At a glance.
- Another commercial surveillance company is outed.
- Voice security and the challenge of fraud.
- CISA updates its Zero Trust Maturity Model.
- Effects of the US intelligence leaks.
- Russian cyber auxiliaries believed responsible for disrupting the Canadian PM's website.
- Patch Tuesday update.
Another commercial surveillance company is outed.
Yesterday Microsoft and the University of Toronto's Citizen Lab announced the discovery that a hitherto little-remarked Israeli firm, QuaDream, which Microsoft characterizes as a "private sector offensive actor (PSOA)," has been selling its surveillance platform to governments in Europe, North America, the Middle East, and Southeast Asia. Its activity, now attributed to the company, had been tracked as DEV-0196. The product it sells is known as "REIGN," and Microsoft studies the malware the platform deploys against iOS targets as "KingsPawn." The company amounts to a cyber mercenary operation, in Microsoft's view, and it sells both services and tools to its government customers.
Citizen Lab, which cooperated with Microsoft in the investigation, says that QuaDream's targets have included journalists, political opposition figures, and at least one NGO worker. The business keeps as low a profile as possible. "QuaDream operates with a minimal public presence," Citizen Lab writes, "lacking a website, extensive media coverage, or social media presence. QuaDream employees have reportedly been instructed to refrain from mentioning their employer on social media." The researchers conclude with the observation that the commercial surveillance market is larger and more protean than any single company.