Skype monitoring, Gmail hacks, and fake iTunes updates: How governments can track you

By | December 11, 2011, 1:27pm PST

Summary: Wikileaks’ recent ‘Spy Files’ shows how the private intelligence sector can access your Gmail accounts, use ISPs to spy on you, and even inject in-progress downloads to track you.

The chances are you’re not being watched at this very moment in time.

But popular software and services, from Skype to Gmail, Hotmail, and even iTunes are vulnerable to the covert spying technologies the private sector has invented.

Wikileaks last week revealed its latest treasure trove of leaked material, showing only the tip of the iceberg for what the intelligence sector offers. Private companies sell their civil right infringing software, privacy invasive hardware, and other technologies to state organisations for widespread monitoring, hacking and surveillance of its citizens.


Click for gallery (Source: Wikileaks)

In recently released videos, Gamma Group touts the ability of how its broad range of “infection functionality” can remotely access the full hard drive of another computer, inject downloads with spy software, and trick users into downloading fake updates to gain access to their lives.

When was the last time iTunes required an update? When did you last log into Gmail? Have you recently had a seemingly private conversation with someone on Skype?

If Gamma has this capability, then your government may do as well.

Gallery
A range of software, specifically designed to access computers, cell phones and networks, can inject downloads in progress with spy software, or hack cell phones. From intercepting Skype phone calls to ISP-level surveillance monitoring. This is how one company does it.

Its technology can attack a machine, smartphone or network on a specific target, or it can be installed at a Internet service provider level to offer widespread access of the innards of one’s private and personal life.

It can also be used to access industry secrets, healthcare providers, or even other government networks.

While Gamma is only one example of a multitude of private sector organisations that work on behalf of governments, Wikileaks’ insight into how the company practices can be applied as a minimum benchmark for others, at least.

It has long been no secret that governments spy on its own citizens.

The BBC discovered evidence post-revolution that suggested links to the repressive Mubarak-Egyptian regime. The company denied the allegations, yet were unwilling to divulge which countries or governments exactly it supplies technology or training to.

From British intelligence service GCHQ’s efforts to crack BlackBerry encryption in the wake of widespread rioting, to the U.S.’ National Security Agency’s Echelon satellite intercepting capabilities, governments have a vast array of technology at its disposal.

Yet more often than not with government, it cannot provide the services it needs to fulfil its ‘duties’ to its public.

One would question whether spying on its own citizens is a duty, but “protecting the public” is the foremost role of government — no matter how they persuade its public otherwise.

Should a government authorise the private sector use of such wide, sweeping surveillance, the matter of accountability becomes unclear.

But what the private sector offers governments, democratic and otherwise alike, leaves even the most popular software vulnerable to unauthorised snooping and interception.

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit. Details of which are restricted, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from the Huffington Post, Business Insider, AllThingsDigital, The Atlantic Wire and CBS News.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
42
Comments

Join the conversation!

Just In

That would be fine logic...
IslandBoy_77 17th Dec
@Lerianis10 ... in a society where people have absolute morals. But in the miasma of today's "do what you want so long as it doesn't hurt anybody", the definition of hurting someone varies wildly across the spectrum of humanity. In Saudi Arabia, its acceptable to lash a women and imprison her for being raped, and she bears the blame. You and I know that is totally ass-backwards, but they accept it as "truth". You say that getting stoned and having sex with anyone who consents is ok. They say it isn't (and, it isn't).

So because humans have this innate ability to skew things to suit themselves (the Saudi example being extreme, but is merely mysogonistic behaviour hiding behind a twisted, vested-interest interpretation of the Koran), it is totally necessary to have "illegal" things defined - else society would self-destruct in short order. Sort of what we in the west are seeing now, just like what happened to the Romans, Greeks and every other major civilization that has traded freedom for license... When we get to the stage where everyone has the same regard for others as they do themselves, and that self-regard is a healthy one born out of a genuine relationship with God, THEN we won't need rules and regulations, as everyone will KNOW what is good or bad, right and wrong, beneficial or damaging etc etc. Until then, the rules and regs, regrettably, need to stay.
You make an enormously good point. Governments spend billions on spying on their citizens and yet spend very little on actually improving their lives.

What kind of a way is THAT to run a country!?
@Imrhien

Good point. Personally, I think that most of the 'crime' in America is stuff that should be legalized: the drug trade, prostitution (over- and 'under'-age), etc.

