[HN Gopher] NSO Group iMessage Zero-Click Exploit Captured in th...
___________________________________________________________________
NSO Group iMessage Zero-Click Exploit Captured in the Wild
Author : jbegley
Score : 903 points
Date : 2021-09-13 20:04 UTC (1 days ago)
(HTM) web link (citizenlab.ca)
(TXT) w3m dump (citizenlab.ca)
| pat-jay wrote:
| Wow great work, thanks Citizen Lab! Everyone, please donate - we
| need this!
| defaulty wrote:
| This report says they discovered this in March.
|
| The NY Times [1] just reported that "Apple's security team has
| been working around the clock to develop a fix since Tuesday,
| after researchers at Citizen Lab, a cybersecurity watchdog
| organization at the University of Toronto, discovered that a
| Saudi activist's iPhone had been infected with spyware from NSO
| Group."
|
| What took so long? Did Apple not know about this in March or was
| someone sitting on it for 6 months?
|
| [1] https://www.nytimes.com/2021/09/13/technology/apple-
| software...
| robocat wrote:
| "Citizen Lab forwarded the artifacts to Apple on Tuesday
| September 7." -- from article, no need to jump to unwarranted
| conclusions about Apple. "In March 2021, we examined the phone
| of a Saudi activist" - it would be interesting to know the
| reason why Citizen Lab delayed so long. Hopefully they just
| wanted time to discover who else was being targeted?
| dezfuli wrote:
| > In March 2021, we examined the phone of a Saudi activist
| who has chosen to remain anonymous, and determined that they
| had been hacked with NSO Group's Pegasus spyware. During the
| course of the analysis we obtained an iTunes backup of the
| device.
|
| > Recent re-analysis of the backup yielded several files with
| the ".gif" extension in Library/SMS/Attachments that we
| determined were sent to the phone immediately before it was
| hacked with NSO Group's Pegasus spyware.
|
| Seems like they originally examined the phone in March, but
| recently did another analysis, during the course of which
| they discovered the exploit and reported it to Apple.
| badRNG wrote:
| I assume it takes time to go from "this person could have
| potentially been targeted with Pegasus" to "this person's
| iPhone was exploited by Pegasus, and here is how they did
| it."
| [deleted]
| stefan_ wrote:
| The easiest way for Apple to find Zero-Day exploits is presumably
| just to register an iPhone to some Saudi activist and regularly
| take memory dumps.
| avnigo wrote:
| You joke, but maybe one way to fight this proactively is with
| fake activist honeypots. Apple, a company with the size and
| budget of a nation state could certainly pull off such an
| operation for the security of the devices they sell, but
| obviously, and maybe unfortunately, this would never happen.
| [deleted]
| [deleted]
| fragmede wrote:
| That's actually where this particular knowledge came from.
| Citizen Lab dumped a Saudi activist's phone and told Apple what
| they found.
| 9935c101ab17a66 wrote:
| Morbid, but hilarious. Well done.
| Certified_moose wrote:
| I have always wondered. Let's say my iPhone is infected with this
| malware, and I update to the latest IOS. Will my iPhone be back
| to normal?
| mortenjorck wrote:
| Is there a reason why quarantining image attachments from unknown
| senders hasn't been standard industry practice ever since
| Stagefright?
| zionic wrote:
| Project managers like the pretty inline previews! Security?
| Pssh that's just for nerds.
| flixic wrote:
| Apple specifically introduced BlastDoor framework to combat
| this, so NSO shifted their attacks around decoding, avoiding
| BlastDoor.
| arsome wrote:
| Android 10 also introduced similar mitigations:
| https://android-developers.googleblog.com/2019/05/queue-
| hard...
|
| Though it's worth noting that the cost of Stagefright was
| surprisingly low - it took a long time for a good ASLR bypass
| to come out for it and by that time most devices were updated
| or replaced. Additionally, the sheer variance between Android
| devices means developing worm-level exploits becomes
| extremely difficult compared to something where everyone's
| running the exact same binary like Windows, so it likely only
| saw targeted use.
| notyourday wrote:
| Apple should know who works for NSO Group. It should block every
| single account of every single person working for that org. Same
| goes for their families.
|
| Google should do the same for Android.
|
| You do not fight organizations like that by fighting
| "organization". You make it very difficult for people who work
| for those organizations to participate in a society that relies
| on what they actively work on breaking. In fact, you tell Israeli
| government that unless they put a leash on its dog and lock it up
| in its backyard, you will start disabling accounts of every
| single person in Israeli government. When the government leaders
| cannot work their iphones, they will ensure that NSO does not
| touch Apple's products.
| nebula8804 wrote:
| 30 seconds later, a command comes down the chain from Israel to
| its lapdog: the US and then 5 seconds after that Tim Cook gets
| a call from his local congressperson stating that he is in
| violation of AB 2844 stating that you cannot discriminate
| against Israeli's
|
| [1]:https://iacforaction.org/in-support-of-the-anti-bds-
| ab-2844-...
|
| 1 second after that, the restriction is lifted.
| qaq wrote:
| which will accomplish exactly nothing same way as taking out
| Cartel leaders does not reduce the flow of drugs.
| notyourday wrote:
| Baby hackers that want go working for NSO want to have a high
| life. Modern high life requires modern communications
| devices. Blocking them from modern life (for example, vaccine
| passports done via iPhone and Android) will quickly lower the
| ranks.
|
| Blocking Israeli government officials from Google and Apple
| will _immediately_ solve NSO is an Israeli company that is
| cozy with the government and gets government protection
| problem.
|
| None of the NSO group's clients would want to pay for it via
| suitcases of cash. And in either event paying with suitcases
| of cash creates problems in the modern world for those that
| receive the suitcases of cash.
| qaq wrote:
| there is a wide range of exploit brokers and a decent
| number of security researchers that choose $ over morality
| as long as there is demand there will be supply.
| notyourday wrote:
| Don't let perfect to be the enemy of good. New broker
| pops up? Apply the same methodology.
|
| Apple is a trillion dollar company. Broker is a ant.
| Squash it.
| fortran77 wrote:
| The NSO Group is owned by Novalpina Capital, a British private
| Equity firm.
| notyourday wrote:
| NSO Group operates at the pleasure of Israel. If Israel says
| "jump" NSO Group is going to respond with "Would you like us
| to have our tongues out while we do it?"
| rodgerd wrote:
| > Apple should know who works for NSO Group. It should block
| every single account of every single person working for that
| org. Same goes for their families.
|
| NSO are suing Facebook - successfully so far - to force them to
| allow NSO staff access to Facebook when FB responded to NSO
| attacks by doing just that.
| notyourday wrote:
| Facebook was suing NSO about the hacks that NSO carried out.
|
| In this case Facebook, Apple, Google, etc should simply
| terminate the accounts exercising "we are deplatforming you.
| No explanation" option they all have.
| 5etho wrote:
| finally, there will go down 'apple privacy myth'
| q_andrew wrote:
| It seems like the NSO group is some kind of Hydra where every
| time their exploits are thwarted they find 2 new ones. The
| difference is that Hydras go for demigods while NSO products
| target civil servants and minorities.
| danicgross wrote:
| Would turning off iMessage protect from this? Or would the iPhone
| still process the GIF through SMS somehow...?
| aacook wrote:
| Great question. Every cell carrier processes images before
| delivering to the recipient. Like, if you send 3 or more photos
| almost every cell carrier will downsize the images. While this
| isn't an extensive test, I just tried renaming a PDF to a GIF
| and it failed to send on Google Voice and T-Mobile.
| onedognight wrote:
| You can disable MMS in Settings -> Messages
| -> MMS Messaging.
| SheinhardtWigCo wrote:
| Their high-confidence attribution to NSO Group is described as
| being based on two factors:
|
| 1. Incomplete deletion of evidence from a SQLite database, in the
| exact same manner observed in a previous Pegasus sample;
|
| 2. The presence of a new process with the same name as a process
| observed in a previous Pegasus sample.
|
| But isn't it likely that someone with the skills needed to
| discover and weaponize a chain of 0-day exploits, is incentivized
| and able to detect these quirks in Pegasus samples and imitate
| them, with the goal of misattribution?
|
| Of course, there may be more factors involved in the attribution
| that aren't being shared publicly.
| [deleted]
| Leparamour wrote:
| Since when do we assume misattribution in fingerprinting APTs?
|
| Crowdstrike will find out it's clearly Russia behind this and
| Mandiant will blame China.
| schleck8 wrote:
| It usually is the US, China or Russia though; the three have
| a large number of experts for this. And unless you find an
| error in the attribution processes, they are most of the time
| backed up by data that appears plausible, like a server or
| code fragment
| Hnrobert42 wrote:
| It seems like incomplete deletion of data is an error. If you
| are an exploit developer looking to throw investigators off
| your trail, it is one thing to name your processes with Pegasus
| names. It is another to deliberately introduce errors in your
| exploit to appear like Pegasus.
|
| Your proposal is possible. It is just less likely than that
| this exploit was developed by NSO Group.
| sharmin123 wrote:
| Things To Consider Before Hiring A Professional Hacker:
| https://www.hackerslist.co/things-to-consider-before-hiring-...
| throwawaydddsss wrote:
| i got a few of the pegasus texts from the sketchy gmail
| addresses, one was from way before the public even knew about it
|
| i'm a scrub at a random software company, i'm not a criminal by
| any means, maybe a bit paranoid (barely any online presence)
|
| anyone have a similar experience? or any advice or explanation as
| to why i'm so interesting?
| tsjq wrote:
| you have a similar number or username as their highvalue target
| ?
| verytrivial wrote:
| Image and video decoders seem like exactly the right target for
| formally verified (i.e. proven) implementations. There are just
| so many moving parts, and libraries get re-used in many projects,
| rarely forming the 'special sauce' in any given app.
|
| I have been keeping an eye on the work done by what is now called
| Project Everest[1] over the years in the communication and
| cryptographic space.
|
| Is there similar work in the image and video decode space? My
| seach fu is not yeilding anything beyond some hardware decoding
| proofs.
|
| [1] https://project-everest.github.io/
| DangerousPie wrote:
| Anybody know why there was such a delay here?
|
| > In March 2021, we examined the phone of a Saudi activist who
| has chosen to remain anonymous, and determined that they had been
| hacked with NSO Group's Pegasus spyware. During the course of the
| analysis we obtained an iTunes backup of the device.
|
| ...
|
| > Citizen Lab forwarded the artifacts to Apple on Tuesday,
| September 7. On Monday, September 13, Apple confirmed that the
| files included a zero-day exploit against iOS and MacOS.
| TonyTrapp wrote:
| This has been asked and discussed in this thread already:
| https://news.ycombinator.com/item?id=28516795
|
| In short: Just because they got access to the phone in March
| doesn't mean that they were already aware of the zero-day
| exploit back then. Finding this kind of stuff takes a while.
| willis936 wrote:
| We (the public) have known about FORCEDENTRY for 6 months.
| That time was spent analyzing and understanding the exploit.
| It does seem like a long time for such a public zero-click
| affecting 100s of millions of users.
| giarc wrote:
| I recently learned of this group through the Dark Net Diaries
| podcast. The host does a pretty good job of covering the NSO
| group in episode 99 and 100.
|
| https://darknetdiaries.com/episode/
| trangus_1985 wrote:
| If you're interested in infosec/appsec, DND is a great place to
| get started. The host packages up stories in a well put-
| together way, has no qualms about breaking to explain a concept
| or term, and does it all within an hour.
| adamgordonbell wrote:
| Those episodes were great!
|
| It sounded like NSO group just considers loosing zero days like
| this a cost of doing business.
|
| There seemed to be an implication that they have a war chest of
| these exploits and expect them to each get burnt after a
| certain amount of usage.
| bostik wrote:
| > _cost of doing business_
|
| That's exactly what it is. These companies buy, research and
| stockpile exploits, and keep a few always at ready for when
| the currently deployed ones get burned. All exploits have a
| shelf life, and the more widely one is used, the more likely
| it is to get caught.
|
| Because let's not forget: NSO and their ilk are _not_ in the
| business of developing exploits. That 's just their raw
| material. They are in the business of selling weapons-grade
| espionage and surveillance capabilities.
| drexlspivey wrote:
| They were paid $55m for a single contract with Saudi Arabia,
| this money alone are enough to buy you tons of 0-days
| hulitu wrote:
| Lets not be so journalistic. They have to pay also salaries
| and equipment.
