Detecting and Mitigating Mobile Spyware

Hello, everybody. Welcome to our to our webinar today on detecting and mitigating mobile spyware. You’re all very welcome. Thank you all so much for giving us the time to go through some of what we think is really, really, really powerful content that our CEO column has pulled together. So to give you a flavor of what we’re going to cover today before we go through some housekeeping points, we’re gonna look at a brief history of the evolving mobile spyware landscape and what that looks like, and then we’re gonna look at best practices for detecting and mitigating spyware as well. So it’s it’s it’s supposed to be a really, really beneficial session, so we hope you get lots out of it. Just to cover off some housekeeping points before we get going, the session today is going to run for about thirty five to forty minutes. We’re gonna look to cover our presentation for about twenty, twenty five minutes and then leave some time at the end for a q and a. Today’s call is being recorded. And as your questions pop up, please feel free to put them into the chat box. At the end, as I said, we have some time for questions. We’ll go through as many as we can. Those questions that we don’t have time to answer or to be able to get to answer, we will follow-up after the session with some with some further information to make sure everybody’s everybody’s covered off. So with that, I’m going to hand over to our CEO, Colm Healy, who’s gonna take us through today’s today’s webinar. So, Colm, over to you. Matt, thanks thanks very much. Delighted to be here today, and really appreciate so many of you taking some time out to to join us. I know that many of you are actually customers of Corrado and would know us very well, but I also know that there are some people who would be less familiar with, with Corrata and what we do. So I thought it would be helpful just at the start to give a little bit of background to who we are as a company. So I think most of you will be aware that Corrata provides threat detection and response for mobile endpoints, specifically iOS and Android. We have a unique architecture which delivers a hundred percent visibility of the threats that are targeting those devices, but also does that without compromising either use end user experience or end user privacy, provide effective protection for both BYO and for corporate devices. And, you know, we’re delighted that we have so many of our customers on the call today. Appreciate it’s Thanksgiving in North America, so don’t expect to see many North American customers on the call today. But, nonetheless, I’m delighted to to to have all of you here today. So look, I think, you know, when we look at mobile spyware, we really can’t, consider the whole area without starting with Edward Snowden. So back in twenty thirteen and the Snowden revelations about the extensive surveillance activities, mass surveillance activities, by the of the NSA and some of its associated, intelligence organizations brought into sharp, awareness and relief, the extent to which, to which network communications were being surveilled. Specifically, the the modus that was being used in order to, effectively spy on people was, intercepting, probing, as it were, the the network traffic that was going across the world’s Internet. And, of course, the US spy agencies and the spy agencies of many other national or national and many other countries were in a position to actually put probes into the network and actually intercept traffic and understand what was going on that way. That, of course, led to a a a big change, a big change in the way in which people communicate. And one of the most important significant changes around that was the growth of end to end encrypted messaging channels. So particularly, we have WhatsApp. We have Signal. We have Telegram. We have many others. But the whole notion that if you’ve got sensitive communications, you need to make sure that they’re not just, encrypted in the normal way, but they’re encrypted end to end. That’s then in turn, probably was a a challenge for the spies. So those who wanted to understand the, communications that were going between individuals or between within organizations who basically wanted to spy on us. And the the challenge there was that they needed to infiltrate the endpoint. And I think for many years, there was a an assumption that the endpoints, particularly Android and iOS because of the way in which those, modern operating systems are built, were pretty robustly defended against against that threat. All of that really changed in twenty sixteen. Now in front and you see a quote here from John Scott Railton of the University of Toronto’s Citizens Lab. Now John Scott was one of the one of the team who discovered, revealed the existence of the Pegasus spyware. And I really, really like the quote here. It’s a recent quote from John, but it’s actually I think it captures well the impact of the revelations around the Pegasus spyware on, frankly, everyone. We went from a situation where we thought that, you know, our phones were secured, that our communications were could be protected to one where we really just don’t know. And I think what was particularly invidious about the the Pegasus spyware and generally mobile spyware in general is the fact that it it it offers so few clues. So many of the ways in which we would have traditionally thought about the the the the clues would have we would have looked out for when a device was infected with some sort of malicious code, none of those applied in the case