Today there is a thriving market for legal, for-profit smartphone spyware (aka mercenary spyware). Companies like the NSO Group are free to create and sell highly sophisticated, zero-click malware such as Pegasus which has been used to spy on dissidents, politicians, activists and journalists around the world. There are also several apps available to parents to track their children, but are often used to abuse or stalk adult partners or ex-lovers. Today I'll discuss the state of these malicious apps, ways to protect our smartphones and even detect such spyware after the fact with the co-founders of iVerify, Danny Rogers and Rocky Cole.
Interview Notes
iVerify app: https://www.iverify.io/consumer
xkcd “Security” cartoon: https://xkcd.com/538/
Moxie Marlinspike (Signal) on Cellebrite tool: https://signal.org/blog/cellebrite-vulnerabilities/
Further Info
Nominate someone for a challenge coin: https://fdsd.me/quest
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Send me your questions! https://fdsd.me/qna
Support our mission! https://fdsd.me/support
Subscribe to the newsletter: https://fdsd.me/newsletter
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Would you like me to speak to your group about security and/or privacy? https://fdsd.me/speakerrequest
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:01:38: Interview setup
0:03:08: How does iVerify work and why did you create it?
0:07:10: What sort of people need protection like iVerify?
0:11:07: How do you know that you can trust a security app?
0:14:54: What do MDM profiles do to my phone? Is it reversible?
0:20:37: How dangerous are third-party app stores, compared to Apple/Google?
0:27:37: If an app I've installed is pulled from the app store, will I be notified?
0:28:50: How hard is it today to jailbreak a phone?
0:31:49: How do you tell if a phone has been hacked?
0:33:21: Can you detect if an app has escaped its sandbox?
0:38:09: What is the marketplace like for spyware?
0:41:36: Are phones getting harder to hack?
0:44:16: Is it possible to detect or prevent hacking via physical access?
0:49:11: How do Apple and Google phones compare on security?
0:52:08: How does Apple's Lockdown Mode work?
0:54:47: Should governments outlaw the sale of mercenary spyware?
1:01:10: Should governments hoard 0-days or disclose them?
1:03:31: What are your top security tips for regular users?
1:05:44: What's next for iVerify?
1:07:28: Wrap-up
Interview Notes
iVerify app: https://www.iverify.io/consumer
xkcd “Security” cartoon: https://xkcd.com/538/
Moxie Marlinspike (Signal) on Cellebrite tool: https://signal.org/blog/cellebrite-vulnerabilities/
Further Info
Nominate someone for a challenge coin: https://fdsd.me/quest
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Send me your questions! https://fdsd.me/qna
Support our mission! https://fdsd.me/support
Subscribe to the newsletter: https://fdsd.me/newsletter
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Would you like me to speak to your group about security and/or privacy? https://fdsd.me/speakerrequest
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:01:38: Interview setup
0:03:08: How does iVerify work and why did you create it?
0:07:10: What sort of people need protection like iVerify?
0:11:07: How do you know that you can trust a security app?
0:14:54: What do MDM profiles do to my phone? Is it reversible?
0:20:37: How dangerous are third-party app stores, compared to Apple/Google?
0:27:37: If an app I've installed is pulled from the app store, will I be notified?
0:28:50: How hard is it today to jailbreak a phone?
0:31:49: How do you tell if a phone has been hacked?
0:33:21: Can you detect if an app has escaped its sandbox?
0:38:09: What is the marketplace like for spyware?
0:41:36: Are phones getting harder to hack?
0:44:16: Is it possible to detect or prevent hacking via physical access?
0:49:11: How do Apple and Google phones compare on security?
0:52:08: How does Apple's Lockdown Mode work?
0:54:47: Should governments outlaw the sale of mercenary spyware?
1:01:10: Should governments hoard 0-days or disclose them?
1:03:31: What are your top security tips for regular users?
1:05:44: What's next for iVerify?
1:07:28: Wrap-up
Activity