Hermit (spyware)

Last updated

Hermit
Developer(s) RCS Lab
Operating system iOS, Android
Type spyware
Websitewww.rcslab.it

Hermit is spyware developed by the Italian commercial spyware vendor RCS Lab that can be covertly installed on mobile phones running iOS and Android. [1] [2] [3] The use of the software was publicized by Google's Threat Analysis Group (TAG) on June 23, 2022, and previously disclosed by the security research group Lookout.

Contents

Details

According to Lookout, RCS Lab is in the same business as NSO Group, which gained notoriety for its Pegasus spyware, and sells spyware to government agencies. Lookout believes Hermit has been deployed by the governments of Kazakhstan and Italy. Similar to Pegasus, Hermit is capable of tracking calls, location tracking, reading text messages, accessing photos, recording audio, making and intercepting phone calls, and could gain root on Android devices. [1] [4] Some attackers would pose as the victim's mobile carrier, sometimes with the carrier's assistance, to trick the victim into downloading an app that would deliver the payload. Another vector used was posing as a legitimate messaging app. While apps containing the spyware were not made available on the iOS app store or Google Play store, malicious actors were able to obtain certificates allowing installation on any iOS device through Apple's Developer Enterprise Program. [1] [3] Once Hermit was publicized, Apple said they revoked certificates related to it, and Google said they pushed Google Play Protect updates to all users.

See also

Related Research Articles

Mobile malware is malicious software that targets mobile phones or wireless-enabled Personal digital assistants (PDA), by causing the collapse of the system and loss or leakage of confidential information. As wireless phones and PDA networks have become more and more common and have grown in complexity, it has become increasingly difficult to ensure their safety and security against electronic attacks in the form of viruses or other malware.

The iPhone is a line of smartphones produced by Apple that use Apple's own iOS mobile operating system. The first-generation iPhone was announced by then–Apple CEO Steve Jobs on January 9, 2007. Since then, Apple has annually released new iPhone models and iOS updates. As of November 1, 2018, more than 2.2 billion iPhones had been sold.

Android is a mobile operating system based on a modified version of the Linux kernel and other open-source software, designed primarily for touchscreen mobile devices such as smartphones and tablets. Android is developed by a consortium of developers known as the Open Handset Alliance, though its most widely used version is primarily developed by Google. It was unveiled in November 2007, with the first commercial Android device, the HTC Dream, being launched in September 2008.

iOS Mobile operating system by Apple

iOS is a mobile operating system developed by Apple exclusively for its smartphones. It was unveiled in January of 2007 for the first-generation iPhone, launched in June 2007.

<span class="mw-page-title-main">Rich Communication Services</span> Mobile communication protocol

Rich Communication Services (RCS) is a communication protocol between mobile telephone carriers and between phone and carrier, aiming at replacing SMS messages with a text-message system that is richer, provides phonebook polling, and can transmit in-call multimedia. It is part of the broader IP Multimedia Subsystem. Google has added support for end-to-end encryption for all chats using RCS in their own app, Google Messages. End-to-end encryption is not a feature of RCS specified by GSMA, instead deferring to the individual messaging clients to establish encryption.

<span class="mw-page-title-main">UC Browser</span> Chinese web browser developed by UCWeb Inc

UC Browser is a web browser developed by mobile internet company UCWeb, a subsidiary of the Alibaba Group. It was the most popular mobile browser in India, Indonesia, and Mali, as well as the second-most popular one in China as of 2017. Its world-wide browser share as of May 2022 is 0.86% overall according to StatCounter.

iOS jailbreaking is the use of a privilege escalation exploit to remove software restrictions imposed by Apple on devices running iOS and iOS-based operating systems. It is typically done through a series of kernel patches. A jailbroken device typically permits root access within the operating system and provides the right to install software unavailable through the App Store. Different devices and versions are exploited with a variety of tools. Apple views jailbreaking as a violation of the end-user license agreement and strongly cautions device owners not to try to achieve root access through the exploitation of vulnerabilities.

iMessage Instant messaging service by Apple

iMessage is an instant messaging service developed by Apple Inc. and launched in 2011. iMessage functions exclusively on Apple platforms – including macOS, iOS, iPadOS, and watchOS – as part of Apple's approach to inter-device integration, which has been described by media outlets as a means of achieving vendor lock-in.

