NSA whistleblower Edward Snowden warns of iPhone spyware

News by Doug Drinkwater

NSA whistle-blower Edward Snowden reportedly refuses to use Apple's iPhone because he fears the handset can be monitored by spy agencies.

Snowden's lawyer, Anatoly Kucherena, told English-language website Sputnik news, a division of the Russia state-run Rossiya Segodnya news agency, that he will not use the iPhone for fear of secret services being able to track his actions and view transmitted data.

“Edward never uses an iPhone, he's got a simple phone," said Kucherena. "The iPhone has special software that can activate itself without the owner having to press a button and gather information about him, that's why on security grounds he refused to have this phone."

The attorney didn't elaborate on such software, although Snowden has claimed in his latest leaks to Der Spiegel how the NSA spyware program ‘DROPOUTJEEP' can be used to identify (via the Apple device's UDID) and spy on every Apple iPhone and its user. The leaks are partially based on a GCHQ document dating back to November 2010.

Apple has denied such claims, although Snowden is not the only security expert to raise the possibility of  iPhone backdoors.

The whistleblower is, unsurprisingly, extremely private in his online communications, and this isn't the first time he's had reservations about mobile phone surveillance. According to Glenn Greenwald's ‘No Place To Hide' book released last year, he asked the journalist to remove the battery from his phone and to place it in the fridge before they started discussing the leaks, in order to avoid people listening in to their conversation.

His lawyer's comments are likely to be viewed with a certain amount of scepticism, however, especially considering he is in in asylum in Russia, whose government is calling for all data generated in the country – including that on Apple's iCloud – to be stored on servers within the country's borders.

Responding to the news, digital forensics expert and white-hat hacker Jonathan Zdziarski - who has previously researched Apple's packet sniffing and other forensic services affecting iOS devices - said that these latest comments were both ‘vague' and ‘alarmist'.

“It could mean anything…we know there are CALEA (the  US Communications Assistance for Law Enforcement Act) taps on all devices, but nothing specific about collection tech. I'd say ‘prove it with documents',” he told SCMagazineUK.com.

“I am not sure it's really anything other than rhetoric from a lawyer at this point. We know about DROPOUTJEEP, CALEA, etc, so it could be anything,”.

Dr Guy Bunker, senior VP of products at Clearswift, said in an email to SC that it's hard to say if there are backdoors in the iPhone and other leading products.

“Is there, isn't there? It will be a challenge to prove definitively either way. From a ‘silicon' perspective, it only takes 25,000 gates to put a backdoor in a chip, which then opens the question as to who else may have the opportunity,” he said.

“However, if you look at all the information that is voluntarily given up - primarily through the telco provider, location services from telco towers, and information on browsing – then is there much more than anyone who really needs/wants to know can't get hold of? Add to this apps which are downloaded, and the adware (aka spyware) that is regularly found in some, then there is another rich source of information that can be gleaned without the user necessarily knowing about it.

“The only way to be sure you are not being followed or tracked is not to use a mobile phone at all – from any vendor, or any provider. Even the simplest phones can track you when you switch them on.”

Meanwhile, Darktrace's director of technology Dave Palmer added:  “While we have not seen any indications of phone manufacturers building in surveillance tools to date. Darktrace has helped numerous customers whose employees have unknowingly installed malicious, third-party apps onto smartphones and brought them into the workplace. This will always be risk – and is extremely challenging to address if you don't have visibility of all activity within the network.”

This news coincided with Apple reportedly allowing China's state Internet Information Office to run security audits on products the firm sells in China, to overcome fears that its devices are used for government surveillance. CEO Tim Cook agreed to the inspections in a December meeting in the US with information office director Lu Wei, according to Beijing News.


Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews