US Counterintelligence Shares Tips to Block Spyware Attacks

The US National Counterintelligence and Security Center (NCSC) and the Department of State have jointly published guidance on defending against attacks using commercial surveillance tools.

Tips shared in the joint advisory are designed to help people at risk of being targeted by surveillance campaigns block attempts to track their location, record their conversations, and harvest their personal information and online activity using mercenary spyware deployed on their mobile devices.

Also Read: 5 Best Practices About Information Retention For Businesses

“Companies and individuals have been selling commercial surveillance tools to governments and other entities that have used them for malicious purposes,” the two US government agencies said [PDF].

“Journalists, dissidents, and other persons around the world have been targeted and tracked using these tools, which allow malign actors to infect mobile and internet-connected devices with malware over both WiFi and cellular data connections.

“In some cases, malign actors can infect a targeted device with no action from the device owner. In others, they can use an infected link to gain access to a device.”

The list of spyware mitigation measures shared by the NCSC and the US State Department advises potential targets to:

• Regularly update device operating systems and mobile applications.
• Be suspicious of content from unfamiliar senders, especially those which contain links or attachments.
• Don’t click on suspicious links or suspicious emails and attachments.
• Check URLs before clicking links, or go to websites directly.
• Regularly restart mobile devices, which may help damage or remove malware implants.
• Encrypt and password protect your device.
• Maintain physical control of your device when possible.
• Use trusted Virtual Private Networks.
• Disable geo-location options and cover camera on devices.
• While these steps mitigate risks, they don’t eliminate them. It’s always safest to behave as if the device is compromised, so be mindful of sensitive content.

This advisory was published on the heels of news that US State Dept employees’ phones have been hacked using Pegasus spyware developed by the Israeli surveillance firm NSO Group.

The attacks hit at least 11 US officials based in or focused on matters concerning the East African country of Uganda and took place in the second half of last year.

Reports of State Dept employees having their devices infected with spyware came after the US sanctioned NSO Group and three other companies from Israel, Russia, and Singapore for spyware development and selling hacking tools used by state-backed hacking groups.

Also Read: Employment Application Template: What Information Required

The Commerce Department’s Bureau of Industry and Security (BIS) added NSO and Candiru to its Entity List for supplying the software used by state hackers to spy on government officials, journalists, and activists.

In early November, Apple also filed a lawsuit against NSO for targeting and spying on Apple users after compromising their devices using the ForcedEntry exploit and Pegasus spyware as Citizen Lab revealed in August.

“Some governments are using commercial surveillance software to target dissidents, journalists & others around the globe who they perceive as critics,”  the NCSC said today.

“Commercial surveillance tools are also being used in ways that pose a serious counterintelligence and security risk to U.S. personnel and systems. Today’s [..] bulletin offers cybersecurity practices that may mitigate risks.”