Millions of People Are Installing Malware on Their Partners’ Phones

0:00Study and play. Come together on a Windows 11 PC. And for a limited time, college students get the best of both worlds. Get the Unreal College Deal. Everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft 365 Premium and a year of Xbox Game Pass Ultimate with a custom color Xbox wireless controller. Learn more at windows.com slash student offer. While supplies last, ends June 30th. Terms at aka.ms slash college PC. This company made like$2 million plus. They're money laundering, they're using identity theft. It's a whole cybercrime operation.

0:37You see sometimes the photos of their retreats that they go on. They drink and they take photos and they're so happy that they're working at this small startup, but not realizing that their software potentially is infecting hundreds of thousands of people around the world.

0:53Hello, welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist-founder company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. And they get early access to our interview series too, just like this episode. Gain access to that content at 404media.co. Hello. This week, I'm speaking to Zach Whittaker. He's an editor over at TechCrunch. I've known him for a very, very long time.

1:31He's also the editor of Lorenzo Franceschi Bicari, you know, a longtime and dear friend of mine. And Lorenzo was previously on the podcast talking about government, spyware, malware, all of that sort of thing. i'm also talking to zach about malware for mobile phones but it's on the other side of the spectrum in a way in that is very much focused on stalkerware or spouseware and i'll let zach sort of define more of what that is but it's a really really pressing threat i think it's way more prevalent than people probably understand or even i understand sometimes and zach has been leading coverage on stalkerware and spouseware for the last few years.

2:20I hope you enjoy the conversation.

2:26All right, Zach, welcome to the show. Thank you so much for joining us. Hey, thanks so much for inviting me. I really appreciate that. Of course, of course. So let's just start basic. For you, what is stalkerware? Like, how do you define it when someone asks you, hey, what is this thing called stalkerware? So I would say that stalkerware is its most basic fundamental level phone spyware. But the reason why we call it stalkerware is because in part, because of how it's used and also the people who use it as well. So as you can imagine, it's very secretive and stealthy in terms of the way that it's kind of planned on people's phones.

3:02For the most part, it affects Android users because you can easily plant an Android app, a stalkerware app on someone's phone. But it also does affect iOS users, iPhone users, iPad users as well in a slightly different way. It usually just takes their account credentials and accesses their data in a different way to the cloud. But we call it stalkerware specifically because of the way that it's used and the people who use it. So it's primarily people who are in close or romantic domestic relationships. And people use this spyware. They buy it commercially online using a credit card like anyone can do.

3:40And then they buy it, plant it on someone's phone, usually with knowledge of their passcode or a way to get into their phone. And this is, as I say, it's often close familial kind of settings, partners, domestic spouses. And that's also why we also call it spouseware as well. It lends itself to different names because of the way it's used. But this kind of software is really nasty. It can be used to grab people's messages and their photos and their real-time location. and it can be really, really invasive and acquire all kinds of people's information in real time and allow whoever planted the app or accessed their device account settings to get their information in real time to see what they're up to, where they're going and who they're meeting.

4:23So this is really invasive and nasty software. Yeah, it captures all sorts of data. I mean, essentially everything that's on a mobile phone and usually we wouldn't talk that broadly or that generally, but that's basically the case because as you say to install this piece of software you typically have to be in a in a privileged position with the target which is a very fancy way of saying you're an abusive husband or an abusive wife or an abusive spouse or whatever and in that position you're going to have physical access to the device and i mean when me and lorenzo were covering stalkerware spouseware like something like 10 years ago at this point there was a sort of a feeling in infosec that i don't think is the case anymore to be clear so i should probably stop making this point because i think it's a bit it's a bit out of date but at the time people weren't really paying attention to it because it wasn't like sexy in an infosec way it's not a zero day exploit being delivered by Paragon or NSO Group or anything like that, it's on a technical level, actually pretty basic.