of Pegasus. And indeed, none of those really has applied in the case of any other of the sophisticated spyware attacks we have seen. There’s two other elements to this as well. One is the fact that the well, while the initial Pegasus attacks required user interaction. So the initial the first attack that was revealed was done with an s delivered by an SMS with a link that needed to be clicked on. Subsequent attacks were zero click. So literally, without any action on behalf of the, the victim, their phones got taken over by the attackers. And the idea that this was a once off or a phenomenon that the industry, the ecosystem in general would come together and defend against successfully, really, that idea, unfortunately, that that notion has not played out. We’re nearly ten years on from the the first, revelations around mobile spyware. And on the right, you can see a list of the countries where there have been confirmed instances of, of of Pegasus infections or specifically infections with NSO the NSO groups, spyware, the NSO group being the organization which developed Pegasus. So we know that the the threat is is ongoing. It’s been around. We haven’t yet managed to eliminate it. And so what we really want to do today is try to understand how organizations can defend against this, what are the best steps in order, not just to mitigate it, but to detect it if the infections if you happen to be one of those organizations which is targeted with this kind of attack. So I suppose one of the, one of the reasons why, people were so surprised by the emergence of this kind of spyware was because of the, I would say the perception, but also the, the the the reality that, in comparison to the platforms that we’ve been working with previously, particularly Windows, both iOS and Android were far more secure. They’re fundamentally architected in a way which makes them far more secure. As a result, in order to, to attack them, what is required is the existence of vulnerabilities. And again, you know, vulnerabilities are just a feature of software. There’s no way that you can eliminate vulnerabilities completely. And this graph really gives you a sense for the fact that the existence and the exploitation of vulnerabilities is an ongoing is an ongoing reality. So while it waxes and wanes as it were, every year, you are seeing significant vulnerabilities being uncovered, being exploited because these are the actual, vulnerabilities that are known to have been exploited, being exploited by bad actors. So it is a an ongoing problem. It is it it’ll while the underlying systems are very, very are fundamentally better architected than our traditional systems, they do nonetheless because they are complex and ever evolving, they do nonetheless, give rise to vulnerabilities as on an ongoing basis. One of the challenges for defenders is that the flip side of having, operating systems that are locked down as it were is that it’s actually very difficult for third party systems to, to detect and, to monitor what’s to detect malware essentially on these devices. Because the normal hooks you would have into understanding what’s happening on the device that you have, for instance, on traditional laptops and desktops, they don’t exist in iOS and Android because everything is so segmented. And because of that, actually detecting this malware, proactively searching and hunting for it is is very difficult, particularly if you rely on a on a, I suppose, a a traditional approach of focusing on the processes and files that are on the that are exist or changed on the device. Because, basically, you can’t view those files or those processes remotely with a third party tool. So what do we rely on? Well, today, we kind of rely on, Apple and Google as the owners of these operating systems to protect us against this kind of spyware. So so far this year, there have been four waves of alerts from Apple to end users about suspected infections. Essentially, what we have here is Apple using telemetry available to it being a then alerting end users to the fact that there looks like there is some something in the telemetry that is telling, Apple that there’s a likely infectious spyware style infection on these, on your device. Now it’s it’s worth saying that Apple have never or indeed Google have never ex explain how it is how it is that they are able to, detect these infections. What’s the process of going around that? But we at Carata have you know, our our booking hypothesis as it were in relation to how Apple does this is that they rely on crash reports that they collect as normal part of business from end user devices. So if any of your organizations have developed applications, have consumer applications, for instance, or even your own business applications, you’ll know that Apple provide, crash log information to you, about those, about those applications as they are behaving on individual, individual people’s devices. What we believe the way in which we believe Apple are detecting, are detecting potential malware infections in these cases is when they see crash logs associated with, for example, WhatsApp, which are concentrated in a very small number of people, suggesting that, like, maybe millions and millions of people are successfully running a version of an app like WhatsApp without encountering crashes, but a very small subset are seeing crash logs associated with that particular application. That is we that is the telltale sign, we believe, that Apple is using in order to in order to be in order to issue these alerts. Obviously, from from the perspective