Google\u2019s Threat Analysis Group (TAG) on Tuesday revealed that government hackers targeted iPhone users with zero-day vulnerabilities, especially those considered \u201chigh-risk\u201d users, such as journalists, human rights defenders, dissidents, and opposition party politicians.<\/p>\n
On Tuesday, Google published \u201cBuying Spying\u201d, an in-depth report detailing Commercial Surveillance Vendors (CSVs). In the report, the search giant has called out on the U.S. and other governments to take stricter action against spyware sales and the misuse of surveillance tools.<\/p>\n
\u201cThese capabilities have grown the demand for spyware technology, making way for a lucrative industry used to governments and nefarious actors the ability to exploit vulnerabilities in consumer devices,\u201d the TAG report reads.<\/p>\n
\u201cThough the use of spyware typically only affects a small number of human targets at a time, its wider impact ripples across society by contributing to\u00a0growing threats\u00a0to free speech, the free press and the integrity of elections worldwide.\u201d<\/p>\n
Google\u2019s TAG, the company\u2019s team that examines nation-backed hacking, in its report detailed how it actively tracks around 40 CSVs of varying levels of sophistication and public exposure, which are developed, sold, and deployed spyware.<\/p>\n
It also sheds light on several government-led cyber campaigns that utilized hacking tools developed by spyware and exploit sellers, including Barcelona-based Variston, a surveillance and hacking technology start-up.<\/p>\n
In one of the campaigns, according to Google, the government operatives took advantage of three unidentified iPhone \u201czero-days\u201d vulnerabilities that were unknown to Apple at the time to exploit the Cupertino giant\u2019s iPhone operating system. The spyware in question, developed by Variston, was analyzed twice by Google in 2022 and 2023, indicating the company\u2019s increasing eminence in the surveillance technology sector.<\/p>\n
Google said it discovered the unknown Variston customer using these zero-days to target iPhones in Indonesia in March 2023. The hackers delivered an SMS text message containing a malicious link infecting the target\u2019s phone with spyware, and then redirecting the victim to a news article by the Indonesian newspaper Pikiran Rakyat. In this case, Google did not reveal the identity of Variston\u2019s government customer.<\/p>\n
The company specifically called out certain CSVs, including Israeli firm NSO that developed the notorious Pegasus spyware, which went on to became a global threat to human rights and human rights defenders. Other companies named in the report that develop spyware include Italian firms Cy4Gate and RCS Labs, Greek company Intellexa, and the relatively newer Italian company Negg Group and Spain\u2019s Variston.<\/p>\n
\u201cWe hope this report will serve as a call to action. As long as there is a demand from governments to buy commercial surveillance technology, CSVs will continue to develop and sell spyware,\u201d the TAG report says.<\/p>\n
\u201cWe believe it is time for government, industry and civil society to come together to change the incentive structure which has allowed these technologies to spread so widely,\u201d the group added.<\/p>\n","protected":false},"excerpt":{"rendered":"
Google\u2019s Threat Analysis Group (TAG) on Tuesday revealed that government hackers targeted iPhone users with zero-day vulnerabilities, especially those considered \u201chigh-risk\u201d users, such as journalists, human rights defenders, dissidents, and opposition party politicians. On Tuesday, Google published \u201cBuying Spying\u201d, an in-depth report detailing Commercial Surveillance Vendors (CSVs). In the report, the search giant has called […]<\/p>\n","protected":false},"author":20,"featured_media":120361,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[215,48520,5920,7],"tags":[6819,2245,62770,62771,6763,62769,62772,617,722,686,62773,46225,6814,1598,16208,62768,62774],"class_list":{"0":"post-120328","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-apple","8":"category-cyber-security","9":"category-iphone-smartphones","10":"category-security-news","11":"tag-apple","12":"tag-apple-iphone","13":"tag-commercial-surveillance-vendors","14":"tag-csvs","15":"tag-google","16":"tag-googles-tag","17":"tag-government-hackers","18":"tag-hackers","19":"tag-hacking-2","20":"tag-iphone-2","21":"tag-nso","22":"tag-pegasus","23":"tag-spyware","24":"tag-surveillance","25":"tag-tag","26":"tag-threat-analysis-group","27":"tag-variston"},"yoast_head":"\n