Google security researchers claim that spyware vendors were behind the exploitation of 80% of zero-day vulnerabilities in 2023. The vulnerabilities were used to spy on devices around the world.
A zero-day is a vulnerability that has been published or used in attacks before the vendor releases a security update that keeps its products safe.
Google's threat analysis team monitors the activities of 40 commercial spyware vendors to detect attempts to exploit vulnerabilities, protect users of its products, and strengthen the security of the broader community.
As part of this research and monitoring, Google found that 35 of the 72 known zero-day exploits that affected its products over the past ten years can be attributed to spyware vendors. And this number only represents known exploits. So, in reality, there may have been more exploits.
See also: US: Visa restrictions for those involved in spyware
Spyware vendors use zero-day vulnerabilities to target various persons of interest (e.g. journalists, activists, and politicians) at the behest of their clients. In many cases, these clients are national governments and private organizations.
Some of the most well-known spyware companies that exploit zero-day vulnerabilitiesare:
- NSO Group: The Israeli company behind the famous Pegasus spyware and other sophisticated spying tools.
- Intellexa : An alliance of spyware companies led by Tal Dilian. It combines technologies such as Cytrox's "Predator" spyware and WiSpear's WiFi eavesdropping tools
- Cy4Gate and RCS Lab: Italian companies known for the spyware “Epeius” and “Hermit” that target Android and iOS devices. Cy4Gate acquired RCS Lab in 2022, but they operate independently.
- Negg Group: Italian company with international reach. It is known for the malware “Skygofree” and the spyware “VBiss”, which targets mobile devices.
- Variston: Spanish company that provides customized security. It collaborates with other vendors for zero-day exploits and is connected to the Heliconia framework, which is expanding to the UAE.
These companies sell licenses for their products for millions of dollars. Using spyware, their clients can infect Android or iOS and track their users.
Some of the exploit chains use n-days, which are security vulnerabilities for which patches are available, however patch delays still make them exploitable.
Google says spyware vendors are very aggressive, developing at least 33 exploits for unknown vulnerabilities between 2019 and 2023.
See also: Pegasus Spyware: Targeted iPhones of Journalists and Activists in Jordan
In report , there is a list of 74 zero-day vulnerabilities used by 11 spyware vendors. The majority are vulnerabilities affecting Google Chrome (24) and Android (20). This is followed by Apple iOS (16) and Windows (6).
Google says that when researchers discover vulnerabilities and notify companies to fix them, spyware vendors are in trouble because they have to find other ways to infect. This also affects their work with customers, as it can take time for them to find a new exploit. This can delay their payment from customers, while also increasing their operating costs.
However, this is not enough to stop the spread of spyware, as the demand for these tools is high.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Google is calling for more action to be taken against the spyware industry, including higher levels of cooperation between governments and the introduction of strict guidelines governing the use of surveillance.
How can someone protect their digital life from spyware?
One of the most effective ways to protect yourself from spyware is to use reliable security. These programs scan your device for spyware and remove it. They also offer real-time protection, alerting you when an application tries to install spyware on your computer.
See also: Shutdown.log: Helps detect malicious spyware on iPhone
It's also important to keep your operating system and all programs up to date. These updates often include security fixes that can help protect your computer from spyware.
Another important tip is to be careful with the emails and messages you receive. Spyware is often spread through phishing, where attackers try to convince you to click on a malicious link or open a dangerous attachment.
Finally, it's important to keep backups of your important files. While this won't directly protect you from spyware, it will help you recover your data if your computer is infected.
Source: www.bleepingcomputer.com