of a defender, it’s really too late when one of these alerts arrives because the infection has been in place for a period of time, and sensitive information about your organization or about the individuals in your organization has already been captured at this stage. So, really, the challenge is how do we get ahead of these waves of of, of notifications. In a way, you know, the last thing you wanna have is receive is one of your end users receive one of these notifications because it means that the infection you’ve already had, the the horses it were, has already bolted. It’s also true as well that these notifications don’t go to organizations. They go to the individuals impacted, and there is a risk that in those circumstances, the individual may not, necessarily inform the information security team in a timely fashion. So given that, what’s what’s the current, as it were, approach? What approaches have been used in the past to try to defend organizations from this kind of spyware? So there’s really two approaches, and they both suffer from what we consider a lack of practicality or scalability. So the first is actually taking, devices typically of, maybe high risk individuals within your organization and on a on a regular basis, plugging them into a laptop or a PC and using some forensic software on that laptop or PC to extract information, diagnostic information from that device and analyze it. In other words, probably, in many ways, doing a similar job to what Apple is doing remotely by finding crash logs and other artifacts and then using those to infer whether there is an infection on the device or not. Clearly, you’re doing this either doing this physically taking control of the device, in some cases, asking, we’ve seen in some cases, we’ve seen organizations asking their executives to actually install software on their computers and then do the tethering themselves and then obviously conduct the forensic scan themselves. Either way, it’s not a it it it probably works for a small number of of devices. It’s probably not something you’re gonna do on a weekly or certainly not a daily basis. You might do it on a monthly basis, but it’s it’s not really something that gives you kind of real anything like real time ongoing monitoring of anything at all. And certainly, even the limited monitoring it gives you is only going to address a small number of of devices. A second approach is to get in the individuals to, to actually generate diagnostic files on the device themselves and then upload those diagnostic files, to for for analysis. This is, something that Corralis solution offers, and is a very useful step in a strategy for detecting and mitigating against spyware. But the issue is it’s not really scalable because it’s it’s not realistic to expect, again, your, your executives, your employees, employees, your at risk individuals to do this on a regular basis in some sort of cadence. It’s not realistic to think you’d be able to do that on a consistent scalable basis in a way that would be sufficiently timely to ensure that you’re gonna get to the infection before the damage is done. So Corrata is a very, very strong advocate of using network traffic monitoring as a way to identify potential infections, by spyware. Ultimately, any side of spy any spyware is going to leave, traces as it were in the the the traffic passing between the device and the command and control server of the, the malicious actor. It’s just you can’t exfiltrate data without actually sending it over the Internet. And for that reason, there is a an opportunity by through monitoring, network traffic data to be able to identify, artifacts which indicate potential compromise. The the great thing is that unlike being able unlike what we spoke about earlier in terms of the processes that are running on a device, the inability of a third party application to examine and look at those processes in real time. The you there are it is possible to monitor the network traffic running on your device. It’s obviously one of the features of the Corrata product, but it is an inbuilt feature of the, the operating systems themselves. It is something that both Apple and Google support with APIs. So because of that, it it is a, I I suppose, a a a way into understanding what’s happening on the device and also by the as a and as a result of that, a way into looking for and trying to identify, identify malicious activity and the artifacts that are left in the network traffic by, by spyware. So that’s all well and good. Like, that’s all well and good in theory. That maybe is convincing to you, but, like, does it work in practice? And I suppose we a a a a the the most recent, spyware that has been revealed is called Landfall. It was recently discovered by, Palo Alto. I think it’s unit forty two team. And it gives us a good, I suppose, test case as it were in terms of the approach that Corrata is very, very much, supporting or very much advocating as it were. So the Landfall, Spyware was targeting Samsung Galaxy devices. Thankfully, you can all rest rest easy. It has been patched by Samsung back in April of April of this year. But it’s interesting to look at how it operated. So the way it was delivered was through a an image file. The the GNG format of an image file, let’s say, a lossless raw image file format that’s widely supported. So an image file would be sent to the the victim’s device, probably over one of the messaging systems. Certainly, some of the the names of some of the image files that have been uncovered included WhatsApp in in the in the prefix and indicating