InfoSecBulletin Cybersecurity for mankind
Senator Ron Wyden wrote a letter to the Department of Justice claiming that foreign officials are requesting data from Google and Apple. This letter exposes another way for governments to monitor smartphones.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Most apps use push notifications to inform smartphone users about new messages, news, or updates. These notifications can be sounds or visual signals that inform users about new emails or their team’s victory. What users may not know is that these notifications are usually sent through Google and Apple’s servers.
Wyden said that the two companies have special knowledge about the traffic between the apps and their users. This allows them to help the government monitor how users are using specific apps. Wyden asked the Department of Justice to change any policies that prevent public discussions about push notification spying.
In a statement, Apple said that Wyden’s letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.
“In this case, the federal government prohibited us from sharing any information,” the company said in a statement. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”
Google said that it shared Wyden’s “commitment to keeping users informed about these requests.”
The Department of Justice chose not to comment on the push notification surveillance or any potential restrictions on Apple or Google discussing it.
Wyden received a letter mentioning a “tip” as the source of surveillance information. The letter did not provide more details about the tip, but a source familiar with the situation confirmed that both foreign and US government agencies have been requesting metadata from Apple and Google. This data is related to push notifications and is used to connect anonymous messaging app users to specific Apple or Google accounts.
The source didn’t say which foreign governments made the requests, but mentioned that they are democracies that support the United States.
The source said they did not know how long such information had been gathered in that way.
Users often overlook push notifications, but technologists have raised concerns about the challenges in deploying them without sharing data with Google or Apple.
French developer David Libeau is worried about users and developers not being aware of how apps send data through push notifications to big US tech companies. He called this a “privacy nightmare”.
