NSA Vs. Your Smartphone: 5 Facts

9 Android Apps To Improve Security, Privacy

Is your smartphone a sitting duck for government intelligence agencies?

Fears about the security afforded by smartphones rose sharply over the weekend, after excerpts of documents leaked by National Security Agency whistle-blower Edward Snowden revealed that the agency has successfully retrieved data from a number of different makes and models of smartphones. A report published Saturday by Der Spiegel outlined some of those capabilities.

Smartphones are no doubt an attractive target for intelligence agencies. They store not just contact information -- useful for charting a target's social network -- but also photographs, bank account numbers, passwords as well as Web searches that provide insight into people's interests. On top of that, the devices carry a GPS chip that reveals a user's location, and a camera and microphone that could be remotely activated and surreptitiously used to eavesdrop on targets in real time.

[ Are tax dollars being used to spy on taxpayers? Read NSA Paid Tech Companies Millions For Prism. ]

Of course, the NSA already has numerous non-technological means, such as a subpoena, for obtaining access to desired systems that operate inside the United States. Beyond that, however, are NSA smartphone spying worries founded?

Here are five related facts about what's known about the NSA's capabilities:

1. NSA Working Groups Develop Exploits.

The leaked documents revealed that the NSA maintains working groups for each of the major smartphone brands, including not just iPhone, Android and BlackBerry but also Nokia, which has reportedly been the most popular device for accessing extremist forums.

All models of smartphones appear to be vulnerable to some types of surveillance. For example, NSA analysts were reportedly able to retrieve vast quantities of location data from iOS users. That changed with the introduction of iOS version 4.3.3, which restricted the amount of location information stored in memory to just seven days, reported Der Speigel. 2. BlackBerry Enterprise Server: Hackable.

According to the released documents, thanks to a discovery by British partner agency GCHQ, the NSA also has the ability to intercept BlackBerry text messages sent using BlackBerry Internet Service (BIS), which are networks operated by telecommunications providers. All BIS traffic is compressed, but not encrypted.

By contrast, many enterprises rely on BlackBerry Enterprise Server (BES), which encrypts all data in transit. But according to a leaked presentation -- titled "Your target is using a BlackBerry? Now what?" -- the NSA can also intercept BES traffic, although it requires a "sustained" operation on the part of the agency's Tailored Access Operation department to "fully prosecute your target." One Mexican government agency email included in the report suggests that the capability has been put to the test.

3. Malware Already Turned Smartphones Into Listening Stations.

Reports into the NSA's smartphone hacking capabilities came on the heels of reports that the NSA had weakened unnamed encryption systems. In the information security realm, was nothing sacred?

But the NSA's reported hacking capabilities aren't exactly news. Notably, the British-built FinFisher malware that's sold to governments can be used to monitor all forms of communication on devices that run Apple iOS, BlackBerry OS, Google Android and Nokia's Symbian platform as well as Windows Mobile. According to teardowns of the software, which has been actively used to target dissidents in autocratic regimes, the software also can perform "silent calls" that remotely activate the device's built-in microphone.

4. Criminals Were Already Infecting Smartphones Via PCs.

According to the Der Spiegel report, the NSA's favored technique for retrieving information from phones is to infect a PC that synchronizes with the device. Again, however, this isn't a revolutionary approach. Criminals have long been infecting PCs with malware that then load malware onto Android smartphones, typically to help gangs intercept one-time codes sent by banks to authorize account transfers.

5. Like Hackers, The NSA Can Jailbreak.

If the NSA can't grab what it needs via malware, it can simply root a targeted Android smartphone, or jailbreak an iPhone or iPad. "Jailbreaking is when hackers unlock phones like the iPhone so that they can install software Apple doesn't approve of," said Robert David Graham, CEO of Errata Security, in a blog post. "Every time somebody releases a jailbreak for the iPhone, the NSA quietly copies the jailbreak into their malware. Indeed, some researchers simply sell their jailbreaks to the NSA instead of releasing them to the public."

Learn more about BYOD, MDM and other topics by attending the Interop conference track on Mobility in New York from Sept. 30 to Oct. 4.