that’s how they were delivered. So we think that they were delivered over the mesh as a as an image over a meshing app. And then what did what happened? So what happened then was that because of a vulnerability in the decoder for the image the image handling software for this particular type of file, a piece of malware appended to the image file or embedded within the image file was able to get traction within the devices that were. So there was a zip file with a number of when which on when unpacked contained dropper software essentially that reached out to the command and control infrastructure to download the, the payload of this, this this spyware. The spyware was very powerful. It, fingerprinted the device. It was also able to exfiltrate a wide amount of information, calls. It could do call recording. It could listen in on calls. It could, extract files and databases from the device. So, you know, sort of what we would consider classic spyware functionality. The this is this is this is what we see. And this none of these elements that are present in LANDFOR were unusual, and using images is and exploiting problems with decoders or with image handlers is, has been used before. And so this is this is a kind of a pretty pretty typical in terms of spyware, but no less devastating for that. So forward here. The so let’s see how how monitoring and network traffic might have helped in this case. So interestingly enough, when we look at the the traffic between the malware and the command and control server, we see the we see some interesting anomalies as it were, some anomalous behavior. Specifically, we see it using very rarely used ports, very high port numbers. In this case, you can see there the first port number is twenty two thousand three hundred ninety eight. The second is twenty two thousand three hundred and eight excuse me, three hundred and eighty seven. So not ports that, frankly, we would ever see in the traffic monitoring that we do. So there’s your there’s your anomalous behavior. Now this is it’s obviously a a relatively straightforward anomaly. It’s not a very complex one, but it’s an anomaly nonetheless. And actually, interestingly enough, it’s a type of anomaly that has been evident in other, spyware infections as well. In fact, in the original Pegasus infection, we saw this use of rarely used or high port numbers. So so that’s so that’s clearly a very good example of how by monitoring the network traffic, you get an indication that there is malicious activity happening on your device. The the so that and and that’s the that’s ultimately the way in which you can, start to narrow down the lie the the from all of the network traffic incidents, which might indicate that there is, there is some sort of infection. The kind of sidebar on this is why are they using these very high port numbers? Well, that basically, the high port number is a way use of a high port number is a way of avoiding detection from scanners. So there are obviously, there are defensive capabilities that are out there, which are looking at all of the all of the servers that are on the extraction Internet and looking to see if there are any malicious services out there. But by hiding it on a very pie you effectively hide it up in a port number that would never never be scanned. So how like, putting this all together, what is a coherent sort of spyware detection workflow? Well, so we see it as four steps. Right? So step one is this kind of remote anomaly detection. So it’s looking at the network traffic, looking for these kind of strange and unusual behavior on the network, and then giving us an indication that there is some problem with the, that there’s some there’s some malicious software sitting on the device. The second step is to automatically quarantine that device. That’s just to make sure that, you know, don’t things don’t get worse. So we know there’s something bad going on here. We need to quarantine the device. Certainly prevent the device from connecting to to business related applications. Then at that point, that’s the point when you you you trigger the end user to manually generate and upload diagnostics file, and they might be the device diagnostics files or packet captures that can be used then by the security team to analyze the the situation further. So this is once you have that those files, then you have the a bit you have the the the threat hunting team have the ability to hunt for the infection artifacts. And and this is important not just in terms of, the detection piece, but it’s also important in terms of the investigation piece. Because having get capturing those artifacts at an early stage in the process means you’re much more likely to be able to understand what damage has been done and indeed also more able to be understand how the the the spyware has worked. So really, we think this is a a very this is the the way in which organizations should go about, managing the spyware threat and describe with this kind of spyware detection workflow. Finally, just if if if people aren’t concerned enough or hopefully maybe or maybe they’re missing they’re concerned to mitigate it based on the the the workflow we proposed, I do think it’s it’s we shouldn’t finish on this topic without briefly touching on the the risk around GenAI and Spyware. So fundamentally, one of the concerns that we have is that as, LLMs become deeply embedded within the, within the smartphone user experience, the risk the the risk from an infection grows exponentially. And just to sort of make this very concrete, so if you have very powerful