Apple spyware alerts: Germany's BSI advises swapping work phones
Since 29 October Apple has been warning users, including members of the Bundestag, of commercial spyware; Germany's BSI advises them to treat their iPhones as compromised.
The warnings reach beyond politicians and show that targeted spyware is a tool against decision-makers of every kind. For high-risk users the BSI recommends replacing the device, not merely updating it.
What happened
According to Germany's Federal Office for Information Security (BSI), Apple's threat notifications have been reaching iPhones since 29 October. Apple is warning of so-called mercenary spyware: surveillance software from commercial vendors, aimed at specific individuals. It names neither a vulnerability nor an attacker. On 30 October the BSI wrote to members of the Bundestag. Karsten Wildberger, the digital minister, confirmed on ARD, a public broadcaster, on 1 November that MPs and members of the federal government had been warned, without naming them. The BSI says those affected should assume their device may have been compromised. It advises updating the operating system immediately unless a forensic analysis is planned, enabling Lockdown Mode and, where the risk is high, replacing the device, resetting accounts and changing the phone number. It also recommends a new passcode, new passwords for the Apple account and e-mail, and two-factor protection on messaging apps. How many countries are affected is unconfirmed; one recipient cited 99.
What follows
For companies the case is a template. Any firm employing executives, negotiators or staff with access to sensitive data needs a procedure for such warnings: someone to check that a notice is genuine, spare devices, and a decision on when to preserve forensic evidence before an update erases traces. If work phones must be replaced and numbers changed, costs and downtime follow. Assessment: fake warnings are a known phishing lure; genuine Apple notices arrive in the Apple account and by e-mail, without links to third-party sites.
What changes in practice
- Affected users
- The BSI advises treating the iPhone as compromised, using Lockdown Mode and changing passwords.
- Companies
- Executives with sensitive access need a procedure: verify the notice, a spare device, forensic preservation.
- IT departments
- For high-risk cases the BSI recommends a new device and number, which ties up budget and time.
What to watch
- Whether Apple or the BSI disclose more on scale and attackers
- Whether other countries or companies report recipients
- New iOS security updates in the coming weeks
Sources
- Security Affairs: Apple's spyware notifications reach the Bundestag: what the BSI says to do now
- All About Security: Apple-Warnung vor Spyware, BSI informiert Bundestagsabgeordnete
- BSI: Empfehlungen zu Apple Mercenary Spyware