{"id":16543,"date":"2019-10-09T08:10:04","date_gmt":"2019-10-09T16:10:04","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/10\/09\/news-10282\/"},"modified":"2019-10-09T08:10:04","modified_gmt":"2019-10-09T16:10:04","slug":"news-10282","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/10\/09\/news-10282\/","title":{"rendered":"How to protect against stalkerware, a murky but dangerous mobile threat"},"content":{"rendered":"

Credit to Author: Wendy Zamora| Date: Wed, 09 Oct 2019 15:00:00 +0000<\/strong><\/p>\n

Last week<\/a>, we pledged that\u2014in honor of National Cybersecurity Awareness and Domestic Violence Awareness months\u2014we would continue the fight against the online scourge known as stalkerware, or applications used to track and spy on victims without their knowing consent.<\/p>\n

We told readers that, despite working to protect against stalkerware programs for more than five years, it was time to take our efforts to the next level by spreading awareness of stalkerware and its dangers, and demonstrating how law enforcement, cybersecurity vendors, and advocacy groups can team up for better results.<\/p>\n

We laid out our vision and our plans for future action, calling on other security vendors, organizations, and individuals to get involved.<\/p>\n

And now we\u2019re ready to get back to work.<\/p>\n

This year\u2019s NCSAM emphasizes personal accountability, stressing the importance of taking proactive steps to enhance cybersecurity at home and in the workplace. The overarching theme of 2019 boils down to a nifty tagline: Own IT. Secure IT. Protect IT<\/a>. If you need that deconstructed a bit, the message asks users to consider key security concerns, such as maintaining online privacy, securing consumer devices and browsing experiences, and protecting against scams and other threats.<\/p>\n

In the context of stalkerware, then, the goal of this particular campaign is to raise awareness of this threat, as well as the difficulty defining, and thus protecting against it. We aim to help users be personally proactive by demonstrating why stalkerware is both murky and dangerous, where to draw the line between legitimate monitoring programs and stalkerware, and most importantly, how to protect against stalkerware if users feel it\u2019s being used against them.<\/p>\n

What makes stalkerware dangerous<\/h3>\n

In previous blogs, we already described what stalkerware is<\/a> and what it can do<\/a>, especially on a mobile device. In a nutshell: Stalkerware can see all the things you see on your device, hear all the things you hear, pinpoint your physical location, and even remotely control your camera and microphone. Calls can be intercepted, eavesdropped on, and recorded\u2014all without the knowledge of the device owner.<\/p>\n

Stalkerware applications can conduct equally nefarious surveillance operations as spyware<\/a>, a category of threats deemed by the cybersecurity industry as malicious. However, unlike spyware, stalkerware is largely available on the open market\u2014including on Google Play\u2014to anyone willing to pay.<\/p>\n

Often marketing themselves as parental monitoring tools<\/a>, though sometimes outright advertising their true purpose (to catch a cheating spouse in the act or \u201ckeep tabs\u201d on a partner), stalkerware applications are able to skirt many cybersecurity solution detection protocols because, if used with consent or as originally marketed, they may not be particularly malicious.<\/p>\n

The danger is that there\u2019s a whole lot of gray area in between malicious spyware used by nation-states and legitimate monitoring programs used by parents or in the workplace. When VICE\u2019s Motherboard first reported<\/a> on the rampant usage of surveillance applications by \u201cregular people,\u201d jealous or distrustful lovers were often cited as the main participants. And while stalkerware applications might help confirm the nagging suspicion of an affair, they are more often leveraged as tools for control and abuse. <\/p>\n

In fact, according to the National Domestic Violence Hotline<\/a>, digital surveillance is a form of abuse itself.<\/p>\n

Let\u2019s take a second to unpack that, because it\u2019s important. If someone is using stalkerware to monitor their partner unknowingly, they are participating in a form of abuse<\/em>. It\u2019s not a long leap from there to full-blown manipulation, and even violence.<\/p>\n

Indeed, according to a 2014 study conducted by NPR<\/a>, a whopping 85 percent of US shelters for abused women were working directly with a victim being tracked via GPS; 75 percent said their victims\u2019 abusers were eavesdropping on their conversations remotely, using hidden mobile apps. This was five years ago. <\/p>\n

Despite concerted efforts to \u201cout\u201d a few well-known consumer stalkerware applications by hacktivists\u2014including a breach of FlexiSpy and Retina-X<\/a>, makers of PhoneSheriff and SniperSpy\u2014the market for personal surveillance has only grown.<\/p>\n

In 2014, we started with 421 signatures for applications defined as stalkerware, including monitoring and spyware programs. Signatures are created to identify known threats, and they are uploaded into our software’s database so that when a Malwarebytes user comes across that threat, we automatically detect it. <\/p>\n

Today, we have more than 4,300 monitoring signatures in our database, an increase of more than 900 percent over five years. And that\u2019s only signatures of known threats. <\/p>\n

Through a technology called behavioral heuristics, we are able to identify if an application is acting <\/em>like a threat\u2014in this case, if it’s monitoring user activity, location, browser history, or employing other surveillance techniques\u2014and detect it based on suspicious activity. In that way, we catch many more threats that were previously unknown. Through heuristics and signatures combined, we now detect more than 150,000 stalkerware applications. <\/p>\n

In addition, thousands of those apps are currently active in the wild. Over the last three months, we have seen 2,332 programs that we consider stalkerware detected at least once by Malwarebytes for Android. Out of those, 107 were categorized as spyware, while the other 2,225 were flagged as monitors. <\/p>\n

Monitoring software is currently catalogued as a potentially unwanted program (PUP)<\/a> by Malwarebytes, therefore it isn\u2019t automatically blocked and removed from user systems. We instead isolate the application and allow users to make the decision whether or not to keep the program and prevent our software from detecting it in the future, or dispose of it. <\/p>\n

While this allows users to make an autonomous choice about which types of applications to allow on their devices, it also represents a challenge if abusers can simply add monitoring programs to an exclusion list and keep on spying without intrusion.<\/p>\n

You can start to see now why stalkerware has proved problematic for the security industry. Where do you draw the line between freedom and safety? For us, it boils down to one simple term: consent.<\/p>\n

To monitor, or not to monitor<\/h3>\n

In a world where opportunities to connect over the digital realm translate into opportunities to cheat, deceive, bully, stalk, harass, and otherwise be bombarded by awfulness, it\u2019s no wonder users are tempted to keep an eye on those they care about most: their partners and children.<\/p>\n

As we said in our article about the difference between parental monitoring apps and stalkerware,<\/a> we are not here to tell people how to parent their kids. Nor are we about to expunge on relationship advice. But we can tell you what is considered an invasion of privacy or unauthorized access in the eyes of the law, as well as the cybersecurity community. <\/p>\n

If you strip away the reasons for using monitoring apps\u2014ranging from legitimate love and concern for safety to a desire to exert power and control over an individual\u2014the capabilities of many stalkerware and monitoring programs are no different, technically, from surveillance programs used by nation-states.<\/p>\n

Let’s take a look at a few examples to demonstrate our meaning.<\/p>\n

Below are four monitoring applications that, so far, only Malwarebytes detects. Two of them are still available on Google Play and Apple’s App Store.<\/p>\n

Couple Tracker<\/a><\/p>\n