5:31You log into the phone, you download the app, maybe you sideload it, you install it, and that's it. Again, maybe after this interview, I'm going to retire making this point because it does seem out of touch now when companies like Kaspersky actually, I take this shit very seriously now. Just briefly, what do you think of that argument that maybe InfoSec historically didn't really pay attention to this because of the lack of technical sophistication. I think that might actually be in part why stalkerware I think is so dangerous actually. Because it's kind of everywhere. It permeates like a lot of society, different societies all over the world.

6:07And it really is one of those kind of like silent kind of like things that affects a lot of people, but I don't think we get a huge amount of visibility into it. So over the past few years, these stalkerware companies have been breached and hacked and they have exposed so much people's data. By nature, these apps will grab and steal people's information. But the added consequence to that is a lot of these companies don't keep that data secure. So they leak and they have all this information on the internet for other people to find. And so that has allowed us over the years to give us some idea, some understanding of how big of an issue this is.

6:50And we think that this affects millions of people, potentially every single day around the world. And we just don't get that much visibility into it. Lorenzo and I have been covering, just like you, stalkerware over the past few years. And I think the last count that we came to, I think it was in the region of 28 or 29 stalkerware operations or companies that have been exposed or they have been hacked or breached people's information over the course of the last 10 years. And some of these operations have had millions of people who have had their phones compromised at any given time. So we're able to see that some of these operations are actually quite large, even though we don't necessarily see the amount of scale that some of the attacks might have.

7:36But this is a huge problem. We just don't get to see it as much as I think we should. Yeah. So you're getting that sort of sense of scale from all of these different breaches or data exposures by stalkerware companies. And correct me if I'm wrong, I'm just going to say this for the sake of argument, but let's just say that, oh, 29 were exposed or hacked or whatever. Each one of those had a million users. I know that's not the case. I'm just doing it to build the example. But to get the sense of scale, have you basically like added up how many different user accounts were exposed and all of that, just to get a general sense of, oh, wow, this is like millions of people potentially impacted by this malware.

8:17We've tried over the years, and it's really difficult sometimes to actually gauge just how big these operations are, because every single time a company is breached or exposed or had a security lapse, it's a different kind of incident. So the amount of data that we see might vary from time to time, from place to place. But a lot of the time, because these stalker operations rely on grabbing people's location data. Oftentimes, this data is collected, stored by these stalkerware servers, and then they are leaked and exposed. And that allows us to maybe plot out where the locations are seen on a map, for example.

8:51This gives us some visibility into how big these things are. So some of these operations will, as I say, will have a few thousand users here or there. Some of the bigger operations will have maybe a million or plus victims who have had their phones compromised at any given time. And there will be some overlap over these different operations over time because sometimes they evolve, sometimes they get shut down, sometimes they get exposed by reporters like me and you who write about them and they shut down and move on to new operations. But I think the scale is really important to kind of put into perspective because we think that there are probably millions of people who are being compromised every day by this very easy to buy consumer grade spyware.

9:32Whereas, for example, if you look at, say, government-backed spyware, which targets people with powerful zero days and spyware that compromises vulnerabilities on their phone, generally speaking, those are a small number of people. We're talking probably tens, maybe even hundreds of thousands of people who are being spied on by their governments. But the problem, what I think is one of the larger problems with stalker and spyware is that it just affects so many people. and it's so easy for people to use and to buy and to plant on people's phone. I think that in itself is the real danger here. Yeah, and there's the additional very complicated threat that this software, this malware is being deployed often in the context of an abusive relationship.

10:18So of course, where you're mentioning the government spyware there, the threat of course is that, well, the government, generally speaking, has the power to arrest you. they have the legal monopoly over the use of violence all of that sort of thing uh very very concerning for all sorts of different reasons obviously depending on the context activists journalists dissidents whatever right and then also against criminals who should be investigated as well there's all that nuance there here it's not just that people are being hacked and their data taken by this spouseware it's that i don't know when i was speaking to domestic violence experts when I was covering this a while back, you would think that coming from the perspective of InfoSec, oh, it'd be great if we made a tool that automatically removes this malware.