very powerful AI assisted search capabilities, for instance, over images, you can you and and you’ve got control of the device. You can ask questions like, are there any, images in the image library that look to have passwords in them, for example? But you can go beyond that. You can go and have the LLM essentially do the hard work of finding critical information. You might be looking for IP. You might be looking for sensitive information about customers or staff. You might be looking at information that could be used to to blackmail the organization. All of those things infinitely easier when you have a l LLM assisted search capabilities that could potentially which which would then which are built in and adhere into a device. So if a device gets taken over, you, you risk a much, much greater there’s a much greater risk, shall we say, of serious harm being done than perhaps exist today. So I hope, I hope people found that, useful. I’m more than happy now, Matt. I think we have probably have a few questions coming in. More than happy to to start to to talk to to some of these points, and hopefully clarify some things. Yes. Yeah. Thank you so much, for that column. I think it was really beneficial to discuss and to visualize how mobile spyware has evolved over over time, but then also when married against how having a much more evolved detection workflow allows the business to identify these threats a lot sooner, isolate devices, and then give themselves time to react and investigate further. So, yeah, it’s it’s it’s really beneficial when when when when they’re like that. You’ll be happy to know that you’ve you’ve generated a huge amount of conversation and a huge amount of questions. So I’ve been scanning as they have come in, and I wanted to bring together the the ones that are most commonly asked. And the first one that I’m gonna put to you is who who typically is targeted by these type of attacks with the businesses? Right. Great question. So so look. I mean, there’s a couple of things going on here. There’s the very public, discussion around the use of, this kind of commercial surveillance software by authoritarian regimes to spy on dissidents broadly, civil society activists, journalists, etcetera. So that’s very much where we that’s what we hear about a lot. Right? But there is a a parallel, a parallel and increasing incidents of the same type of software, maybe not necessarily from the same vendors because, in fact, might be coming from nation state actors in this case, being used to targeted people in sensitive sectors to understand about sensitive transactions, for instance, that might have geopolitical implications, but also to, I suppose, in general, advance the interests of of particular nation states, particularly hostile nation states who might be trying to disrupt the normal functioning of society and who is part of that wants to get a foothold in the in the information in the devices of key individuals within those organ within critical organizations. So there there’s these two different, very visible, like, you know, top sort of the sort of visible part of the iceberg as it were, and then there’s all this other stuff that’s going on. Not just targeting actually not just targeting the sales organizations working in sensitive sectors as well, but also their advisers. So consultants working for them, they may could be cybersecurity consultants. They could be just general business consultants. Or indeed, they’re they’re they’re the lawyers, the legal firms who are working for us as well often, again, who are heavily involved in critical transactions that these organizations are undertaking. Great. Okay. Thank you so much for that. And think a question that kinda leads well into that and follows up on that nicely is, do you see these threats being more targeted towards iOS devices or Android devices? So a great question, actually. I think you would see more of them on iOS devices simply because the kind of people who are being targeted tend to use iOS devices. I it’s not that they’re inherently you know, the jury is very much out as to whether iOS or Android are more secure. There’s a kind of perception that iOS is, and there’s an element to the fact that, I guess, iOS is a closed entirely closed ecosystem, whereas Android there are multiple versions of Android. So just by that nature of it, it’s it it probably is a little bit more even though the underlying architecture may some people tell me is more is superior to iOS, the mere fact that there are multiple OEMs, for instance, who customize the, the customized versions of Android makes it, probably balances that out. So, no, we don’t don’t see one being being more targeted than the other. It’s more the individuals and what phones they have to have is the critical thing here. Okay. Okay. Understood. Thanks so much for that. Following up on the devices, this question on what are your thoughts on people using lockdown mode? Yeah. A really good question. Like, lockdown mode’s really good, and I I think if I was a I think if I was a dissident working in a living in an an an an authoritarian country authoritarian country, or if I was someone who really was concerned they as an individual were likely to be targeted, I think lockdown mode is probably the right way to go. I think it’s unfortunately, for general employees, even in sensitive sectors, it kind of breaks your phone. It removes some of the most critical capabilities that you need just to get on with your life and with your and and get on with your work. And so for that reason, I’m not convinced that