What you need to know about stalkerware | Eva Galperin

TL;DR

In this content, the speaker discusses the issue of stalkerware and the importance of protecting oneself from abusive surveillance.

Transcript

I want you to travel back in time with me, to the before time, to 2017. I don't know if you can remember it, dinosaurs were roaming the earth. I was a security researcher, I had spent about five or six years doing research on the ways in which APTs, which is short for advanced persistent threats, which stands for nation-state actors, spy on journal... Read More

Key Insights

• 🔒 Online harassment can have severe consequences, leading to fear and silence among victims, who often feel vulnerable to hacking and privacy invasion.
• 💌 Data leaks and personal information shared by friends and family can provide abusers with valuable information used to harm victims, highlighting the importance of digital privacy.
• 🔐 Account compromise is a common method for abusers to gain unauthorized access to victims' personal information and online accounts, emphasizing the need for strong, unique passwords and robust two-factor authentication.
• 🌐 Stalkerware, commercially available software used to spy on individuals, is a cheap and increasingly prevalent tool for abusive partners and former partners.
• 🛡️ Antivirus companies often fail to recognize stalkerware as malicious software, making it difficult for victims to detect and remove it from their devices.
• 📈 The Coalition Against Stalkerware, formed by academics, practitioners, and antivirus companies, aims to educate the public and change the norms around stalkerware, ensuring detection and protection in the future.
• 💡 By raising awareness and implementing changes in how antivirus companies approach stalkerware, there is hope for a future where victims can easily identify and remove this harmful software.
• 🙏 It is crucial to provide support and resources for victims of online harassment and intimate partner violence, creating a safe and secure digital environment for all individuals.

Questions & Answers

Q: What prompted the speaker to start the project against spyware and digital abuse?

The speaker's motivation to start the project against spyware and digital abuse stemmed from reading an article about victims of alleged sexual abuse by a hacker. The fear these victims felt, coupled with the realization that others may be enduring similar experiences, made her furious and determined to prevent anyone else from going through the same trauma.

Q: Who were the majority of individuals reaching out to the speaker for help?

The majority of individuals contacting the speaker for assistance were women who had been sexually abused by men and were now being spied on by their abusers. However, the speaker also received messages from men being spied on, including a case involving a man whose boyfriend had outed him to his conservative Korean family.

Q: What types of leaks were observed in cases of digital abuse?

There were various types of leaks involved in cases of digital abuse. The speaker mentioned that human leaks occurred when friends or family unknowingly shared information about the victims with the abusers. Another form of leak observed was account compromise, where abusers gained access to victims' accounts because they shared passwords or had physical access to their devices.

Q: What advice does the speaker offer to protect against digital abuse?

The speaker suggests several measures to protect against digital abuse. It includes using strong and unique passwords for all accounts, using strong password answers for security questions, and enabling the highest level of two-factor authentication possible. She also encourages users to regularly review the security and privacy settings of their accounts and be vigilant about unrecognized logins or suspicious activity.

Q: What is stalkerware and how does it work?

Stalkerware refers to commercially available programs that allow individuals to spy on others by gaining full access to their devices. Abusers typically install stalkerware on the target's device, often tricking them into doing so. Once installed, the abuser pays for access to a portal provided by the stalkerware company, which gathers information from the targeted device and sends it to the abuser. These tools provide abusers with extensive access to personal information, communications, and even encrypted messages.

Q: Do companies producing stalkerware recognize its potential for abuse?

Yes, companies producing stalkerware are fully aware that their tools may be used for abusive purposes. The speaker cited examples of marketing copy from companies like Cocospy and HelloSpy that explicitly highlighted the ability to spy on partners or wives without them knowing. These companies capitalize on the prevalence of cheating and even promoted harmful images of violence against women.

Q: How difficult is it to detect stalkerware on a device?

It can be challenging to detect stalkerware on a device, as antivirus companies often do not recognize it as malicious software. Results from VirusTotal showed that many antivirus platforms failed to identify stalkerware in their scans. However, there have been efforts to change this, with some antivirus companies committing to labeling stalkerware as potentially unwanted programs. This would allow users to scan for and remove such software manually.

Q: Are there initiatives working to combat stalkerware and educate people about it?

Yes, a coalition called the Coalition Against Stalkerware was launched to combat stalkerware and raise awareness about its dangers. The coalition comprises academics, practitioners, and antivirus companies. Their objective is to educate people about stalkerware and encourage antivirus companies to treat it as a serious threat. By changing norms and ensuring that antivirus programs detect and remove stalkerware, the coalition aims to protect individuals from this form of digital abuse.

Summary & Key Takeaways

• The speaker, a security researcher, discovered that one of their fellow researchers was allegedly a serial rapist, which led them to start a project to help victims of sexual abuse by hackers.

• They learned that personal data leaks and abusers can use various tactics, such as compromising accounts, to spy on their victims. They provided advice on how to secure accounts and protect oneself from abuse.

• The speaker discussed the rise of stalkerware, commercially available spying programs used by abusers, and the need for antivirus companies to recognize and address this issue. They highlighted efforts to create awareness and change norms surrounding stalkerware.