11:05And it's like, no, no, no. If you do that, the man might get angry and stab or attack or something else horrible to this person. And the security considerations around this technology are like way more complicated than And people may assume, because it's not like it's tech first, then domestic violence. It is a domestic violence situation and then tech is involved in on it. Like, what do you make of that? I completely agree with you. And I think that is, you know, notifying people of this kind of activity is really hard. It's actually really, really difficult. And there are a lot of, as you say, a lot of considerations that I think folks don't necessarily think about when, you know, covering and reporting and investigating spyware, like stalkerware, especially when it has this very, very close kind of knit domestic family setting.

11:55Over the years, we found it really difficult to notify victims of stalkerware. And this has been a consistent challenge. And I think you may have experienced this as well. Because when we find that in the cases where we've had identifiable information about victims who've had stalkerware plans on that phone, we may have an email address, we may have some kind of information that could potentially notify them. But if we reach out to them and notify them, say, hey, you might have Spyro on your phone, the added consequence of that is that the person who planted the app on their phone may also see that.

12:30So that could put them in a potentially unsafe situation. And that's really something that we've been thinking about a great deal over time. One of the bigger challenges that we had was with a project called The Truth Spy, which was a a significant stalker operation that we covered several years ago at TechCrunch because it had a serious security vulnerability that allowed anyone to basically download the stolen data from someone's victim's phone. This was a major vulnerability that we managed to write about in the end because it was of such public kind of interest. But when we were able to peruse some of the data and look at some of the victims involved to try and understand more about the business side of these stalker operations, because they do make a lot of money that allows them to continue perpetually making more victims and more money out of this.

13:17We found that some of the victims, we couldn't notify because if we were to notify them, then they would also be potentially put at risk by their partners. So we built a tool that essentially allowed people to search for their own IMEI number, which is unique to their phone, so they can look for themselves in a safe setting to check and see if their phone was compromised by the spyware. Now, that was something that required a lot of time. Resources were at a big company at the time, so we had to go through software security testing of our own. But in the end, it was something that we thought we could do to help people, give them agency to essentially find out if they've been falling victim themselves, rather than us reach out.

13:58But again, that's a very complicated process, and it's not something that can easily or feasibly be done. So that's why I think there has to be a lot more done to support victims of stalkerware and also help folks identify on their own phones so they can remove it in a way that's safe so long as they have a safety plan in place themselves. Yeah, it's a really, really hard problem. And I think your solution is a very novel one in that you almost made like a heavily been pwned site, but just for this sort of branch of stalkerware. Is that site still up and stuff? That's still very much there, yeah.

14:34Yeah, it's still there. Yeah. So we still have it located at techcrunch.com. So you can essentially, for a period of time, when we had that slice of data, there was about 400 or so thousand people whose phones we had identified as being compromised by this suite of different stalkerware tools under the TruthSpy family. And so we purposely built that so that we didn't collect any information and we tried to essentially minimize as much, tracking things like that so people could freely use it. But we found over time that the actual page, people visited that page hundreds of thousands of times. So we hope that there are folks that were able to essentially identify the spiral on their own devices and also remove it in a safe way.

15:24We've written guides of how folks can essentially identify and remove it on their phones. But one of the real challenges with Stalker is that it also deliberately hides something else and it's so stealthy. So it's designed to look like a system app or a system settings app to blend in. And it doesn't visually get seen on the phone. It hides the app. So you can't just swipe through and delete the app because you don't know it's there. And that's one of the real challenges here is that these apps often abuse settings in the phone, like Android settings, accessibility settings, notification settings.

15:58So they can just access all the information at any given time. And a very similar thing with iPhones as well, is that even though you can't necessarily plant a malicious app on an iPhone so easily, if you have access to their email address or their password for their Apple account, you can just pull essentially the downloaded data from their account at any given time. So that's another situation that people need to think about. It's not just Android users who have their phones compromised, it's iPhones as well. So taking those precautions are also really important for users to prevent stalkerware from being planted or misused against someone.