Making something illegal (unless it actually involves stealing from someone, physically harming someone, or forcing someone to do or not do something that they do not or do wish to do, sexual or not and regardless of age) is the worst thing you can do with anything.

Why? It throws that thing in question into the hands of the worst of the worst and makes those things worse than they ever would be if they were legal.
0 Votes
+ -
That would be fine logic...
IslandBoy_77 17th Dec
@Lerianis10 ... in a society where people have absolute morals. But in the miasma of today's "do what you want so long as it doesn't hurt anybody", the definition of hurting someone varies wildly across the spectrum of humanity. In Saudi Arabia, its acceptable to lash a women and imprison her for being raped, and she bears the blame. You and I know that is totally ass-backwards, but they accept it as "truth". You say that getting stoned and having sex with anyone who consents is ok. They say it isn't (and, it isn't).

So because humans have this innate ability to skew things to suit themselves (the Saudi example being extreme, but is merely mysogonistic behaviour hiding behind a twisted, vested-interest interpretation of the Koran), it is totally necessary to have "illegal" things defined - else society would self-destruct in short order. Sort of what we in the west are seeing now, just like what happened to the Romans, Greeks and every other major civilization that has traded freedom for license... When we get to the stage where everyone has the same regard for others as they do themselves, and that self-regard is a healthy one born out of a genuine relationship with God, THEN we won't need rules and regulations, as everyone will KNOW what is good or bad, right and wrong, beneficial or damaging etc etc. Until then, the rules and regs, regrettably, need to stay.
0 Votes
+ -
I bet all the attacks that compromise a user's computer target Windows.
@kraterz I bet your right because MAC or Linux don't run web browser mail clients, Skype or iTunes!

"Oh look here comes another bandwagon"
they do make skype for mac if you look and linux to and itunes of course is apple which is mac duh
@kraterz

well done with that comment... it was real intelligent... it targets browser mail, itunes, or skype. browser mail is available across all OS's and browsers. the targets are Skype, iTunes, and Webmail clients... next time, stay in school
0 Votes
+ -
Some common sense goes far
Daniel Breslauer Updated - 12th Dec
No serious person would fall for any of these. I wouldn't, for sure.

To clarify:
* My WiFi is protected with WPA2-PSK AES with a non-random passphrase nobody can guess.
* Everything I do is over HTTPS.
* I change my passwords regularly.
* I don't use the same passwords for different sites.
* I don't use password managers. Ever.
* I never use public WiFi. If I would, at all, I would not transmit any passwords without proper precautions (such as using VPN).
* I don't use 'automatic updating' for iTunes or anything like that (I don't use iTunes in any case).
* I would never accept an OTA update for my phone without knowing the exact details, and most likely would get it from the manufacturers' site and update manually.

Can't imagine why anyone would want to 'track' me anyway. But whoever wants to try will have a serious job doing so.

That said, this is really a serious problem, it is quite worrisome and should not be allowed.
@Daniel Breslauer
This isn't a secure site, the remote VPN is still vulnerable and your machine, just like everyone else's in the world is still succeptable to drive-by malware attacks. Your cautious on your end but that doesn't speak for your remote end point or other variables.
@Daniel Breslauer Someone could always sneak into your house with a USB key. How secure is your front door?
@zwhittaker - they'd have to be REALLY motivated to do that. Software allows the snoop (public *or* private) to easily monitor thousands of people (or more) in a very, very short time, using one or two agents. Breaking into someone's house unnoticed requires several agents + hours *per person.* That's just common sense.
@zwhittaker My two dovermans' say "hi"
@zwhittaker

With all due respect, Mr. Whittaker, I have cameras situated inside my home and around my home, with no or few 'blind spots'. You aren't getting into my home to mess with my computer without me knowing about it and if I looked at the surveillance footage and saw someone I didn't know entering my home when I wasn't home, especially if it was LEA?

Hard drive wipe on my computer and re-image, which I keep a backup on a daily basis with 7 days worth of backups.
@twicker

You must have a really awesome security system. There is a show on the discovery channel. A "reformed" thief breaks into someone's home in a few minutes ransacks it, and takes everything of value in under 15 minutes. Then, they show the "victim" how they could harden their home against break-in.

