ought to be famous that an Anavar solo cycle may be utilized in a average amount (20-50 mg) by ladies and young athletes.
    It is necessary to keep in mind that Dragon Pharma’s Anavar must be
    stored in a dry place, protected against daylight.

    References:

    best steroid on the market – https://www.echobookmarks.win/anavar-oxandrolone-an-overview,

    Reply

  218. اسامی پذیرفته‌ شدگان بدون آزمون دانشگاه آزاد، پس از اتمام فرآیند ثبت‌ نام و انتخاب رشته برای پذیرش بدون کنکور دانشگاه آزاد، اسامی پذیرفته‌ شدگان بدون آزمون دانشگاه آزاد از طریق وبگاه رسمی پذیرش این دانشگاه به نشانی azmoon.org منتشر خواهد شد.

    Reply

  219. ثبت نام دانشگاه آزاد بر اساس سوابق تحصیلی، داوطلبان گرامی که مایل به ادامه تحصیل در واحدهای دانشگاه آزاد هستند می‌توانند از طریق فرآیند ثبت نام دانشگاه آزاد بر اساس سوابق تحصیلی اقدام نمایند و در رشته و دانشگاه مورد نظر خود به ثبت‌نام بپردازند.

    Reply

  220. ثبت نام دانشگاه آزاد ورودی های جدید، با ثبت نام دانشگاه آزاد ورودی های جدید و گسترش واحدهای آموزشی خود در اقصی نقاط ایران و ارائه طیف وسیعی از رشته‌های تحصیلی در مقاطع گوناگون از کاردانی تا دکتری، فرصت ادامه تحصیل را برای تعداد زیادی از جوانان این فراهم آورده است.

    Reply

  221. ثبت‌ نام در آزمون ورودی دبیرستان ماندگار البرز، دانش‌آموزان علاقه‌مند به ثبت‌ نام در آزمون ورودی دبیرستان ماندگار البرز می‌بایست در بازه زمان ثبت نام آزمون دبیرستان ماندگار البرز، به وبگاه مربوطه مراجعه نموده و نسبت به تکمیل فرم نام‌نویسی اقدام نمایند.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *