Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Tracking & Law Enforcement

Popular Mideast App Pulled After Report it Was Spying Tool

A popular mobile application developed in the United Arab Emirates has been removed from both Apple and Google’s online marketplaces following a report it was used for widespread government spying.

A popular mobile application developed in the United Arab Emirates has been removed from both Apple and Google’s online marketplaces following a report it was used for widespread government spying.

The moves come after The New York Times reported Saturday the app ToTok allowed the UAE government to track the conversations, movements, and other details of people who installed it on their phone.

Apple told AFP that ToTok was removed from its App Store pending a review, while Google said it was taken down from the Play Store “for a policy issue.”

The Times reported that ToTok, used by millions in the UAE and the surrounding region, had been designed to look like an easy and secure way to send messages and videos in countries where other services are banned.

The report said US intelligence officials and a security researcher determined the app was being used by the UAE government for detailed surveillance.

Security researcher Patrick Wardle, who assisted the newspaper, said in a blog post that ToTok appears to be part of a “mass surveillance operation” which “likely afforded in-depth insight in a large percentage of the country’s population.”

Wardle said the app became popular by offering free calling and messaging to users where services such as Skype and WhatsApp are blocked, and that it was also promoted by what appear to be fake reviews.

Wardle said ToTok appears to trick users of iPhones and Android devices into handing over access to their location and private data on their devices.

“You have access to users’ address books, chats, location and more, in a completely ‘legitimate,’ Apple-approved manner!” the researcher wrote.

He likened ToTok’s data collection to that of the US National Security Agency’s “bulk collection” of metadata, only deeper.

“Once you know who’s talking to whom, and perhaps even what they are saying, you can identify specific individuals of interest and target them with more advanced capabilities,” he said.

According to the Times, the app launched this year was developed by Breej Holding, which the newspaper said is likely a “front company” affiliated with DarkMatter, an Abu Dhabi-based cyberintelligence and hacking firm.

In a blog post Monday, ToTok said nothing of the spying allegations but noted that the messaging app was “temporarily unavailable” in the Android and Apple marketplaces “due to a technical issue.”

“While the existing ToTok users continue to enjoy our service without interruption, we would like to inform our new users that we are well engaged with Google and Apple to address the issue,” the statement said, while adding that the app is also available from its own website and from marketplaces by smartphone makers Samsung, Huawei, Xiaomi and Oppo.

Written By

AFP 2023

Click to comment

Expert Insights

Related Content

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Ransomware

US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...

Ransomware

The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Cybercrime

The owner of China-based cryptocurrency exchange Bitzlato was arrested in Miami along with five associates in Europe

Cybercrime

Russian Vladislav Klyushin made tens of millions of dollars by hacking into U.S. computer networks to steal insider information.

Cybercrime

A hacker who reportedly posed as the CEO of a financial institution claims to have obtained access to the more than 80,000-member database of...

Cyberwarfare

Google Project Zero has disclosed the details of three Samsung phone vulnerabilities that have been exploited by a spyware vendor since when they still...