Spyware Hides Right Under Our Noses
By: Jim Stickley and Tina Davis
August 8, 2019
There’s a mass exodus occurring now! But it’s not from any particular place. Instead, it’s with regard to spyware malware known as Exodus that’s causing quite a stir. The malware has been used as legitimate spyware for some time. However, researchers have just discovered that the Apple iOS version of it goes far too far beyond “mere” spyware. And it was right there under our noses…until recently. Now that we’re onto it, it’s making it’s exit out of circulation.
It was built to look just like a tab used for mobile carrier support. However, it can reach much further. It can access videos, photos, audio recordings, contact lists, the device ID, and potentially spy on conversations through the microphone as well as track his or her location. And it’s being done legitimately through Apple’s APIs that developers use to create apps.
Exodus was found in the Google Play store, but not in the Apple store. The researchers from Lookout determined that they acquired a certificate for enterprise distribution and got it out using Apple’s Developer Enterprise Program, which is the only way to get apps on devices that haven’t been jailbroken.
So, let’s talk about jailbreaking devices. That means taking off the security features so that apps can be installed from locations outside the official app store; directly from a website for example. Apple does not allow this last process, called sideloading, by default. So users who want to go rogue and get apps from other places, must jailbreak the device. This practice is not recommended. The security features are there for a reason; one being instances just like this one.
It does also affect Android devices and on those devices, it first gathers information about the device, sets up the surveillance capabilities, and then tries to gain root access. This basically allows the app to control the phone in every possible way. We don’t want that. So, if an app ever asks for administrator access or “root” access, don’t give it. It is really not necessary unless you are a developer of the app. If an app does request these, you should delete it immediately. The Apple version of Exodus asks for administrator rights too. The same advice applies. Don’t do it.
Exodus has been removed from the Google Play store, but don’t assume there aren’t others out there like it. However, it may be difficult for Apple to determine if it’s on external websites. So, always be certain of the websites you visit and watch out for phishing attempts in your email. If you receive a link or attachment that is unexpected and you are not sure about, just don’t click it. It’s not worth the risk of being spied upon.
SUBSCRIBE TO WEEKLY NEWSLETTER
