This week, Apple notified customers in 110 countries around the world (150 countries to date) that they “may have been targeted with spyware capable of hacking into their devices.” Apple notifies users “directly on their iPhone lock screen with a push notification that urges the person to take action.” The threat alert will read “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.” Apple will send notifications to users via email as well.
If you receive this notification from Apple, take it seriously and follow it urgently.
Why?
Spyware is “software that is secretly or surreptitiously installed into an information system to gather information on individuals or organizations without their knowledge” and is a type of malicious code. The spyware then passes the information to another entity without consent or asserts control over the device without the user’s knowledge. Spyware includes password stealers, banking trojans, and keyloggers.
On mobile devices, spyware steals information including “SMS messages, incoming/outgoing call logs, contact lists, emails, browser history, and photos. Mobile spyware can even log keystrokes, activate and record from any connected microphones or cameras, take screenshots of the phone’s background and track the device using GPS.” The ways threat actors can install spyware on mobile devices is through unsecured free wi-fi, operating system flaws, and malicious apps.
Spyware allows the controller to literally take over your phone without your knowledge or consent.
Spyware is also known as stalkerware, which can be applied to a device for an abusive partner or ex-partner to secretly track an individual’s device and online activity. The FTC has provided guidance on how to detect whether you have become the victim of spyware and how to protect yourself.
How to Detect and Protect Yourself from Spyware
First, if you get an alert from Apple or another manufacturer, take it seriously and follow their instructions.
It is difficult to detect spyware. The signs may be minimal, but be aware of changes to your device’s behavior including: overheating, battery drainage, old messages and pop-ups, excessive data usage, and the presence of new apps on your phone.
To protect yourself against spyware, Guardian Digital suggests the following tips:
- Employ strong passwords;
- Implement two-factor authentication;
- Regularly review installed apps (you may recall that I do this the first of every month);
- Use a VPN;
https://guardiandigital.com/resources/blog/spyware
CISA also has tips to consider:
- Use lock-down mode on your phone;
- Reboot your device weekly;
- Implement user account control;
- Routinely update your OS and apps;
- Install antivirus and anti-malware software;
- Manage your application permissions;
- Vet apps before you install them;
- Keep physical control of your devices;
- Use secure messaging apps; and
- Only visit websites beginning with HTTPS://
These tips include basic cybersecurity hygiene to protect your device from compromise, but more importantly, from spyware, which apparently is becoming a bigger problem than in the past. Be aware of the burgeoning problem and implement the above tips to best protect yourself.