Cybersecurity professionals from Google’s threat hunting unit and the University of Toronto’s Citizen Lab are upping the pressure on mercenary hacking firms selling high-end surveillance spyware with fresh calls for the U.S. government to urgently clamp down on these businesses.
In prepared remarks during a House Intelligence Committee hearing this week, Google’s Shane Huntley called on Congress to consider a “full ban” on federal procurement of commercial spyware technologies and urged expanded U.S. government sanctions against two notorious vendors — NSO Group and Candiru.
“We welcome recent steps taken by the government in applying sanctions to the NSO Group and Candiru, and we believe other governments should consider expanding these restrictions,” Huntley argued, before urging the U.S. government to consider a full ban on buying these products and the addition of new sanctions “to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment.”
“The U.S. could also set an example to other governments by reviewing and disclosing its own historical use of these tools,” Huntley told the Permanent Select Committee on Intelligence.
[ WATCH: Fireside Chat with Google Malware Hunter Shane Huntley ]
Huntley, who runs the Google Threat Analysis Group (TAG) and has been closely involved in documenting the use of zero-day exploits, said the rampant abuse of commercial spyware tools and ongoing use of zero-day exploits against widely deployed software have become too dangerous to society.
In fact, according to Huntley, the U.S. Intelligence Community should make it a priority to identify and analyze threats from foreign commercial spyware providers “as being on par with other major advanced threat actors.”
Israel-based NSO Group and Candiru have been outed among a growing list of hack-for-hire companies using zero-days and sophisticated exploit chains to infect the most modern Windows and iOS/macOS-powered machines.
Earlier this week, Microsoft threat research units warned that an Austrian company called DSIRF was caught exploiting zero-day flaws in Windows and Adobe software products in “limited and targeted attacks.”
In addition to NSO Group, Candiru and DSIRF, there have been public documentation (.pdf) of several vendors operating in this murky space, a list that includes Cytrox, Cobwebs Technologies, Cognate, Black Cube, Bluehawk CI, BellTroX. Cytrox has been linked to the ‘Predator’ iPhone spyware suite caught on phones belonging to European politicians.
[ READ: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits ]
As the exploitation and spyware discoveries mount, Huntley called on the United States to pay close attention to foreign governments who harbor problematic vendors and undertake diplomatic efforts to limit harms caused by the mercenary spyware industry.
“Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated,” he added.
In separate testimony at the hearing, Citizen Lab senior researcher John Scott-Railton called attention to “pay-to-play government customers” that provide a steady supply of business to the mercenary spyware industry.
“In many cases, the talent pool of mercenary spyware developers draws from veterans of the intelligence services of U.S. allies. This includes countries with whom the U.S. has intelligence-sharing relationships,” Scott-Railton said. “While some pay-to-play customers are situated within governments with a degree of oversight, many are operating without any clear oversight or accountability. Predictably, this ballooning customer list is responsible for many of the abuses that have been uncovered,” he added.
[ READ: Citizen Lab Exposes Cytrox as Vendor Behind ‘Predator’ iPhone Spyware ]
Scott-Railton used the spotlight of the hearing to underscore just how invasive and powerful the commercial spyware products can be, warning the Intelligence Committee that it’s very difficult detect these hacking attacks at scale.
“The mercenary spyware industry knows that expanding espionage capabilities is a core part of their business model. But, it is inconvenient for them to acknowledge, as this quickly leads to the critical question: when does the industry become a threat to the U.S. national security and counterintelligence?” Scott-Railton asked.
He noted that U.S. government personnel “are not very well protected” from mercenary spyware, pointing to evidence showing at least nine U.S. officials had their phones infected by NSO Group’s Pegasus spying tool.
Scott-Railton said his research team has seen “troubling cases” suggesting that non-state actors may be accessing or directing the use of mercenary spyware, pointing to reports out of Mexico that commercial spyware tools “may be ending up in the hands of cartels.”
More directly, the Citizen Lab security expert called on Congress to direct the U.S. Intelligence Community to identify problematic mercenary spyware companies and use all tools to counter and disrupt their activities.
“Congress should develop legislation ensuring comprehensive U.S. export control and transparency requirements for domestically-developed spyware, including extensive due diligence for national security risks and human rights concerns,” he argued.
Related: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits
Related: Victim of Private Spyware Warns It Can be Used Against US
Related: Microsoft: Austrian Company Exploiting Windows, Adobe Zero-Days
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series.
Ryan is a veteran cybersecurity strategist who has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s past career as a security journalist included bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Ryan is a director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
Follow Ryan on Twitter @ryanaraine.
Tags:
