The BBC is reporting that Wikileaks has released information on US CIA cyber weapons, including against Android devices.

A similar unit targets Google's Android which is used to run the majority of the world's smart phones (~85%) including Samsung, HTC and Sony. 1.15 billion Android powered phones were sold last year. "Year Zero" shows that as of 2016 the CIA had 24 "weaponized" Android "zero days" which it has developed itself and obtained from GCHQ, NSA and cyber arms contractors.

These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the "smart" phones that they run on and collecting audio and message traffic before encryption is applied.

Wikileaks link for Android exploits. Much of this appears to be redacted.

I am not concerned about attacks that require physical access to the Android device. If a nation targets me specifically, I expect them to succeed in compromising my device. I am interested in avoiding being casually swept up by mass attacks or surveillance.

Assume, if necessary, that we are talking about unrooted, fully-patched Android devices running the latest Android OS (Nougat).

How, if at all, should a normal end-user modify their behavior to maintain their privacy given this disclosure?

  • 1
    If WL didn't publish the information you're looking for then I'm not sure how we could answer this. Unless you're looking for very general guidance, perhaps. – eldarerathis Mar 7 '17 at 17:32
  • The leaked "zero days" are mostly for <4.4 versions. However surely there is "zero days" for marshmallow and nougat about wich we don't know, and there is vulns on newer devices which are very know mostly on mid-range phones which can be exploited but manufacturers don't really care about them. – Једноруки Крстивоје Mar 7 '17 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.