Yeah, there is tech that will capture millions of packets per second. I've done it only for R&D and diagnostic purposes, but if you think analyzing that data is cheap, easy, or fast, you're wrong.
@zwhittaker That's why my hard drive is encrypted. happy In addition, one could employ an Intrusion Detection System to compare checksums of files against a secure, generated list to determine if any changes have occurred to executable files.
@Daniel Breslauer SO? What makes you think that they haven't thought of that?
@Daniel Breslauer Okey... But we're here to work & live and not to spend time undercover. Or are we to wear camouflage nets not to be recognized, helmets and bulletproof vests not to be injured, regularly change our way when getting home not to be tracked or wear black glasses so our eyes wouldn't betray us?
No. We don't do it and so we don't treat our computers. Hacking my data is a criminal act of the same seriousness as hacking my phone or spying myself. This is what the government must deal with. It seems to me that techies and security guys love this competitive environment and make "the rest of us" feel stupid and guilty.
I do use the same password for tens of website logins, I never change them and yes a I use password manager to keep them in one place for I can't imagine myself remembering 165 different usernames and passwords only to work with my photos, emails, songs, tweets, tunes, news, rss, updates, magazines... It's just too much to keep.

Don't blame me to carry my keys on one ring. It's just normal. Or do you have your keys spread across all your pockets just for a case? Your girl would find you funny, wouldn't she...
@Ondrax Exactly - You want to know what song I'm listening to? spend your time and resources. Want to know where I am? At work, room 402. That's public knowledge. However, there are things that should remain private, and for those things, I take appropriate actions.
It is easy not to be tracked. Don't use a smartphone and don't use gmail. Don't use Skype. If you use other peoples systems to communicate, then by definition it really isn't private.
@hayneiii@... Don't use any phone at all actually. Smartphones, especially Android, are relatively transparent. It's actually much easier to embed tech in a "dumb" phone which has all the same tracking options and none of the user access. CarrierIQ is a perfect example. You think they aren't putting that in phones where random college students can't find it? Phone calls on "conventional" switches can be rerouted, but not to the extent TOR offers. Tech has offered more privacy. Luddism is not protection.
@hayneiii@...

And don't use the internet.
@Michael Alan Goff Skype and GMail aren't the internet, and it's quite easy to accomplish their functions without them. There's even turn-key "server-in-a-box" software that'll give you your own mail, cloud, chat, file, etc. servers with minimal or no configuration on a physical system or deployable to a host or the cloud.
@hayneiii@... you can also set up your own mail server, use programs like iFolder or owncloud to also set up your own cloud server, and there are IM and videochat programs that are open source and utilize encryption. You could also use services like GMail for private mail if you used encryption.
so is the moral of the story is to not update your software?
What would have been helpful is a list of files modified or added to the OS by these packages. And how to get rid of these files.
0 Votes
+ -
Interesting article, more because it goes after everyone's favorite bogeyman (guvmints! They bad bad bad!) instead of discussing the real problem: these are private companies, selling to a variety of clients. Governments generally (a) have better things to do with their limited times, and (b) have people who could easily write this kind of code themselves (i.e., they don't need to have private companies do it for them, unless, say, they're smaller countries like Egypt). NSA doesn't need this stuff.

However, it's far easier to write about Big Bad Guvmint than it is to look at how these systems might be used by businesses to gain competitive intel, either through directly receiving it or by discovering the indiscretions of employees to gain access to the competitor through that employee.

For the vast majority of us, our governments don't care what we do as long as we're not actively attacking someone (as it should be). Corporations have no such limits.
0 Votes
+ -
Depends
John L. Ries Updated - 13th Dec
@twicker
Governments do, in some countries, actively seek to identify and punish those who are seen to be "enemies of the state", or even enemies of the current chief executive (it's even happened right here in the good old USA a time or two), even if there is no good reason to believe that any laws have been broken. It's also true that government officials have been known to use their authority for personal profit. In an ideal world, neither of these things would ever happen, but we don't live in such a world.

Reply to Rapid Rec:

History strongly disagrees with your statement. Political power has been abused throughout history. There are many good, honest, trustworthy public officials, but there are many venal, corrupt ones as well. There are also a fair number of officials who think themselves obliged to suspect everyone, even if there is no logical reason to do so, together with those who view any sort of political dissent as a threat to the survival of society.

Thus, I'm not nearly as trusting as you are.
@John L. Ries The only time, (IMHO) that Govt. gets involved is when people start downloading things like how to make a bomb, how to become a terrorist, etc. certain words phrases, are picked up and then they start looking into what you're doing, and who you are, and, ah what the.........*h!t
0 Votes
+ -
What else is new? lol.
Rick Sos 12th Dec
They can spy all they want as long as they don't slow my computer down.
What the h*ll has a person been doing that makes him so paranoid that he thinks someone is trying to keep track of him 24/7? If it was so prevalent, every person would be on the payroll of some company or government keeping track of everybody else.
Round and round goes the merry-go-round----------------
0 Votes
+ -
Suggested movie
John L. Ries 12th Dec
@tbelair@...
"The Lives of Others"; a German film about an East German author who was monitored by the Stasi in the late 1980s.

