Counter Spyware Solutions by Numbers Station

Am I Secure? is the only iOS app that detects the latest versions of advanced spyware like NSO Group’s Pegasus.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

The number of man-in-the-middle (MitM) attacks our users are seeing when using VPN providers is concerning. In our iOS security app for individual users, there is a free man-in-the-middle MitM attack check for a number of popular domains. We routinely receive emails to our support team about MitM warnings users are seeing in the app. Some are explained by expected behaviour such as public WiFi access points redirecting to a login page, and once logged in, the warning disappears. For other ones though, when we write back explaining they should try disabling their VPN, run the test again and see what happens, sure enough, every time it only happens when the VPN is enabled. Even more concerning, often the warning the user is seeing is only for https://t.co/ZXvzqdSmez, the other test domains all come back as clean, so not a glitch but a very specific focus on a high value domain. This of course does not impact the Gmail mobile app (except as a denial of service), since it is certificate pinned, but would impact web access to Gmail. It might not be the VPN provider themselves, could be someone upstream from them doing it too.

In a future release of the app the UI is going to bring up a share results option if a MitM is detected *AND* a VPN is enabled which will allow the user to select their email app and email us quickly the results. This way we can get better coverage of how often this is happening. The email would contain the test domain(s) impacted, the public IP of the VPN provider’s exit node and info on which certificates were presented for the failed connection. From there we can figure out the VPN provider and see if only specific exit nodes of the provider are impacted or all of them. Right now the results do not leave the app so we only know when someone takes the time to collect all of that and email us. Using email still so the user is able to see everything that is shared before hitting send.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

@criticalvas @lorenzofb 404 page not found now for the link to their report...

[Vas Panagiotopoulos @criticalvas]

The 🇺🇸US Cybersecurity and Infrastructure Security Agency (CISA) has issued a national alert warning that cyber actors are using sophisticated targeting & social engineering techniques to deliver spyware & gain unauthorised access to victims’ mobile messaging apps.
https://t.co/ulsteWARv4

[Vas Panagiotopoulos @criticalvas]

⚠️@HennaVirkkunen promises to submit a list of #spyware companies that received 🇪🇺EU funding following our @FTM_eu investigation.

💡All applications, she said, are reviewed by a “multidisciplinary team of ethical experts.”

🎥 WATCH: https://t.co/CI5mV3boM1

Q: @daniel_freund

[Lorenzo Franceschi-Bicchierai @lorenzofb]

NEW: How former L3Harris Trenchant boss Peter Williams was able to steal zero-days worth millions of dollars, based on court docs and interviews with former colleagues.

“No one had any supervision over [Williams] at all. He was kind of allowed to do things the way he wanted to.”

[Aaron Zollo @zollotech]

IOS 26.1 Security updates are now live and there are quite a few.

https://t.co/NiJgIHhWW7

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

Lockdown Mode also tightens policy around what accessory/USB connections are accepted and invalidates pairings. With current iOS version, Lockdown Mode enabled, the device locked, and no passcode known, USB-based forensic boxes are effectively blocked. That said, attackers could still try completely different avenues, zero-click exploits delivered via messaging apps being one example, especially if targeting 3rd party apps that do not benefit from Lockdown Mode protections. At that point these tools could perform their usual data extraction but the initial access would not be USB based.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

To ensure user privacy, we do not collect any data at all, just show the results to the user in the app and it is up to them if they wish to contact us and share the info. Perhaps though when a VPN is enabled and a MITM is detected we should add a button to report a MITM and ask the user if they wish to share which domains are being blocked along with the exit IP of the VPN provider which in many cases would tell us which VPN provider is performing the MITM.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

Am I Secure? (on the App Store) opens a TLS connection to each domain being checked and inspects the certificate chain presented by the server during the TLS handshake; instead of relying on the device's trust store, it compares the terminal certificate chain’s root CA against a locally stored one in the app. Basically certificate pinning. What we find interesting is some users will tell us that the MITM warning is only happening for one domain, usually https://t.co/ZXvzqdSmez, but not any of the others being checked...nothing sketchy at all about that! Of course WiFi access point login/accept our policy pages also set this off when they redirect.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

We would also add, if you are only conversing with other people that also use iOS, do not install any additional messaging apps and use just iMessage. The protections of Lockdown Mode do not fully extend to 3rd party apps. Similarly, on iPhone 17 devices with MIE protections, no 3rd party messaging apps currently have opted-in for this protection, so currently only iMessage has that additional protection too. Hopefully 3rd party apps will add MIE in future versions.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

@antoinedss @runasand @micahflee @BSidesPDX Lockdown Mode adds additional physical access protections to the USB port to stop attacks from tools like GrayKey or Cellebrite. It also adds protections that block the cellular connection from being downgraded to a 2G connection, as happens with many IMSI grabbers.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

@happygeek "Team Z3 has withdrawn their WhatsApp entry."

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

@Aminexche @lorenzofb We’re planning a public Android app that works across all major Android variants, whereas our government-focused deployments currently target Samsung Knox devices exclusively.

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

Unfortunately usually by the time the threat notification arrives, the attacker has already known for a while that they got caught and have already wiped their spyware and the evidence contained in logs ages off quickly, so minimal if any evidence left by the time analysis is performed. Only way to protect yourself and detect spyware is routine scanning, ideally daily, not post notification checks.

The attacker can find out they were caught before threat notifications are sent due to a delay between when malicious messaging accounts (for sending 0-click exploit chains) or exploit/C2 infra is shutdown and the threat notifications are sent out. Shutting those down has a lower threshold than threat notifications so it happens right away at the start of the investigation giving attackers time to clean up their mess.

[Lorenzo Franceschi-Bicchierai @lorenzofb]

SCOOP: A man who worked on developing hacking tools for defense contractor L3Harris Trenchant was notified by Apple that his iPhone was targeted with spyware.

It's unclear who targeted him, but he believes he was the scapegoat of a leak investigation.

https://t.co/dWAhfdE6Tw

[Counter Spyware Solutions by Numbers Station @Numbers_STN]

@Jeyso215 Thanks for the shoutout!

[Vas Panagiotopoulos @criticalvas]

A decision by the Swiss Supreme Court has revealed an ongoing investigation by the 🇨🇭Office of the Attorney General into exports of #spyware to various countries in breach of Swiss export control laws. The investigation relates to the company Thalestris Switzerland.
https://t.co/TQGv4XD8cY

[Vas Panagiotopoulos @criticalvas]

🇺🇸US Immigration and Customs Enforcement (ICE) law enforcement arm Homeland Security Investigations (HSI) has signed a contract worth $3m with Magnet Forensics, a company that makes a phone-hacking & unlocking device called Graykey, writes @lorenzofb.
https://t.co/ijFCucdQHU

[Milo Jones @Inveniam]

Mythical Beasts: Diving into the depths of the global spyware market #Cybersecurity https://t.co/a53ZfHyNnz