| gitanovic wrote:
| The podcast also says that they have ~60 customers in 40
| countries... do your calculations.
| DSingularity wrote:
| I wonder what the US response would have been if the NSO
| group was an Iranian business.
| [deleted]
| Operyl wrote:
| I heavily recommend reading "This is How They Tell Me The World
| Ends" written by one of the guests he had in episode 98, Nicole
| Perlroth (which also touched a little on the NSO in that
| episode). She's The NY Times cybersecurity reporter. A lot of
| the book focused on the NSO, among others.
| malshe wrote:
| That book is fantastic and scary!
| badRNG wrote:
| This episode just came out last week, and this is the second
| time NSO has made news since it aired (along with Germany being
| a confirmed client.) Surprisingly apropos, but I imagine Jack's
| disappointed the big news makes it just after his episode's
| release on the subject.
| charlchi wrote:
| Someone remind me why Germany needs to be installing Israeli
| spyware onto citizens phones? We know this software's only
| purpose is to track down wrongthink and then murder
| dissidents.
|
| Massive blow to the integrity of European telecoms.
| Hackbraten wrote:
| Germany has comparably little domestic talent, partly
| because the Bundestag outlawed "hacking tools" in the 00s.
| fortran77 wrote:
| The NSO Group is owned by Novalpina Capital, a British
| private Equity firm. It's not really accurate to call it
| "Israeli Spyware"
| slim wrote:
| Who owns Novalpina Capital ?
| photochemsyn wrote:
| GuardianUK says:
|
| "The Guardian reported this year that hundreds of
| thousands of euros of Yana Peel's legal bills were
| expensed to the NSO Group by her husband - another move
| that apparently angered his partners.
|
| Stephen Peel's lawyers said at that time that the
| "manner" in which the legal fees were paid had been
| approved by Kowski and Lueken, and he strongly disputed
| the suggestion that the payment of the expense claims was
| a source of disagreement between the partners.
|
| Peel, Lueken and Kowski are all now involved in a legal
| dispute over the future ownership of the firm they
| created."
|
| https://www.theguardian.com/world/2021/jul/09/uk-
| financier-l...
| saagarjha wrote:
| Can you stop posting this bait in every single thread
| about the NSO? It's really annoying that you repeatedly
| drag people into shallow semantic arguments for dumb
| (nationalistic?) reasons: https://hn.algolia.com/?dateRan
| ge=all&page=0&prefix=true&que...
| hulitu wrote:
| Because they learned nothing from Gestapo and STASI.
| rocqua wrote:
| It might just be used with warrants for phones that are
| used by strongly suspected criminals.
| ehsankia wrote:
| The noteworthy angle/point the podcast covers is that NSO is
| very likely indirectly trying to dig dirt on citizenlab people
| (same people the post above is from) as they regularly discover
| their exploits and cost them money. As Jack talks about at the
| end, this puts NSO group into a whole other category if the
| above is indeed true.
| vjust wrote:
| I once worked in a 'dissident' org (supported by the US Agency
| for International Development) - these orgs were fighting for
| human rights in their countries. In one extreme case/country, my
| prospective project team mate, no one knew her real name (came to
| know this later), though she was our colleague, was quite social
| and pleasant. In her country's expatriate circles in DC, she was
| worried about foreign spies. Family back home is at risk, and so
| is she, even if she lives in DC. These are brave people.
|
| She wanted to build a database of something, and we were like,
| "keep your phone in another room" if you want to come discuss.
| Something that I am not sure she practices but more people need
| to practice.
|
| CitizenLab is doing yeoman's service for people's rights to
| privacy and human rights. They're heroes.
| [deleted]
| eynsham wrote:
| > supported by the US Agency for International Development
|
| Isn't it more usual for the NED to do such things? I remark
| upon this because it occurs to me that using USAID to do
| politics might make recipients suspicious of aid even when it's
| both necessary from a humanitarian perspective and unlikely to
| threaten the ruling dispensation in the recipient country.
| (This is a separate question from whether the NED/US government
| as a whole should even involve itself in such matters, to which
| my answer is 'maybe', since the dubious stuff probably happens
| anyway and lots of these civil society organisations &c.
