Snowden : Smartphones Can Be Remotely Controlled

Smartphone users can do "very little" to stop security services getting "total control" over their devices, US whistleblower Edward Snowden has said.

The former intelligence contractor told the BBC's Panorama that UK intelligence agency GCHQ had the power to hack into phones without their owners' knowledge.

Snowden said GCHQ could gain access to a handset by sending it an encrypted text message and use it for such things as taking pictures and listening in. The UK government declined to comment.

Edward Snowden says government phone-hacking capabilities were "named after Smurfs" Mr Snowden spoke to Panorama in Moscow, where he fled in 2013 after leaking to the media details of extensive internet and phone surveillance by his former employer, the US National Security Agency (NSA).

He did not suggest that either GCHQ or the NSA were interested in mass-monitoring of citizens' private communications but said both agencies had invested heavily in technology allowing them to hack smartphones. "They want to own your phone instead of you," he said.

Mr Snowden talked about GCHQ's "Smurf Suite", a collection of secret intercept capabilities individually named after the little blue imps of Belgian cartoon fame. "Dreamy Smurf is the power management tool which means turning your phone on and off with you knowing," he said.

"Nosey Smurf is the 'hot mic' tool. For example if it's in your pocket, [GCHQ] can turn the microphone on and listen to everything that's going on around you - even if your phone is switched off because they've got the other tools for turning it on.

"Tracker Smurf is a geo-location tool which allows [GCHQ] to follow you with a greater precision than you would get from the typical triangulation of cellphone towers."

Mr Snowden also referred to a tool known as Paranoid Smurf. "It's a self-protection tool that's used to armour [GCHQ's] manipulation of your phone. For example, if you wanted to take the phone in to get it serviced because you saw something strange going on or you suspected something was wrong, it makes it much more difficult for any technician to realise that anything's gone amiss."

Once GCHQ had gained access to a user's handset, Mr Snowden said the agency would be able to see "who you call, what you've texted, the things you've browsed, the list of your contacts, the places you've been, the wireless networks that your phone is associated with. "And they can do much more. They can photograph you".

Mr Snowden also explained that the SMS message sent by the agency to gain access to the phone would pass unnoticed by the handset's owner.
"It's called an 'exploit'," he said. "That's a specially crafted message that's texted to your number like any other text message but when it arrives at your phone it's hidden from you. It doesn't display. You paid for it [the phone] but whoever controls the software owns the phone."
Image copyright

Describing the relationship between GCHQ and its US counterpart, he said: "GCHQ is to all intents and purposes a subsidiary of the NSA. "They, the NSA, provide technology, they provide tasking and direction as to what they, GCHQ, should go after." The NSA is understood to have a similar programme to the Smurf Suite used by GCHQ on which it is reported to have spent $1bn in response to terrorists' increasing use of smartphones.

Mr Snowden said the agencies were targeting those suspected of involvement in terrorism or other serious crimes such as pedophilia "but to find out who those targets are they've got to collect mass data".

"They say, and in many cases this is true, that they're not going to read your email, for example, but they can and if they did you would never know," he said.

In a statement, a spokesperson for the UK government said: "It is long-standing policy that we do not comment on intelligence matters.
"All of GCHQ's work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the Parliamentary Intelligence and Security Committee. All our operational processes rigorously support this position."

The government believes Mr Snowden has caused great damage to the intelligence agencies' ability to counter threats to national security.
Mr Snowden maintains he has acted in the public interest on the grounds that the surveillance activities revealed in the thousands of documents he leaked are carried out - in his words - "without our knowledge, without our consent and without any sort of democratic participation".

US has not offered Snowden a plea deal

Snowden says he has offered to do time in prison as part of a deal to return to US, but ‘we are still waiting for them to call us back’

Snowden, who is wanted under the Espionage Act after leaking tens of thousands of top secret documents, said he had offered to do time in prison as part of a deal. The US justice department has made no effort to contact Edward Snowden to discuss a plea deal that would see him return from exile in Russia, the NSA whistleblower said in an interview on BBC Panorama.

