Edward Snowden has reheated his now-cold allegation that GCHQ has the capability to hack smartphones and take control of them.
In last night's Panorama, the BBC's investigative show, Edward Snowden gave his first interview to the BBC and among others things, talked about GCHQ's Smurf ‘toolkit'.
According to the GCHQ documents which detailed the ‘smurf' toolkit, the measures work on both Android and iPhone. Named after the blue skinned, white-capped heroes of yesteryear's Saturday morning television, the toolkit hosts an array of measures for penetrating smartphones. For example, Nosey Smurf, can active a phone's microphone and act as a remote bug for audio surveillance. Paranoid Dreamy Smurf can remotely switch off a phone; Tracker Smurf provides method of geolocation even more accurate than triangulation (a means of tracking phones via surrounding phone towers) and Paranoid Smurf makes sure that none of this penetration can be tracked back to its origin.
This kind of attack software arrives via a covert text message, which according to Snowden, users cannot see.
These are still big claims, said director of BeyondTrust technical services, Brian Chappell to SCmagazineUK.com who finds Snowden's allegations somewhat questionable: “The claimed capabilities would need there to either be documented mechanisms to achieve this for each platform or vulnerabilities that would allow this functionality for each platform.” Keeping those vulnerabilities quiet would be particularly hard today. More likely, says Chappell, is “a compromised phone, with a vulnerable app or deliberately engineered app, being the source of the capability.” But that even “managing to have that capability within an app or even the mobile OS, for years without a security researcher or hacker finding out about it seems a little far-fetched.”
Once again, we can only half-tell what the ramifications are for the GCHQ's Smurfs. Snowden leaked his cache of private documents mid-2013, so it would be hard to say whether the Smurfs are still in use or if GCHQ and the NSA have continued with many of the plans outlined in the leaked documents.
Privacy International, the right-to-privacy charity, spoke to SC saying that whether the Smurfs programme can still effectively compromise smartphones is not known: “It is impossible to know whether devices are still at risk as we don't know the vector or payload used by GCHQ.”
The ‘Smurf' toolkit which allowed GCHQ to get into smartphones was revealed in the documents that Snowden leaked to the press in June 2013. Over two years have passed since then, so is this all that shocking? Tony Marques, UK lead cyber-security consultant at Encode UK told SC, that these disclosures are no big surprise:
"As with many things Snowden has discussed, it's not new. The ability to use mobile phones as covert listening devices has been around for several years”. Marques added that this kind of breach can happen without the consent or complicity of the phones' manufacturer, “since it's a matter of getting the right update to the phone that ‘upgrades' the firmware.”
Jonathan Sander, VP of product strategy at Lieberman Software Corporation echoed that very statement to SC, saying “Snowden's revelation about GCHQ's Smurf tools isn't very surprising.” Sander also mentioned that while his comes as no shock to security professionals, it shouldn't be to the man on the street either, “The reality is that most devices are horribly insecure by design and it's a miracle they aren't being exploited every day. People would rather let themselves feel secure so they choose not to think about that, and when Snowden shoves it in their face they react with shock. Security experts calmly smile and nod because they've been trying to tell us all these things for years.”
The significance of this slightly aged revelation has been thrown into sharp relief with the slow, rumbling approach of the controversial Investigatory powers bill, which Downing street bills as providing security services, "with the tools to keep you and your family safe" by allowing them a number of intrusive, surveillance powers.
Speaking to SC, Privacy International said that, “the reason this has come back into the spotlight is due to the Investigatory Power Bill, which will likely include provision for CNE (Computer Network Exploitation), generally analogous to hacking.”
Peter Taylor, the investigative journalist behind last night's Panorama talked to the Telegraph to put the interview into some context. The veteran reporter said of Snowden's first BBC interview, “We set out to make a programme about surveillance in the post Snowden world,” Taylor told the Telegraph. “Because there's this important legislation coming up called the Investigatory Powers bill designed to shed light on what the intelligence agencies – GCHQ, MI5 and MI6 – can do, and put it on a clear parliamentary footing because at the moment it's just a mess.”