16:33Yeah, you did explain most of it, but maybe just to spell it out for people who haven't heard about this before. Can you explain the Apple attack a little bit more? What does the attacker need exactly? And to the best of your knowledge, what is happening there with Apple-focused tools? So over the past few years, we've found a few stalker operations that have specifically targeted iPhones and iPad users. And we've known this because they themselves have had a data breach. And we've seen the data and we've seen, for example, these are account tokens. These are little pieces of information that essentially allows a user, like an iPhone user, to log in to an Apple service.

17:14And you have one of these by entering your username and password, sets a token. But if you steal that token, then you can essentially access an account as if you were that user. And this is what Stalkerware does. It essentially takes an account victim's username and password, and then it logs in stealthily as if it was that user. It pulls a copy of their backup from their phone from iCloud, and then it passes that data and then presents it in a visually understandable way for whoever tried to essentially access that account. so they can access things like their location data and their photos, their messages, and all the usual sort of data that you would expect Spyware to be able to obtain.

17:56But instead of actually planting something on their phone, it's taking the information directly from their cloud, which a lot of users can also prevent this from happening by enabling two-factor on their account, which I think is mandatory now for Apple accounts. But also, for those who are really particularly mindful of this, ensuring that they don't have any system profiles in their system settings, and ensuring that they don't have any devices that are attached to their iCloud that you don't recognize. That's usually one way to identify that your data might have been accessed. Yeah, because of course, as you say, the software manufacturers aren't sophisticated or frankly rich enough to develop software they can actually install on the iPhone or the iPad.

18:38So they have to attack this other thing, which is, as you say, the backup mechanism. And that's basically controlled by an Apple ID and password. I remember I covered stalkware at first with Lorenzo like 10 years ago. The first couple of years were all about Android. And then we started to see like iCloud cloning tools. I think that was the marketing at the time. Now I feel like... I haven't checked these companies in a while, so you would know better than me. But I feel like they don't even get that specific anymore. They don't say iCloud cloning. They just say, get data from iPhone. They don't even want to explain it really to the user because it's like, I mean, these people might not be super technically minded when they're just trying to steal their spouse's Apple ID and password or whatever.

19:24But yes, I've definitely seen that marketed. Just because we're talking about sort of that marketing, I remember I wrote a story about how Google was having adverts in Google search for stalkerware or something like that. So you would search something and then like a top ad would be like for a really abusive piece of software. There's the Apple case we're just talking about there. My question to you is like, what role do Apple and Google play here as the sort of platform providers of these mobile operating systems? Do they have a responsibility here? Is it kind of out of their hands? I appreciate it's very complicated, but just sort of what are your thoughts on that?

20:02I think on a number of fronts. I think Apple has done a fair amount of work and trying to combat things on their end to a degree. Over the years where we have identified Apple accounts that have been compromised by stalkerware, we've reached out to let them know that they have this issue. They have customers who are compromised. Can we provide them information to essentially help secure their accounts? They've received information and secured potentially hundreds of customers over the period of however long to essentially get them secured. So there is some kind of good reaction there. Similar things have happened with Google over time.

20:40They do react and they do try and essentially react when we flag things. But I think there is an underlying issue with Android apps. Android apps do allow this kind of thing to happen. I think by nature, it's a bit of a trade-off because folks appreciate the open nature of Android to a degree. But it can be abused in a way that can allow malicious people to get access to people's information. So I think there is a bit of a responsibility on both to both react, but also try and do things to prevent this kind of thing from happening. You know, Google has made some strides in locking down Android over time.

