Protecting Against Spyware

We recommend going through the steps outlined in our Digital Security Essentials checklist →

Many of these steps will help protect you against spyware.

The two most important things you can do to protect against spyware are (both outlined in the checklist linked above):

• Keep your device operating system up to date (never press "update later"!)

• Do not click suspicious links. Especially if they are from people you don't know or seem urgent/scary.

All software contains bugs, which are errors or flaws that can lead to various issues.

Mercenary spyware is an extremely advanced attack, exploiting sophisticated vulnerabilities on our devices. In response, Apple and Google have introduced an advanced security mode that offers enhanced protection against spyware.

On iPhones, it's called Lockdown Mode and on Android, it's called Advanced Protection Program. (You can also enabled Advanced Protection Program on just your Google Account even if you don't have an Android phone.)

We have no reports of anyone getting infected with spyware who had Apple's Lockdown Mode enabled. Android's Advanced Protection is more recent and its effectiveness has yet to be tested.

Usability trade-offs

For anyone worried about targeted attacks, these usability trade-offs will likely be worth the big increase in security.

iPhone Lockdown Mode: Features that will be harder to use

• No clickable links in messages (mainly within iMessage) - Links show as raw URLs and don't work (i.e. are not instantly clickable). You have to copy-paste them manually to a browser. This encourages you to make sure they are safe before doing so, since spyware often arrives through a text which includes a link custom-designed to be impossible-to-ignore for you in particular.

• Most message attachments blocked (also mainly within iMessage) - When receiving PDFs, documents, Office files, contacts, location over iMessage, you might not be able to view them normally and iMessage will indicate "1 attachment." This is because some spyware can be delivered through malicious attachments.

• FaceTime calls from unknown contacts blocked - Lockdown Mode will block call attempts from unknown contacts or people you have not been in touch with in the last 30 days. You will be notified if this user attempts to FaceTime you and you can decide to call back if the call attempt is genuine.

• Web fonts don't load - Websites appear with system fonts only, often looks weird.

• Images may not display - Some images show as missing image icons.

• Interactive webpage elements fail - Complex web features, animations, dynamic content often broken.

• iCloud Shared Albums don't work as expected - When you share photos in a shared album, location information is excluded. Shared Album invitations might be blocked too.

• Device won't connect to any WiFi automatically - On Lockdown Mode your phone won't connect to insecure WiFi's automatically and you will need to manually connect to the chosen network and accept the security risk.

• 2G or 3G support is turned off - If you find yourself in a location with 2G or 3G cellular network with Lockdown Mode, your phone will simply not connect (as 2G / 3G is more insecure than 4G / 5G).

Learn more about Apple's Lockdown Mode.

Google/Android Advanced Protection Program:

• Security key required - Must use security key/passkey for every new device sign-in to Google Account, which can take some getting used to

• JavaScript optimizer disabled (Chrome) - Some complex websites may not work properly.

• No sideloading - Can't install apps from outside Play Store or verified stores.

• USB locked when device locked - Must unlock device before connecting USB accessories.

• Insecure Wi-Fi blocked - Won't auto-connect to open/WEP Wi-Fi networks.

• Enhanced Safe Browsing warnings - More download warnings and potential blocks.

• Fast charging might not work as expected - You might need to unlock the phone in order to

Learn more about Android Advanced Protection Program.

Several services offer additional security features to protect against targeted attacks on your accounts. These protect your online accounts with each company, not the device itself, but can still be useful in defending against spyware.

Spyware often arrives through a text or email with a link custom-designed to feel impossible-to-ignore specifically for you. These aren't random spam - they're personalized attacks that exploit what matters most to you.

Spyware messages can be highly targeted. Here are some real-world examples of how Pegasus Spyware has been deployed:

"Dear Carmen my brother died in an accident, I’m devastated, I send you the information about the funeral, I hope you can come: [spyware link]" (source)

USEMBASSY.GOV/ WE DETECTED A PROBLEM WITH YOUR VISA PLEASE GO PROMPTLY TO THE EMBASSY. SEE DETAILS [spyware link] (source)

LX 1955 BCN-ZRH 26Jun2020 - Click on the link to receive your mobile boarding pass [spyware link] (source)

Be aware: Some spyware is deployed using exploits that don't require you clicking a link at all ("zero click exploits"). These might show up as missed calls on WhatsApp, for example.

If you want to make it tougher for a thief to get into your home, one easy step is to cut down on the number of doors. On your device, each app acts as "door" to the outside world, exposing you to increased risk of attack. If the app has a bug or vulnerability, it makes your whole device vulnerable.

Examples of apps that have been used by spyware in the past:

• Apple HomeKit + FindMy + iMessage

• Apple Calendar

When you include a link in a message, it often generates a "link preview." Even though you can't see it, your device is visiting that webpage to extract the correct preview image. If the webpage is malicious, a sophisticated attacker can identify your location or in extreme cases, implant spyware on your phone.

If you were infected by spyware already, it can perform live surveillance on your device, accessing the camera and microphone. To limit what spies can see, it's a good idea to cover at least your front camera.

If it fits your workflow, consider setting up a second phone just for your higher-risk work.

Check our Secondary Phone Checklist for more on this.

If you do this, make sure you still take security precautions on all devices. Even though only one device has sensitive communications/data on it, both devices could be a target for spyware since they reveal your location and other personal information an attacker might want.

We can't be certain whether spyware can survive a reboot (i.e. a restart), as this varies depending on the type of spyware and its license. However, restarting is a costless action that may complicate the efforts of the surveilling party to continue spying on you.

If reboots do indeed disrupt the spyware, the actor attempting to spy on your device would need to reinfect your phone.