Snowden, who is wanted under the Espionage Act after leaking tens of thousands of top secret documents, said he had offered to do time in prison as part of a deal. “We are still waiting for them to call us back,” he said.
His comments come just months after Eric Holder, who was US Attorney-General until April, said Snowden’s revelations had “spurred a necessary debate”. He also said the “possibility exists” of a plea deal.
But senior figures in the security services in both the US and UK are unforgiving, wanting him to serve a long sentence both as punishment and to act as a deterrent to others.

Former head of the NSA Michael Hayden, asked by Panorama what would happen to Snowden, said: “If you’re asking me my opinion, he’s going to die in Moscow. He’s not coming home.”

Snowden, in his first interview with the BBC since he disclosed the documents two years ago, said: “I’ve volunteered to go to prison with the government many times. What I won’t do is I won’t serve as a deterrent to people trying to do the right thing in difficult situations.”

BBC: http://bbc.in/1FSGiy5
Guardian: http://bit.ly/1hsorCH

« The Rules of Cyberspace Just Got A Bit Clearer
Safe Harbour No More. Facebook Data Transfer Deal Is Ruled Invalid »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Hiscox

Hiscox

Hiscox offers cyber and data risks insurance to protect your business against the risks of holding data and using computer systems..

Institute for Critical Infrastructure Technology (ICIT)

Institute for Critical Infrastructure Technology (ICIT)

ICIT is a leading cybersecurity think tank providing objective research, advisory, and education to legislative, commercial, and public-sector cybersecurity stakeholders.

Retail & Hospitality Information Sharing & Analysis Center (RH-ISAC)

Retail & Hospitality Information Sharing & Analysis Center (RH-ISAC)

Retail & Hospitality ISAC operates as a central hub for sharing sector-specific cyber security information and intelligence.

Quick Heal Technologies

Quick Heal Technologies

Quick Heal Technologies is a leading IT security solutions provider focused on endpoint and network security solutions.

Physec

Physec

Physec offers innovative security products and solutions for the Internet of Things ecosystem.

Padlock

Padlock

Padlock is a trusted platform with an intimate knowledge of the cybersecurity industry that connects businesses with freelance professionals

Data Terminator

Data Terminator

Data Terminator provide a comprehensive range of secure data destruction equipment and services are in compliance to US Department of Defense (DoD) and National Security Agency (NSA) standards.

Salient Law

Salient Law

Salient Law is a virtual law firm that specialises in advising providers and users of technology on contracts involving technology.

Paladin Capital Group

Paladin Capital Group

Paladin is a leading global investor that supports and grows the world’s most innovative cyber companies.

Defendify

Defendify

We built Defendify to help small businesses navigate the cybersecurity landscape with cybersecurity that is dead simple, affordable, and works around the clock.

Pinpoint Search Group

Pinpoint Search Group

Pinpoint Search Group's recruiters specialize in Information Management, Cyber Security, Cloud and Robotic Process Automation (RPA).

BlueRiSC

BlueRiSC

BlueRiSC invent cutting-edge system assurance solutions for the 21st century with novel software and hardware designs focusing on security technologies that can be game changing.

FortifyIQ

FortifyIQ

FortifyIQ's mission is to advance maximum security against side-channel attacks across the entire computing spectrum.

Oman Technology Fund (OTF)

Oman Technology Fund (OTF)

Oman Technology Fund aims to make Oman the preferred destination for emerging tech companies in the region, and an attractive and stimulating destination for venture capital.

Scybers

Scybers

Scybers are a global cybersecurity advisory and managed services company. With our deep expertise, we help our clients reduce their cyber risks with confidence.

Backblaze

Backblaze

The Backblaze Storage Cloud provides a foundation for businesses, developers, IT professionals, and individuals to build applications, host content, manage media, back up and archive data, and more.