21:14But I think that this is still something that we continue to see. We still see stalker operators and companies setting up and creating new apps, new Android apps that allow people to plant them on people's phones. And this is affecting people with relatively modern devices, modern apps. It's still a problem that is continuing to happen. We're still seeing it in large numbers. But it doesn't really seem to have much sign of slowing down. But I would say that on the flip side of it, we have, as I said, exposed, I think, in the region of a dozen or so individual operations over the past few years on top of the other dozen or so that have been exposed for longer.

21:58So this issue is getting more light. There is more sunlight to this. So we are seeing more effort to tackle this broader issue from the tech companies, but also from the security researchers who are trying to essentially get the word out about this. And also the antivirus makers, the anti-malware providers, who are essentially trying to block this kind of software from running on people's phones as well. So there is a concerted effort all around. But I think that one of the best things that can be done is more education about this topic. Making people aware that this kind of thing happens, I think is a really big part of that.

22:39You know that moment where you're lying awake at like 1 in the morning and you suddenly think, wait, this could actually be a business. Maybe it's a product idea. Maybe it's merch. Maybe it's something you've wanted to launch forever, but you haven't acted on it yet. The hard part isn't usually the idea. It's figuring out how to actually build a thing to go from idea to execution. That's why people use Shopify. Shopify is the commerce platform behind millions of businesses worldwide and about 10 % of all e-commerce in the US. From huge brands to people just getting started to 404 Media's merch store.

23:11You can build a storefront with ready-to-use templates that actually look professional. And they have all sorts of tools to help you write product descriptions, improve your product photos, and make launching way faster. On Shopify, you can run email and social campaigns to actually reach customers instead of just hoping people find you. And everything, inventory, payments, shipping, analytics, all lives in one place, which makes the whole thing feel way less overwhelming. Just speaking for myself, using Shopify's backend makes our front end look good and honestly makes it really easy to manage all of our inventory, do the shipping, all that sort of thing.

23:46I've also found that if you ever need help, Shopify has 24-7 support. So if you've been sitting on an idea for months, or if you just came up with it last night, this might be your time to actually launch it. Start your business today with the industry's best business partner, Shopify, and start hearing. Sign up for your$1 per month trial today at shopify.com slash media. Go to shopify.com slash media. That's shopify.com slash media. So I've talked before about this hoodie that I thought would just be for specific situations, but then somehow it became the thing I wore pretty much all winter long.

24:25That's what happens to me with Paka, spelled P-A-K-A, pronounced Paka. I originally thought it would be my travel hoodie or my outdoor hoodie, but I wore it pretty much constantly all winter and fall and spring. But now it's summer and I wanted to tell you about Paka t-shirts and these pack of socks that I have as well. Honestly, they are amazing. They're ridiculously comfortable. They're made from alpaca fiber, which is softer than cashmere, warmer than wool, and somehow still breathable. The hoodie didn't feel bulky or heavy like a lot of hoodies do. And then the t-shirt I find is really breathable.

25:02It's thermoregulating, odor-resistant, durable, and it actually holds up over time. And I love the socks also. They have amazing designs and then they're super comfortable. They keep my feet not so sweaty, which is great. And I most appreciate that Paka uses one of the world's most sustainable and natural fibers. Each hoodie, if you decide to go that way, is made start to finish in Peru and comes with an Inca ID that's hand woven by artisans, which is a really cool way to connect to where your clothing actually comes from. Over 250 ,000 people have already picked one up. And after wearing it all winter, all fall, when it starts getting cold again here in Los Angeles, I'll be wearing it again.

25:43I totally understand why people do that. So this summer, I'm wearing Paka t-shirts for most of the summer, I assume. But if you've been thinking about leveling up your hoodie game or your t-shirt or your sock game, this is probably your sign. To grab your Paka hoodie or t-shirt or socks, go to www.pakaapparel.com. That's www.pakaapparel.com P-A-K-A-apparel.com This message is sponsored by Raycon. I feel like most days I'm constantly moving, walking somewhere, running errands, grabbing coffee, walking my dog, doing stuff around the house. And I pretty much always want to listen to something while I'm doing it, whether it's a podcast, music, audiobook.