1 of 15

Beyond Spyware - Physical Access Surveillance

Rebekah Brown, Senior Researcher

2 of 15

Why someone reaches out:

Tech Platform Notification

Detention or Device Confiscation

Hunch/Something Strange

3 of 15

Why someone reaches out:

Tech Platform Notification

Detention or Device Confiscation

Hunch/Something Strange

4 of 15

Commercial Mobile Monitoring Tools

  • Cheaper
  • More accessible
  • Requires additional aspects
    • Social Engineering
    • Physical Access
    • Credentials
  • Still very effective

5 of 15

Image credit: Committee to Protect Journalists

6 of 15

Log Analysis

Top-Down:

Analyze spyware, understand what traces it leaves behind, then look for these traces

Bottom-Up:

Analyze phone logs, looking for implausible artifacts, then analyze to see if these are traces of spyware

7 of 15

Clues in Marketing Materials

8 of 15

9 of 15

10 of 15

11 of 15

Online Help Forums

12 of 15

13 of 15

Image credit: Lookout Mobile Security

14 of 15

What to look for:

  • Timeline
  • Apps with excessive permissions
  • Sideloaded apps
  • Setting changes
  • Network communications

15 of 15