U.S. SPIES USED CYBER WEAPON TO HELP UAE HACK ITS FOES.
CYBER TOOL SPIES ON FOES THROUGH THEIR iPHONES
Ateam of former U.S. government intelligence operatives working for the United Arab Emirates hacked into the iPhones of activists, diplomats and rival foreign leaders with the help of a sophisticated spying tool called Karma, in a campaign that shows how potent cyber-weapons are proliferating beyond the world’s superpowers and into the hands of smaller nations.
The cyber tool allowed the small Gulf country to monitor hundreds of targets beginning in 2016, from the Emir of Qatar and a senior Turkish official to a Nobel Peace laureate human-rights activist in Yemen, according to five former operatives and program documents reviewed by Reuters.
Karma was used by an offensive cyber operations unit in Abu Dhabi comprised of Emirati security officials and former American intelligence operatives working as contractors for the UAE’s intelligence services.
The hacking unit was code-named Project Raven.
The ex-Raven operatives described Karma as a tool that could remotely grant access to iPhones simply by uploading phone numbers or email accounts into an automated targeting system. The tool has limits — it doesn’t work on Android devices and doesn’t intercept phone calls. But it was unusually potent because, unlike many exploits, Karma did not require a target to click on a link sent to an iPhone, they said.
In 2016 and 2017, Karma was used to obtain photos, emails, text messages and location information from targets’ iPhones. It also helped the hackers harvest saved passwords, which could be used for other intrusions.
It isn’t clear whether the Karma hack remains in use. The former operatives said that by the end of 2017, security updates to Apple’s iPhone software had made Karma far less effective.
Lori Stroud, a former Raven operative who also previously worked at the U.S. National Security Agency, told Reuters of the excitement when Karma was introduced in 2016. “It was like, ‘We have this great new exploit that we just bought. Get us a huge list of targets that have iPhones now,’” she said. “It was like Christmas.”
The disclosure of Karma and the Raven unit comes amid an escalating cyber arms race, with rivals such as Qatar, Saudi Arabia and the UAE competing for the most sophisticated hacking tools and personnel.
Tools like Karma, which can exploit hundreds of iPhones simultaneously, capturing their location data, photos and messages, are particularly sought-after, veterans of cyberwarfare say. Only about 10 nations, such as Russia, China and the United States and its closest allies, are thought to be capable of developing such weapons, said Michael Daniel, a former White House cybersecurity czar.
Karma and similar tools make personal devices like iPhones the “juiciest of targets,” said Patrick Wardle, a former National Security Agency researcher and Apple security expert.
Apple declined to comment.
The former Raven insiders said Karma allowed the operatives to gather information on scores of targets — from activists critical of the government to regional rivals, including Qatar, and the UAE’s ideological opponent, the Islamist political Muslim Brotherhood movement.
It also granted them access to compromising and at times sexually explicit photos of targets.
Three former operatives said they understood Karma to rely, at least in part, on a flaw in Apple’s messaging system, iMessage. They said the flaw allowed for the implantation of malware on the phone through iMessage, even if the phone’s owner didn’t use the iMessage program, enabling the hackers to establish a connection with the device.
In 2017, the operatives used Karma to hack an iPhone used by Qatar’s Emir Sheikh Tamim bin Hamad alThani, as well as the devices of Turkey’s former deputy prime minister Mehmet Simsek, and Oman’s head of foreign affairs, Yusuf bin Alawi bin Abdullah. It isn’t clear what material was taken from their devices.
Raven also hacked Tawakkol Karman, a human-rights activist known as the Iron Woman of Yemen. She said she believes she was chosen because of her leadership in Yemen’s Arab Spring protests. She said he was shocked. Americans are “expected to support the protection of human rights defenders and provide them with all protection and security means and tools,” she said, “not to be a tool in the hands of tyrannies to spy on the activists and to enable them to oppress their peoples.”