| actually do good work [e.g. the The Assistance Association for
| Political Prisoners in Burma.])
| vjust wrote:
| True.. I was slightly inaccurate, This org. had various USG
| funders, with a large slice of funding from US-AID projects.
| Washington is full of these 'USAID contractors', some tiny
| others mega-sized. But _this_ project may have been funded by
| a division of US Dept of State that is focused on Human
| Rights - DRL. Not sure where the lines are about which one
| US-Aid gets and which one is State. For example development
| of journalism in an emerging country would be US-Aid. But
| OTOH, a project promoting free elections in the same country
| _could_ be State. Not sure.
|
| In any case, they span the range from benign to hostile
| nations, with varying risks attached. The "About" page for
| many such sensitive orgs would be silent on who the team was,
| except if it was Americans (like me) who didn't mind being
| their name out there (or nervously okayed the name being
| public).
| [deleted]
| abvdasker wrote:
| I'm glad you put "dissident" in quotes. USAID is notoriously
| rife with CIA plants and many CIA operatives use the
| organization as cover, which implies that a nation targeting
| its members would have a lot more justification than a
| homegrown activist. That USAID might be targeted by hackers is
| mostly a consequence of the US government's decision to use it
| as a front for clandestine operations overseas.
| viktorcode wrote:
| Regardless, they do help real dissidents. People, who are at
| risk in their home country as they are perceived to be a
| threat to their authoritarian government.
| photochemsyn wrote:
| I can't find any 'dissident USAID' outfit concerned about
| the fate of Julian Assange or Edward Snowden, however.
| Seems like 'human rights concerns' are highly conditional
| on the amount of money an repressive government invests in
| Wall Street.
| jonplackett wrote:
| Can someone explain like I'm 5 why it's so hard to prevent this?
|
| I mean with a messenger app, you know you're getting some payload
| of data from a specific place, that goes through your own server,
| and is only ever going to be text or picture or video.
|
| Why can't that be sufficiently sanitised en route and as it
| arrives to not have this kind of thing happen all the time?
| marcan_42 wrote:
| End to end encryption. The server doesn't get to see the data,
| so there is no chance to analyze/filter it on the way. All the
| parsing and sandboxing has to happen on user devices... and
| there's always one more bug left to exploit there, especially
| in a legacy codebase like iMessage.
|
| This is one of the unfortunate downsides of E2EE: there is no
| way to do server side security on message contents, so you rely
| entirely on endpoint security. For a non-E2EE service it would
| be trivial to scan for, collect, and more easily block
| exploitation attempts.
| jonplackett wrote:
| Hadn't thought about that! Thanks.
| UncleMeat wrote:
| The relevant applications are written in memory-unsafe
| languages. For an application of meaningful complexity, it is
| virtually impossible to actually write a safe program in C or
| C++ and even more impossible to maintain that safety. The code
| _doing_ the sanitization is itself attackable and the process
| of sanitizing complex media is very complicated.
| SilverRed wrote:
| Because the OS is too complicated, imessage is a legacy app
| which is deeply embeded in the OS. And often the exploits are
| in things like the notifications but imessage is the easiest
| way to deliver the data to any ios user.
|
| And people will flame me for this, but part of it is because
| the language iOS is written in allows these exploits to slip in
| easily and all over the place and the difficulty of stopping it
| is too great. There is a good reason Google has started
| migrating core components of Android to Rust and that the
| Google security team is pushing the effort for rust in Linux.
|
| The surface area for bugs becomes so much smaller when you can
| have a compiler eliminate whole classes of bugs.
| 2rsf wrote:
| The language might help the developers mitigate some issues
| but it is definitely not a solution the bad legacy code,
| mediocre development and test processes etc.
| seanieb wrote:
| In theory... Can you name a popular large project or
| product where memory safety issues have been overcome this
| way?
| 2rsf wrote:
| TBH you need to combine both, NASA uses safer languages
| and strict processes for example. Simply moving to
| another language might mitigate some possible issues but
| will definitely won't solve everything
| UncleMeat wrote:
| It isn't a panacea. Switching to Swift or Rust wouldn't
| prevent all vulns. But it would improve things. Modern
| code, strong developers, rigorous testing, static analysis,
| and fuzzing all make things better but they still
| consistently fail to enable developers to produce programs
| free of memory errors. This is true even for applications
| that have absolutely world class people doing these things.
