71–80 of 202 posts
If they had send some OAuth tokens for a honeypot gmail account to the C&C server used for these attacks, they could then track the usage patterns of that token, and find all the other attacked users. Perhaps thats how they identified who was being attacked?
The list of apps being monitored which are hardcoded directly in the implant[1] include : com.yahoo.Aerogram com.microsoft.Office.Outlook com.netease.mailmaster com.rebelvox.voxer-lite com.viber com.google.Gmail ph.telegra.Telegraph com.tencent.qqmail com.atebits.Tweetie2 net.whatsapp.WhatsApp com.skype.skype com.facebook.Facebook com.tencent.xin [1] https://googleprojectzero.blogspot.com/2019/08/implant-teard...
This is an odd list. Some big messaging apps like Signal and Line are notably missing, while tools like Mail Master and Voxer seem like pretty minor players compared to the rest. Is there a particular region of the world or community where this specific list makes most sense?
Line is mostly used in Japan, Signal is mostly used by nerds. So you can assume neither japanese peopel nor nerd were their primary target. Given that this is true for the vast majority of the world population I'd not call this odd.
Earlier quoted context omitted.
These are all social networking services. Maybe, just maybe, this was tied to the PRISM program led by the NSA?
Maybe, just maybe, this was tied to the space program at NASA? Tremendously unlikely, PRISM was something very different from this.
I doubt they'd have written such shoddy and simple implant code though. At a minimum, they would have encrypted the data uploaded, since intelligence agencies love to steal data from other intelligence agencies, and sniffing wires I'm sure isn't unique to the USA.
Earlier quoted context omitted.
This is an odd list. Some big messaging apps like Signal and Line are notably missing, while tools like Mail Master and Voxer seem like pretty minor players compared to the rest. Is there a particular region of the world or community where this specific list makes most sense?
> Some big messaging apps like Signal and Line are notably missing Line is mostly used in Japan, Signal is mostly used by nerds. So you can assume neither japanese peopel nor nerd were their primary target. Given that this is true for the vast majority of the world population I'd not call this odd.
The list of apps being monitored which are hardcoded directly in the implant[1] include : com.yahoo.Aerogram com.microsoft.Office.Outlook com.netease.mailmaster com.rebelvox.voxer-lite com.viber com.google.Gmail ph.telegra.Telegraph com.tencent.qqmail com.atebits.Tweetie2 net.whatsapp.WhatsApp com.skype.skype com.facebook.Facebook com.tencent.xin [1] https://googleprojectzero.blogspot.com/2019/08/implant-teard...
This is an odd list. Some big messaging apps like Signal and Line are notably missing, while tools like Mail Master and Voxer seem like pretty minor players compared to the rest. Is there a particular region of the world or community where this specific list makes most sense?
So the suspects are countries that fight against the autonomy of a region where the population is ethnically different. The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades.
Of course, other countries could do this, but the probabilty of Birmania/Rohingya, SaudiArabia/Yemen… seems much lower. On a side note, Voxer seems to be quite proeminent in China, according to the popularity of their Android app[^3].
[^1]: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
[^2]: https://www.theguardian.com/world/2019/jan/11/if-you-enter-a...
[^3]: https://play.google.com/store/apps/details?id=com.rebelvox.v...
Earlier quoted context omitted.
Maybe, just maybe, this was tied to the space program at NASA? Tremendously unlikely, PRISM was something very different from this.
PRISM would have had to migrate to methods like this with the rise in e2e encryption. I doubt they'd have written such shoddy and simple implant code though. At a minimum, they would have encrypted the data uploaded, since intelligence agencies love to steal data from other intelligence agencies, and sniffing wires I'm sure isn't unique to the USA.
As a side note: given all the security resources Google has, why Android is still not considered safer than iOS? What mistakes has Google made with Android, and how could they be fixed?
2 decades of advertising has misinformed people that Apple products are safer.
The longer I live, the more I think nothing is safe.
Earlier quoted context omitted.
I disagree. 2FA makes it profoundly more difficult to compromise an account. Most people are using a phone as a second factor, so even if the apps don't store files and credentials directly on the device (always in doubt, as seen here), if you have root on a phone you can compromise an account without any user interaction. What's more, every time you download a banking app on your phone, you have to place a little bi…
> 2FA makes it profoundly more difficult to compromise an account. Just because the attacks are dumb. If your computer is pwned, it should wait for you to 2FA, and then when you "log out"-- don't, do malicious stuff instead.
Do you think theres a bank of iPhones at Google loading every webpage on the internet, and looking for unexpected background processes or network traffic?