Apple has patched 3 zero-day vulnerabilities that have likely been exploited by a spyware vendor to hack iPhones.
The post Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones appeared first on SecurityWeek.
Google has released a Chrome 116 security update to patch CVE-2023-4863, the fourth Chrome zero-day vulnerability documented in 2023.
The post Google Patches Chrome Zero-Day Reported by Apple, Spyware Hunters appeared first on SecurityWeek.
Emails, phone numbers, calls logs, and collected messages stolen in data breach at Android stalkware LetMeSpy.
The post Sensitive Information Stolen in LetMeSpy Stalkerware Hack appeared first on SecurityWeek.
The newly detailed GoldenJackal APT has been targeting government and diplomatic entities in the Middle East and South Asia since 2019.
The post New ‘GoldenJackal’ APT Targets Middle East, South Asia Governments appeared first on SecurityWeek.
The Iranian government has been using the BouldSpy Android malware to spy on minorities and traffickers.
The post ‘BouldSpy’ Android Malware Used in Iranian Government Surveillance Operations appeared first on SecurityWeek.
Microsoft and Citizen Lab release information on the activities, malware and victims of Israeli spyware vendor QuaDream.
The post Details Emerge on Israeli Spyware Vendor QuaDream and Its iOS Malware appeared first on SecurityWeek.
Three days after announcing patches for new zero-days affecting iOS and macOS, Apple released fixes for devices running older operating system versions.
The post Apple Rolls Out Zero-Day Patches to Older iOS, macOS Devices appeared first on SecurityWeek.
Google has linked several zero-day vulnerabilities used last year to target Android and iOS devices to commercial spyware vendors.
The post Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors appeared first on SecurityWeek.
The New York Office of the Attorney General has announced punitive measures against Patrick Hinchy and 16 of the companies he owns, for illegally promoting spyware.
Since 2011, Hinchy has owned and operated numerous companies, including the 16 investigated by the New York OAG, for selling and promoting spyware targeting Android and iOS devices, including Auto Forward, Easy Spy, DDI Utilities, Highster Mobile, PhoneSpector, Surepoint, and TurboSpy.
Once installed on victim devices, the spyware would collect and exfiltrate data such as call logs, text messages, photos, videos, emails, Chrome browser data, location, and data from messaging and social media applications, including WhatsApp, Skype, Facebook, Instagram, and Twitter.
The spyware was sold to ‘customers’ looking to spy on their spouse, colleagues, or other individuals, and was installed on the victims’ devices without their knowledge and without notifying them of the data collection and exfiltration activities.
Furthermore, in order to access certain types of information, the spyware required ‘root’ or ‘jailbreak’ access. Some of the spyware also allowed customers to remotely activate the infected device’s camera or microphone, for spying or eavesdropping purposes.
The collected data was being transmitted to servers owned by Hinchy’s companies, and users of the spyware apps could access it through a web dashboard that also allowed customers to activate device cameras, unlock the victim devices, and hide or erase the spyware from those devices.
Collected data, the New York OAG has discovered, was being transmitted in an insecure manner, which exposed it to potential cyberattacks and snooping.
The investigation conducted by authorities has revealed that Hinchy and his companies focused heavily on promoting the spyware and instructing customers on how to install the software without being caught.
Customers were also led to believe that the spyware was legal, although its use without the device owner’s consent violates multiple laws.
Furthermore, Hinchy and his companies failed to inform customers of the harm the use of the software could cause, presented customers with confusing refund and data security policies, and created bogus review websites to lure customers into purchasing the spyware.
The New York OAG fined Hinchy and his companies $410,000 in penalties and ordered them to modify the software so that it would notify device owners of the data collection activities. Furthermore, Hinchy and his companies are now required to “make accurate disclosures regarding endorsements, rooting and jailbreaking requirements, refund policies, and data security”.
Hinchy and his companies are also required to delete collected data and to block customer access to that data unless customers provide an electronic acknowledgment regarding the lawfulness of the spyware.
Related: Justices Turn Away Israeli Spyware Maker in WhatsApp Suit
Related: Google Links Exploitation Frameworks to Spanish Spyware Vendor Variston
Related: Religious Minority Persecuted in Iran Targeted With Sophisticated Android Spyware
The post New York Attorney General Fines Vendor for Illegally Promoting Spyware appeared first on SecurityWeek.