|
| You need all of it. Language safety is only part of the
| path forward, but it is an _essential_ part.
| iJohnDoe wrote:
| Kind of interesting Apple reacted as quickly as they did. It
| usually takes a lot of effort to get Apple to acknowledge
| anything. Or maybe because they didn't request a bug bounty?
| [deleted]
| zaptrem wrote:
| Apple always responds quickly to large security issues?
| syntheticcorp wrote:
| It's because it is being exploited in the wild. Those bugs tend
| to get patched fast.
| badkitty99 wrote:
| And their angle on this "not being a big deal" is that it's
| only used on high profile targets, so they need to keep that
| front up to maintain their busy bottom line
| gitanovic wrote:
| Because you can jailbreak the phone with the vulnerability.
|
| And they don't want that :)
| tsjq wrote:
| why hasn't Apple fixed this?
|
| why doesn't apple sue such groups for violation of some EULA
| stuff ?
|
| why isn't Apple improving their security testing ?
|
| is Apple tacitly complicit with these ?
| hulitu wrote:
| Testing is hard. You need someone to understand the system. The
| problem with SW testing is that is mainly used to verify
| requirements, not to find defects. Also layers over layers of
| libraries does not help either (look how cool i am: instead of
| using libjpeg, libxpm and libpng i use imlib which links to
| those and introduces also its own bugs).
| r00fus wrote:
| Buried lede: Apple has patched that particular exploit [1] and
| everyone should download iOS14.8 now if you want to be protected
| (no doubt NSO has other tricks up their sleeve).
|
| Edit: Just realized it also impacts macOS and watchOS as well
| which were also patched. Patch Monday!
|
| [1] https://support.apple.com/en-ca/HT212807
| sneak wrote:
| Pretty soon the choice will be between:
|
| - vulnerable to the latest published exploits
|
| or
|
| - vulnerable to clientside scanning of your media for
| wrongthink by Apple for the CCP
|
| Smash that iOS update button and do your part for the party!
| samtheprogram wrote:
| The irony is that if you're not updated to the latest iOS,
| the easier (cheaper?) it is for the CCP to run surveillance
| exploits on your device a la the Uighurs.
|
| You can either trust Apple, or lose all security updates.
| Syonyk wrote:
| > _Pretty soon the choice will be between_
|
| What about "Don't use Apple products"? I know that Android is
| just as bad in many ways...
|
| And if all options in the modern tech industry basket of
| choice are terrible, well... humanity survived without them
| for an awfully long time.
|
| I've gone back to a flip phone from an iPhone. I no longer
| use Windows if I can at all avoid it (there exist a few
| sysadmin tasks involving netbooting Mikrotik devices for
| major OS updates that are far less painful on Windows than
| other OSes), and have no plans to let Win11 in my life. And
| Apple is heading out the door too. Throw in my dislike of
| Intel, and... yeah, it's getting pretty thin pickings. I
| still have an iPad with no accounts on it as a PDF reader,
| but I'd like to replace that with something else (Remarkable
| or such).
|
| "Agh, this is soooo terrible, but I'm going to keep using
| it!" just means, in practice, it's not that terrible.
| SilverRed wrote:
| Both Apple and Google scan your cloud synced files. Neither
| of them claim to scan your local only files. So the choice
| is rather pointless as they both hold the same position.
| lern_too_spel wrote:
| Android lets you use your own service with the same
| features as Google's or Apple's. iOS does not.
| SilverRed wrote:
| What do you mean by this? I use Google photos on my
| iphone and it seems to work perfectly fine. I'm assuming
| you are talking about background sync but I just checked
| via the web version and my photos from yesterday are all
| there so it seems that background activity is allowed
| while plugged in since I have not opened the g photos app
| in a while.
| novok wrote:
| Good for you, not good for %99.99 of the population. For
| nation states, that is mission accomplished! You never get
| %100 compliance with anything with large numbers.
| DemiGuru wrote:
| Not even flip phones are safe -
| https://therecord.media/malware-found-preinstalled-in-
| classi...