it’s a it it’s practical in a lot of circumstances. The other thing is it, you know, there are again, the the people more, more technical savvy than me will tell tell me that, you know, even with lockdown mode, there are hooks, there are ways of of getting in that, that the bad guys can exploit. K. Thank you very much. I’m trying to find another one here. Some very, very good questions. So I think to allow us time to wrap up, I’ll take one more. You outlined the section workflow in the presentation. Could you give us a practical example of how this is managed through Corrata or how this will be managed through Corrata? Yeah. So, I mean, with with Corrata, so what what the way in which it would work within within Corrata is that we would set up policies to to to trigger based on particular set of anomalies not anomalous behavior. That’s one part of it. The second part of it, we can implement enhanced logging, which means that a a much more detail in in general, in Corrata, we collect little or no data, but that’s not related to a security incident. So but we do have a mode which allows for the collection of a lot of more data about what’s happening on the phone, and that would be appropriate for someone in the sensitive sector and a high more high risk individual. So we can set sort of preconfigured triggers, or we can also use the information that we’re getting and streaming from the device as it were. We, with our team at the back end, can be empowered to to look at that to look and examine that that data for indicators of potential compromise. That’s that’s kind of step one. That’s the detect that’s the we think there is something worth investigating here step. Obviously, then you can set it up so that either automatically or manually quarantine the device when they’re when certain circumstances arise, and then you move on to asking the end user to to upload diagnostic files or PCAP files. Those then are uploaded to the Corrado back end for for further analysis. And that’s that it’s at that point that we have all of the forensic information that we can derive from the device in order to confirm the infection, or indeed just help us to investigate what’s been going on, how long has this infection been in place, those kind of critical information when an incident lies this occurs. Like, we don’t expect that to be triggering this very frequently. Right? These are these are relatively they’re highly dangerous but relatively rare incidents. And the critical thing is to be in a position to respond to those incidents. To firstly, to identify that the incident is occurring, and secondly, then to be able to respond to it appropriately. Great. Great. Thank you so much for that. There’s actually one question that’s come in and has been asked a few times, so on the back of your answer there. It’s on the quarantining piece. I was asking how fluid that is and how quickly that comes into action and then how quickly it’s rectified and it’s unquarantined essentially because the the problem that I’m reading here is that sometimes they can be delayed a few hours for a device getting shut away and then coming back online on the back end. So if you can just kinda explain that a little bit. Yeah. Because of, yeah, because of the way quarantine works in Kurava, the a device quarantine is instantaneous because it is basically implemented on the device at the network level. And also unquarantining is is also instantaneous when the device has gone back to its sort of to a secure posture. The I think the confusion sometimes arises here in that there are policies within mobile device management systems, which when a device becomes noncompliant, can can implement a style of quarantine. But the problem with that is it can take a number of hours both to be implemented and then actually takes can take considerable length of time to to to be reversed as it were because of the way it’s just the the way in which MDM or or mobile device man mobile device management actually operates. So so we we think that the ability to basically block network traffic and then unblock it is a much more is a is a much more powerful tool in the in this respect in this respect. Great. Great. Thank you so much for that. And with that, I think with the time, we’ll come back to the rest of the questions that came in during the session, and thank you all very much for engaging. Colm, thank you very much for bringing us through a that’s very impactful and the slides. I hope everybody found this found it found it very beneficial. And as I mentioned at the beginning of the call, today’s at the beginning of the webinar, today’s call has been recorded. So for those that joined throughout the session and missed the beginning, we will be circulating the recording after along with the presentation. If there are any other questions, please do respond to the email with your questions, and we will come back to you as quickly as possible. You will also receive a quick feedback survey, which will take no longer than a minute. If you could please take some time to fill fill that out and come back to us, we’d very much appreciate it. And then just to give you some excitement, we’ve got some really, really, really good sessions planned for twenty twenty six kicking off in January. So I’d I’d recommend keeping an eye out for information coming into your inbox early December on them. So thank you all very much again. I hope you enjoyed the session. I hope you have a great end to your week, and we’re looking forward to seeing you on more webinars in the new year. Thank you all so, so much.