<span class="mw-page-title-main">Google Play</span> Digital distribution service by Google

Google Play, also known as the Google Play Store or Play Store and formerly Android Market, is a digital distribution service operated and developed by Google. It serves as the official app store for certified devices running on the Android operating system and its derivatives, as well as ChromeOS, allowing users to browse and download applications developed with the Android software development kit and published through Google. Google Play has also served as a digital media store, offering games, music, books, movies, and television programs. Content that has been purchased on Google Play Movies & TV and Google Play Books can be accessed on a web browser and through the Android and iOS apps.

This is a comparison of mobile operating systems. Only the latest versions are shown in the table below, even though older versions may still be marketed.

<span class="mw-page-title-main">TestFlight</span> iOS app developer tool

TestFlight is an online service for over-the-air installation and testing of mobile applications, currently owned by Apple Inc. and only offered to developers within the iOS Developer Program. Developers sign up with the service to distribute applications to internal or external beta testers, who can subsequently send feedback about the application to developers. The TestFlight SDK additionally allows developers to receive remote logs, crash reports and tester feedback.

iOS 9 2015 mobile operating system

iOS 9 is the ninth major release of the iOS mobile operating system developed by Apple Inc., being the successor to iOS 8. It was announced at the company's Worldwide Developers Conference on June 8, 2015, and was released on September 16, 2015. It was succeeded by iOS 10 on September 13, 2016.

<span class="mw-page-title-main">NSO Group</span> Israeli cyber-espionage and malware firm

NSO Group Technologies is an Israeli cyber-intelligence firm primarily known for its proprietary spyware Pegasus, which is capable of remote zero-click surveillance of smartphones. It employed almost 500 people as of 2017.

Pegasus is a spyware developed by the Israeli cyber-arms company NSO Group that is designed to be covertly and remotely installed on mobile phones running iOS and Android. While NSO Group markets Pegasus as a product for fighting crime and terrorism, governments around the world have routinely used the spyware to surveil journalists, lawyers, political dissidents, and human rights activists. The sale of Pegasus licenses to foreign governments must be approved by Israeli defense ministry.

<span class="mw-page-title-main">GrapheneOS</span> Android-based mobile operating system

GrapheneOS is an Android-based, open source, privacy and security-focused mobile operating system for selected Google Pixel devices, including smartphones, tablets and foldables that is recommended by Edward Snowden.

<span class="mw-page-title-main">Google Messages</span> Messaging application developed by Google

Google Messages is a text messaging software application developed by Google for its Android and Wear OS mobile operating systems, while it's also available via the Web.

<span class="mw-page-title-main">Exposure Notification</span> Initiative for mobile device-based privacy-preserving contact tracing

The (Google/Apple) Exposure Notification System (GAEN) is a framework and protocol specification developed by Apple Inc. and Google to facilitate digital contact tracing during the COVID-19 pandemic. When used by health authorities, it augments more traditional contact tracing techniques by automatically logging close approaches among notification system users using Android or iOS smartphones. Exposure Notification is a decentralized reporting protocol built on a combination of Bluetooth Low Energy technology and privacy-preserving cryptography. It is an opt-in feature within COVID-19 apps developed and published by authorized health authorities. Unveiled on April 10, 2020, it was made available on iOS on May 20, 2020 as part of the iOS 13.5 update and on December 14, 2020 as part of the iOS 12.5 update for older iPhones. On Android, it was added to devices via a Google Play Services update, supporting all versions since Android Marshmallow.

Candiru is a Tel Aviv-based technology company offering surveillance and cyberespionage technology to governmental clients.

FORCEDENTRY, also capitalized as ForcedEntry, is a security exploit allegedly developed by NSO Group to deploy their Pegasus spyware. It enables the "zero-click" exploit that is prevalent in iOS 13 and below, but also compromises recent safeguards set by Apple's "BlastDoor" in iOS 14 and later. In September 2021, Apple released new versions of its operating systems for multiple device families containing a fix for the vulnerability.

References

  1. 1 2 3 Emma Roth (June 25, 2022). "Google says attackers worked with ISPs to deploy Hermit spyware on Android and iOS". The Verge.
  2. Chance Townsend (June 25, 2022). "Google warns of 'hermit spyware' infecting Android and iOS devices". Mashable. Archived from the original on June 26, 2022. Retrieved June 26, 2022.
  3. 1 2 Benoit Sevens; Clement Lecigne (June 23, 2022). "Spyware vendor targets users in Italy and Kazakhstan".
  4. Justin Albrecht; Paul Shunk (June 16, 2022). "Lookout Uncovers Android Spyware Deployed in Kazakhstan". Archived from the original on June 26, 2022. Retrieved June 26, 2022.