With claims of C.I.A. hacking, how to protect your devices

WikiLeaks this week published a trove of documents that appears to detail how the Central Intelligence Agency successfully hacked a wide variety of tech products, including iPhones, Android devices, Wi-Fi routers and Samsung televisions. That’s just about every major category of consumer electronics. So what does that mean for you if you own one — or several — of these gadgets? For many people, it may mean nothing at all. The thousands of pages of documents refer to programs that attacked outdated versions of the software systems running on devices, and many security vulnerabilities have since been patched. On the other hand, many people may still use outdated software on their devices. And although the C.I.A. designed these tools to spy on terrorists, the hacking tools may have ended up in the hands of a whole range of entities. The fallout may also end up being broader. WikiLeaks, which released documents covering 2013 to 2016, has said its initial publication was just the first installment in a bigger cache of secret C.I.A. material. So even if you aren’t worried about what WikiLeaks revealed about the C.I.A. right now for yourself, here are some tips for protecting your cellphones, televisions and internet routers. What you can do if you’re on Android Hundreds of millions of Android users still use devices based on older versions of the Google-made mobile operating system. The WikiLeaks document collection, which includes 7,818 web pages and 943 attachments, showed that the Android devices targeted by the hacking programs were mostly running a version of Android 4.0. Today, about 30 percent of Android users, or at least 420 million people, are on a variant of Android 4.0, according to Google. The company said it was investigating reports of the security issues described in the WikiLeaks documents. With the limited information we have now, the best thing people can do is to stop procrastinating on updating their software. “The one thing that people can and should be doing is keeping their apps and phones as up-to-date as possible,” said Kurt Opsahl, deputy executive director for the Electronic Frontier Foundation, a digital rights nonprofit. For owners of older devices, getting the latest software updates may not be easy. Many older Android handsets, like the Samsung Galaxy S3, are unable to download the latest version of the Android software. If you are in that boat, it’s a good time to purchase a new smartphone — such as the Google Pixel — which is running the latest Android software. Other than ensuring that you have the latest operating system, Google recommends that Android users protect their devices with lock screens and PIN codes, and to enable a setting called Verify Apps, which scans apps downloaded from outside of Google’s app store for malware. What you can do on an iPhone Many iPhone owners are far more up-to-date with their mobile software than Android device owners. So only a minority of iPhone users have devices with the versions of the Apple iOS operating system that the WikiLeaks documents mention. Specifically, the WikiLeaks documents referred to exploits working on versions of iOS up to 8.2. About 79 percent of Apple users are running iOS 10, the latest version of the system, and only 5 percent are running a version older than iOS 9, according to Apple. In raw numbers, with more than one billion iOS devices sold worldwide, that amounts to at least 50 million people running the outdated software. For those worried about their iPhone security, the advice is generally the same here as for Android owners: iPhone and iPad users should make sure to be running the latest operating system, iOS 10. Apple said on Tuesday that many of the security issues described in the WikiLeaks documents had already been patched in the latest version of its software and that it was working to address remaining vulnerabilities. Not all Apple devices can get the latest operating system. Apple’s iOS 10 is compatible with iPhones as far back as the iPhone 5 released in 2012, and with iPads as old as the iPad Air and iPad Mini 2 released in 2013. If you are using anything older than those, it’s a good time to buy a new device for the stronger security. What you can do with your Samsung TV With Samsung televisions, the situation is less clear. The documents mentioned programs attacking smart TVs in Samsung’s F8000 series, which include microphones for voice controls. Samsung said it was looking into the WikiLeaks reports, and noted that software updates with the latest security enhancements are automatically downloaded on its televisions. The company did not immediately comment on whether any vulnerabilities had been patched. The documents published by WikiLeaks disclosed that a tool called Weeping Angel puts the target TV in a “fake off” mode. Then, with the owner believing the TV is turned off, the set secretly records conversations in the room and sends them over the internet to a C.I.A. server computer. Smart TVs are part of a proliferating category of “internet of things” devices that have raised security concerns because many of the companies that make them do not have strong backgrounds in information security. In a recent column I wrote about defending a smart home from cyberattacks, experts recommended strengthening Wi-Fi settings and regularly auditing smart home devices for software updates, among other tips. That advice might not be sufficient for addressing privacy concerns around Samsung’s smart TVs, because the Weeping Angel hack continues to control the television even when it appears to be turned off. Craig Spiezle, executive director of the Online Trust Alliance, a nonprofit privacy group, said the WikiLeaks revelations could spur action that he sees as lacking from makers of connected devices. “I see this as a wake-up call for the industry to build better security and for consumers of these devices to rethink what they have and, in some cases, disconnect their connectivity,” Mr. Spiezle said. What to do with your router The WikiLeaks documents also described methods of injecting malware into routers offered by Asian manufacturers like Huawei, ZTE and Mercury. In general, it is wise for everyone to regularly check routers for so-called firmware updates to make sure they get the latest security enhancements. Depending on which router you own, downloading the latest firmware update isn’t very intuitive because it usually requires logging into the router. More modern routers like Eero and Google Wifi include mobile apps that help you download the latest updates automatically, so consider one of those if you are worried. What to do with your computer The WikiLeaks documents mentioned attacks on Linux, Windows and Apple computers. Personal computers have always been the most vulnerable devices we own, so this tip is fairly obvious: Make sure to install the latest operating system updates and use antivirus software. And as always, stay on guard for suspicious websites that may be serving malware. Agencies

Latest News

With claims of C.I.A. hacking, how to protect your devices