GoKawiilSince 2001, Apple has been warning its users when they may have been targeted by spyware, using email, iMessage, and banners in their accounts. But in September of this year, the company began to place these threat notifications directly in users’ device Lock Screen and Settings — making them harder to miss. Here’s what you need to know about Apple threat notifications and spyware attacks in general, and what they mean for your digital security.
⚠︎ What is an Apple threat notification actually telling me?
Put simply, that Apple detected activity in your device signalling that you have been targeted with so-called mercenary spyware, that is, the sophisticated commercial surveillance technology that is sold by companies like NSO Group, Paragon, or Cytrox, often exclusively to government clients.
This alert does not tell you whether or not the spyware attack succeeded, nor does it provide information about who might be behind the attack or what their motives may be. Further analysis is required for you to see a clearer picture.
⚠︎ How do I confirm if a spyware attack has actually taken place?
A threat notification is like a fire alarm; it draws your attention to the possibility of danger, but you still need the fire brigade. If you have received an authentic Apple threat notification, you should immediately seek expert support from trusted professionals or organizations who can help you conduct a digital forensic investigation. Be careful, however, to ensure that the message is authentic to avoid scams or phishing.
A forensic investigation process takes time, but it will help you better assess and take control of the situation.
If you are a member of civil society, such as an activist, journalist, or human rights defender, you can contact Access Now’s Digital Security Helpline to get more tailored advice. As Apple says, “we strongly suggest notified users enlist expert help, such as the rapid-response emergency security assistance provided by the Digital Security Helpline at the nonprofit Access Now.”
⚠︎ What does a digital forensic investigation do and how would it help me address a spyware attack?
When dealing with a spyware attack, it is important to preserve the evidence that a spyware attack or attempt may have left in your device as soon as possible. Time is of the essence, as data is being overwritten every minute that a phone or laptop stays on. Investigators would work with you to preserve that evidence.
... continue reading