InfoSecBulletin Cybersecurity for mankind
Senator Ron Wyden wrote a letter to the Department of Justice claiming that foreign officials are requesting data from Google and Apple. This letter exposes another way for governments to monitor smartphones.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Most apps use push notifications to inform smartphone users about new messages, news, or updates. These notifications can be sounds or visual signals that inform users about new emails or their team’s victory. What users may not know is that these notifications are usually sent through Google and Apple’s servers.
Wyden said that the two companies have special knowledge about the traffic between the apps and their users. This allows them to help the government monitor how users are using specific apps. Wyden asked the Department of Justice to change any policies that prevent public discussions about push notification spying.
In a statement, Apple said that Wyden’s letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.
“In this case, the federal government prohibited us from sharing any information,” the company said in a statement. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”
Google said that it shared Wyden’s “commitment to keeping users informed about these requests.”
The Department of Justice chose not to comment on the push notification surveillance or any potential restrictions on Apple or Google discussing it.
Wyden received a letter mentioning a “tip” as the source of surveillance information. The letter did not provide more details about the tip, but a source familiar with the situation confirmed that both foreign and US government agencies have been requesting metadata from Apple and Google. This data is related to push notifications and is used to connect anonymous messaging app users to specific Apple or Google accounts.
The source didn’t say which foreign governments made the requests, but mentioned that they are democracies that support the United States.
The source said they did not know how long such information had been gathered in that way.
Users often overlook push notifications, but technologists have raised concerns about the challenges in deploying them without sharing data with Google or Apple.
French developer David Libeau is worried about users and developers not being aware of how apps send data through push notifications to big US tech companies. He called this a “privacy nightmare”.
