Latest News | Spyware Wars: Governments and Tech Giants Unite Against Cyber Intrusion
Spyware's Global Grip: Coalition Aims to Secure Human Rights and Cybersecurity
A global coalition of countries, including France, the U.K., and the U.S., along with tech giants like Google, MDSec, Meta, and Microsoft, has formed the Pall Mall Process to combat the abuse of commercial spyware for human rights violations. The initiative aims to establish guiding principles and policies to address the proliferation and irresponsible use of cyber intrusion tools. The uncontrolled dissemination of spyware is seen as a threat to cyber stability, human rights, national security, and digital security. Spyware tools, like Chrysaor and Pegasus, can be misused to access devices, intercept calls, obtain photos, and operate cameras and microphones remotely, often without user interaction. The U.S. Department of State announced visa denials for individuals involved in the misuse of dangerous spyware technology. Notably absent from the coalition are Israel, Hungary, Mexico, Spain, and Thailand. The efforts coincide with Google's revelation of tracking 40 spyware companies, 11 linked to exploiting 74 zero-days in various platforms over the past decade. The spyware industry poses a challenge as it continues to develop new exploit chains despite ongoing efforts to combat it, highlighting the need for sustained global action against commercial spyware abuse.
Key Points:
Global Coalition Formation: A coalition comprising numerous countries and major tech companies, including France, the U.K., the U.S., Google, MDSec, Meta, and Microsoft, has collaborated to address the misuse of commercial spyware for human rights abuses.- Pall Mall Process: The joint initiative, named the Pall Mall Process, focuses on curbing the proliferation and irresponsible use of commercial cyber intrusion tools. It aims to establish guiding principles and policies involving states, industry, and civil society.
- Declaration Highlights Risks: The coalition's declaration emphasizes that the uncontrolled dissemination of spyware poses risks to cyber stability, human rights, national security, and digital security. Spyware tools, such as Chrysaor and Pegasus, can be exploited for various malicious activities.
- Zero-Click Spyware Threats: The U.K. government warns that spyware attacks can access devices, listen to calls, obtain photos, and operate cameras and microphones remotely, often through 'zero-click' spyware, requiring no user interaction.
- Global Spyware Campaigns: According to the National Cyber Security Centre (NCSC), thousands of individuals are targeted globally by spyware campaigns each year, leading to severe consequences for cybersecurity and public institutions.
- Exclusions and Visa Denials: Israel, Hungary, Mexico, Spain, and Thailand are notable absentees from the coalition. The U.S. Department of State announced visa denials for individuals associated with the misuse of dangerous spyware technology.
- Google's Tracking Efforts: Google's Threat Analysis Group (TAG) reveals tracking approximately 40 commercial spyware companies linked to government agencies. These companies have exploited 74 zero-days across platforms like Google Chrome, Android, iOS, Windows, Adobe, and Mozilla Firefox in the past decade.
- Ongoing Whack-a-Mole Challenge: Efforts to combat the spyware ecosystem are likened to a "whack-a-mole" game, indicating the challenge of addressing recurring and lesser-known players in the spyware industry.
- Spyware Industry Challenges: Despite ongoing efforts, commercial surveillance vendors (CSVs) continue developing new exploit chains. Google's TAG underscores that as long as there is a demand for surveillance capabilities, the spyware industry will persist, causing harm to high-risk users and society at large.
- Recent Exploits and Flaws: Google's TAG report details recent exploits, including state-sponsored actors exploiting three iOS flaws in 2023 to infect victims with spyware developed by Barcelona-based Variston. This incident highlights the need for vigilance and patching vulnerabilities promptly.
Source and further reading.
The Hacker News. (n.d.).
Global coalition and tech giants unite against commercial spyware abuse.
https://thehackernews.com/2024/02/global-coalition-and-tech-giants-unite.html