NSA Planned to Sneak-Attack App Stores to Put Spyware on Smartphones

Another day, another cynicism-inducing reminder that the NSA hasn’t just been unlawfully dragnet spying on our digital lives—it has also rigged up new and complicated techniques to do so, like hijacking app stores to put spyware on smartphones.

The NSA and its “Five Eyes” intelligence allies planned to put custom spyware on smartphones by tapping into vulnerable links to Android and Samsung’s app marketplaces via man-in-the-middle attacks. Documents obtained by Edward Snowden and published by the CBC and The Intercept outline this surveillance plan:

As part of a pilot project codenamed IRRITANT HORN, the agencies were developing a method to hack and hijack phone users’ connections to app stores so that they would be able to send malicious “implants” to targeted devices. The implants could then be used to collect data from the phones without their users noticing.

We already knew that the NSA and the UK’s GCHQ were trying to exploit weak spots in apps like Angry Birds to collect personal data, but this new information shows us how they intended to do so, by tracking internet traffic from smartphones to pinpoint their connections to Android and Samsung marketplace servers in order to attack them and insert spyware.

In addition to using these “implants” for plain old spying, the agencies also intended to use hijacked phones to send bad information to targets. And it successfully discovered a security hole in UCBrowser, a web browser popular in India and China, that it used to collect personal information leaking from phones.

At this point, news about ways the National Security Agency has devised to snoop electronically has to pass a pretty high egregiousness threshold to shock anyone. This latest development is noteworthy because it confirms that these intelligence agencies cared more about finding new ways to conduct mass surveillance than they did alerting companies to weak security spots, since cybercriminals in the know could’ve exploited the same holes as the NSA.

“Of course, the security agencies don’t [disclose the information],” Citizen Lab Director Ron Deibert told The Intercept. “Instead, they harbor the vulnerability. They essentially weaponize it.”

[The Intercept]

Image via Getty

Contact the author at kate.knibbs@gizmodo.com.
Public PGP key
PGP fingerprint: FF8F 0D7A AB19 6D71 C967 9576 8C12 9478 EE07 10C