Yes, you can be spied upon (either by governments or private enterprise) even if there is no logical reason to do so, and the information so gathered can be abused.
For the first time, I am making a response to this subject. Because I now realise without any shadow of any doubt, that my own computer/s (not this one, hopefully), was used to hone the "piece of software" of which we are speaking (the set of five components). The one thing I will say is this: do not be complacent as regards the abilities of anything created by the military or those who serve them. The "software" of which you speak was in its infancy some four years ago....... but it is only very recently that it has come to the attention of the public, and, if it had not been for the papers found in Egypt, it may well still be an unknown entity.

Although what happened to me was a dirty trick to say the least, I do smile, although somewhat ruefully. Nobody is interested in us as individuals.. monitoring is done en masse and not by a human unless something of interest is triggered. We have all been watched for a very long time and it will not go away. It's just that now we know about it.
@dasim91155 It may then go back to the old saw, suggested by others for years now, of including triggers in the sig lines of all e-mails, just to increase the noise level for big brother. Although programs are smart enough parse e-mails and ignore some noise.
This article is a bit unfocused, and the last four sentences veer all over the map. While I share your general concern about privacy concerns, the following are also true:

1. Governments are authorized to "spy" on their citizens in some circumstances and with "some" safeguards. Like any power, this can be abused and should be watched carefully, but no one would argue that government surveillence is always wrong.
2. Why is a private company wrong to sell its products to the public of to the government if there is no legal restriction, such as export rules? Unless you want the government to get in the manufacturing business, it will always be a purchaser of privately produced items. The comment about the goverment wasting money on surveillence when it is not fulfilling its other "duties" is irrelevant - what government has ever been immune from criticism about wasting money or having the wrong priorities?

3. Are you more concerned about specific goverment abuse of surveillence, or the lack of goverment restriction on private access to surveillence technology? I would suggest you pick a topic and stick with it.
@Lerianis10

Just curious but your camera system probably backs up all the data to a central location within your house. The worst thing people think they are secure because they have camera's, but don't realize that when your storing your Video Data in the same house your monitoring is pointless because a smart thief will grab this up first, and then what do you have? Also by cutting the power not only would it shut down most camera's because I doubt you spend money on a personal generators to each cam, or battery powered cameras. And if you did think to be smart and get a generator and pay for offsite storage it only requires cutting your internet to stop any data from being recorded. This is as simple as using a very cheap Signal Jammer, Not to mention that all your connetions to your house are easliy accessed from outside the house, and don't even require a ladder. Maybe at most a lock cutter, but most ISP companies only set a splitter on the outside of the house when running wire (very easy to unscrew and connection gone).

An only solution would be monitoring software, Which would monitor your camera system and detect when it stops transmitting data to the outside data store to inform police. This in the same thing can be monitored by others, as you never know what underlining code has been added by the programmers and manufactures.

No Data is safe, just somtimes takes a little longer to obtain.
Stupid thing keeps deleting and posting the same thing.
And this 'secret software' is what, just really expensive spyware ?
Wouldn't it be easier for the government to put spy software in the actual chips themselves? You know, like China was caught...um...accused of doing.

(These examples are from a search. I do not visit these sites, so I cannot verify their reliability.)
http://www.wired.com/dangerroom/2011/06/chips-oy-spies-want-to-hack-proof-circuits/
http://www.americanrevolution2.com/CHINESE-INTEL-MANCHURIAN-MICROCHIP-IN-ALL-PC-COMPUTERS.htm
If I was the Government there would be bypasses built into every processor or motherboard built.
A deal would be struck with Intel, AMD,since those processors are widely used.
Inverse pixels would be used on every TV screen and monitor to allow light to enter a pixel making it a lens
Every cell phone would have a camera that stays on
Finally Software companies would have built in backdoors for the Government to use.
You know what. All of these things are used now.

Big Brother is watching
0 Votes
+ -
The time has come
JDThompson 13th Dec
The time has come for end-to-end encryption for all network traffic. Modern CPUs can easily handle the computational load. Encryption isn't a panacea, but it would add another layer of security and increase the effort needed to spy on users.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix