Google: Spyware vendors are driving zero-day exploitation

Packaged exploits, services

The report emphasized the infrastructure CSVs provide to customers in addition to just selling spyware. CSVs offer technical expertise, develop exploit chains to deliver malware and help maintain persistence on the target's device. In addition to the CSVs themselves, the spyware market is composed of vulnerability researchers who find and sell zero-day flaws, exploit developers and brokers who weaponize those flaws, and government customers that purchase the finished spyware products.

TAG said CSVs pose a risk to users like any threat actor. Researchers attribute most of the zero-days they discover to CSVs. Unlike cybercriminals, though, they operate openly.

"Third, if governments ever had a monopoly on the most sophisticated capabilities, that era is certainly over. The private sector is now responsible for a significant portion of the most sophisticated tools we detect," the report read. "In 2023, TAG discovered 25 0-days being actively exploited in-the-wild, 20 of which were exploited by CSVs."

TAG researchers discovered 72 in-the-wild zero-day exploits between mid-2014 and 2023; they attributed 35 of them to CSVs. TAG estimates the number is likely even higher and noted how CSVs have accelerated efforts to develop their own zero-day exploits. For example, researchers uncovered 53 zero-day exploits between 2019 and 2023, and 33 were developed by CSVs.

While the fight often favors CSVs, vulnerability researchers are fighting back.

"Exploit chains are expensive and hard to develop. Each time Google and fellow security researchers discover and disclose new bugs, it causes friction for CSVs and costs them development cycles," the report read.

The exploits typically affect Google's Android OS and Chrome web browser. TAG noted the spyware industry is particularly focused on targeting mobile devices, and customers can spy on multiple devices simultaneously for a hefty price. The report highlighted a pricing model for Intellexa's Nova system.

"For €8 million the customer receives the capability to use a remote 1-click exploit chain to install spyware implants on Android and iOS devices, with the ability to run 10 concurrent spyware implants at any one time," the report said.

It's clear CSVs are adept at hacking mobile devices. But TAG said new mitigations developed by vendors like Apple have stopped some exploits, if only temporarily. The report also emphasized CSVs' ability to adapt to such defenses and develop new exploits.

Can CSVs be stopped?

Though TAG said combatting spyware abuse requires sustained government regulation and policies, recent sanctions have yet to shut CSVs down. One prime example is NSO, which was sanctioned by the U.S. and EU in 2021 but continues to operate.

While investigating the device of a civil service organization in Washington, D.C. in September, Citizen Lab discovered a zero-click, zero-day exploit it dubbed "BlastPass." he exploit chain involved two Apple vulnerabilities and was used to deliver NSO Group's Pegasus spyware.

TAG discovered NSO activity even more recently. On Dec. 20, Google disclosed a heap-based buffer overflow vulnerability, tracked as CVE-2023-7204, that was being exploited in the wild against web browsers.

In Tuesday's report, TAG revealed the vulnerability's connection to spyware, though the target is unknown.

"In December 2023, TAG discovered a Chrome 0-day, CVE-2023-7204, used by an NSO customer," the report read.

Despite NSO Group's persistence, TAG applauded the U.S. sanctions imposed against the vendor as well as against Intellexa and another Israel-based CSV, Candira. However, TAG called for more sanctions that limit CSVs ability to operate or make money in the U.S.

The TAG report followed a new U.S. State Department policy announced on Monday to further address the threat of spyware. The policy imposes visa restrictions on individuals "involved in the misuse of commercial spyware."

Transparency was another important factor TAG petitioned for to hinder CSVs. Google researchers called on the government to "foster greater transparency" by setting requirements for the domestic surveillance industry and being more forthcoming regarding spyware it uses.

"The harms from this industry are amply evident by this point, and we believe they outweigh any benefit to continued use."

Arielle Waldman is a Boston-based reporter covering enterprise security news.