Australian diplomatic security has been compromised after the Pakistani military allegedly hacked mobile phones using spyware. The breach also involved diplomats from the US and Britain.
The hack allowed the military to track the movements of Pakistan-based Australian diplomats travelling to Balochistan and its capital, Quetta, according to US-based IT security company Lookout, which uncovered the breach.
Lookout uncovered the hacking in January and yesterday warned there may be other data breaches involving the Australian diplomats because only a small amount of compromised material had been analysed.
Lookout’s head of threat intelligence, Michael Flossman, a former Australian Defence Department employee, yesterday said Australian law enforcement authorities had been alerted to the breach that also involved diplomats from Britain and the US.
Lookout uncovered the breaches after detecting two “surveillanceware” tools it named Stealth Mango and Tangelo, which appeared to have been implanted on mobile phones belonging to people in Pakistan, Afghanistan, India, Iraq and the United Arab Emirates.
It says the surveillanceware appeared to have code similarities to spyware known as “Theonespy” sold by a company called Ox-i-Gen, which appeared to list an address in Sydney’s CBD. “While Ox-i-Gen has its headquarters in Sydney, Australia, most of the connected employees on LinkedIn that work for Ox-i-Gen are located in Lahore, Pakistan.’’
Lookout published examples of the hacked material including what appears to be a government of Pakistan itinerary for Australian diplomats from Islamabad.
The document listed the diplomats’ intended destination, their names that were redacted by Lookout, the method of travel and the purpose of the visit. Information relating to the diplomats’ protection was also disclosed.
Lookout said the surveillanceware had retrieved sensitive data from individuals and groups in the US, Australia and Britain. The data included text messages, contact details, geolocation data, audio recordings, photos and videos from victims’ devices.
Surveillance in Balochistan
The incident confirms claims of Baloch political and human rights campaign groups who have been alleging Pakistani intelligence agencies of mass digital surveillance in Balochistan for many years now.
Balochistan, where more than 20,000 political activists are under incommunicado detention, has seen a surge in intelligence gathering activities since a political movement for a ‘free homeland’ began in early 2000s.
Campaigners for digital rights have documented many cases of hackers targeting political activists and human rights defenders through malware.
“Human rights defenders in Pakistan are under threat from a targeted campaign of digital attacks, which has seen social media accounts hacked and computers and mobile phones infected with spyware,” a four-month investigation by Amnesty International revealed last week.
Faiz Baloch, one of the most active Baloch social media activists, told The Balochistan Post that the incident, though concerning, is not very surprising.
“One can imagine how sophisticated these hacking schemes are if they can easily breach the foolproof security of foreign diplomats including from countries like the US, Britian and Australia,” the Irish-based Baloch activist said.
He added that it also throws light on the boldness of Pakistani military which it is due to the impunity warranted through international silence.
“If this could happen with foreign diplomats, it is easy to decipher how Baloch activists are targeted”, he said.
Faiz Baloch told TBP that social media accounts of many of his colleagues have been hacked. “Many have subsequently been arrested and disappeared by Pakistani authorities,” he alleged.