Who's Hacking Their Phones?

A new phone hacking scandal has erupted, but it's not about stolen nude photos this time. Hacked cell phones belonging to protestors in Hong Kong may be providing the Chinese government with information about their whereabouts, finances and more, Lacoon Mobile Security told The New York Times Tuesday. The protestor's cell phones are apparently being hacked by having downloaded an app which claims to provide updates about the protest, but actually monitors protesters’ communications.

The app was allegedly sent to the protesters, who have been occupying major roadways to protest for democracy over the past six days, via mobile messenger WhatsApp. The app was apparently distributed in a message saying, "“Check out this Android app designed by Code4HK for the coordination of OCCUPY CENTRAL!” The text was accompanied by a download link, which allowed the spyware to infiltrate the user's phone once clicked.

According to a statement from Lacoon, the cross-platform (affecting Droid and Apple iOS) app may be operated by a Chinese-speaking entity to spy on, "individuals, foreign companies or even entire governments."

The Lacoon Mobile Security research team has discovered a new mRAT it calls “Xsser mRAT.” The Xsser mRAT specifically targets iOS devices, and is related to Android spyware already distributed broadly in Hong Kong.

A link to the Android spyware, disguised as an app to help coordinate Occupy Central protests in Hong Kong, was sent as an anonymous message to Whatsapp users there on Thursday. In its investigation of that spyware, Lacoon uncovered the Xsser mRAT hosted on the same Command and Control (CnC) domain with the project being named Xsser. Though called Xsser, this is not related to an XSS attack.

After someone downloads the app, it can access personal data, listen in on calls, read text messages and track the physical location of the phone.

The Chinese government has yet to release a statement regarding the hack. The only thing protestors can do at this point is hope they haven't already been hacked, and take steps to prevent being hacked in the future.

Unfortunately, this isn't the first time a government has used phone hacking against its citizens — cough, the Unites States. The NSA has developed the ability to decode encrypted cellphone conversations (unless you have an iPhone 6). It's not alone;: The Ethiopian government has used surveillance tech to hack into the computers of journalists in the United States and Europe. Russia spied on Americans' cell phone activity during the 2014 Sochi Olympics. The list is endless.

The difference between China's tactics and the countries listed above? China is using their technology to personally victimize their citizens and cut them off from the outside world. It's not just surveillance, it's a full-on intrusion into civilians' lives.

The threat of having one's phone hacked by the government, along with your garden-variety phone hackers, can make the digital world a scary place for everyone (especially, especially, especially women). While it can't totally be avoided, there are steps everyone can and probably take to protect their mobile security. Some tips:

• Don't download anything sent via a suspicious text message.

• Don't store financial information on your phone.

• Don't sign into insecure Bluetooth networks.

• Make sure your Bluetooth is off when you aren't using it.

• Delete your browsing history.

• Try to change your passwords every once in a while.

Images: Getty Images