| fsflover wrote:
| > What about "Don't use Apple products"? I know that
| Android is just as bad in many ways...
|
| Time to consider GNU/Linux phones, Librem 5 and Pinephone.
| haswell wrote:
| > _" Agh, this is soooo terrible, but I'm going to keep
| using it!" just means, in practice, it's not that
| terrible._
|
| I don't think this is the only conclusion here.
|
| I think we should acknowledge just how central personal
| computing devices are in society in 2021. Sure, it's true
| that humanity survived without them, but at that time,
| societal norms were drastically different. Removing tech
| from daily life today can be crippling, and that's part of
| what makes some of these issues so terrible. They directly
| threaten our daily lives.
|
| I'd argue that it's possible for the thing to be "very
| terrible", and to conclude that it's still your only option
| to continue using the Apple/Google ecosystem.
|
| - Not all users have the financial means to switch. The
| iPhone they own is the one phone they'll buy for the next
| 3-4 years.
|
| - A growing number of users have _only_ an iDevice and no
| standalone PC. Couple this with #1, and things get even
| more difficult.
|
| - The utility afforded by the Apple ecosystem is high
| enough (or virtually required depending on one's job) that
| it outweighs the current set of downsides.
|
| If a corner store owner pays a weekly fee to the local gang
| "for protection", it doesn't necessarily follow that
| because the owner chooses to pay the fee, the extortion
| must not be soooo terrible.
| stefan_ wrote:
| Sounds like the buried lede here is that the biggest company in
| the world is having it's products actively being interfered
| with by a small shed in Israel run by war criminals. Presumably
| in this world in 2021 we have mechanisms other than finding
| their digital fingerprints to stop that.
| viktorcode wrote:
| Can you please elaborate why you think NSO group is run by
| war criminals?
| 2rsf wrote:
| And they don't work out of a small shed. But the metaphor
| is not that bad, those guys walk on the edge of the law
| probably passing to the wrong side more than once but never
| being caught
| detcader wrote:
| Imagine if it was a Russian shed
| grishka wrote:
| A shame there's apparently no update coming out for Mojave.
| pcdoodle wrote:
| So much for backwards compatibility. The last of MacOS to
| support 32bit apps...
|
| I wonder if running as a standard user would offer some form
| of protection.
| [deleted]
| nbzso wrote:
| So I have to update to protect my self from Pegasus/NSO and in
| the meantime to install next beta of CSAM scanner.
|
| Hmm. No. I Deleted all my apps and photos, using it as a phone
| and banking app terminal. Phone calls metadata is collected by
| governments by default, so I have no problem with this. I have
| nothing to hide, and nothing to store on Apple devices.
|
| Someone more paranoid than me, told me outrageous theory. Apple
| want's to take part of Pegasus spyware like market by providing a
| legal and user approved backdoor for governments trough CSAM. I
| don't believe it at all.:)
| pengaru wrote:
| > I have nothing to hide
|
| Don't underestimate the value of privacy. How much (or little)
| you have to hide is something worth hiding. It's what you do
| and don't know, do and don't say, do and don't communicate
| with, this is all important to keep private by default.
|
| There's a tendency for individuals to assume the role of would-
| be criminal in these discussions. It's more correct to assume
| criminals exist on all sides, do you have any interest in
| enabling a corrupt government to surveil its law-abiding
| citizens? When you don't have privacy, you enable potential
| criminals in power to see if the populace is aware of their
| actions, or absolutely distracted by instagram. We're all
| potential witnesses to crimes, and at this point it's
| exceedingly likely we'd communicate those observations via
| smartphones. We all require privacy and secure communications,
| full stop.
| nbzso wrote:
| It is sacracstic coment depicting the general state of
| things.
|
| Normalization of surveillance and acceptance of this "new
| world" from the genereal public trough manufactured consent
| by the corporations, media and governments is staggeringly
| fast.
|
| There is not subsitution for privacy, whatever the percieved
| motivation for "common good" is bringing to the table.
|
| My personal decision is to avoid the surrveilance state by
| using FOSS solutions and abandon smartphone habbits.
|
| There must be a place for design and software solutions
| outside the "status quo". Started this year by removing Apple
| from my business and moving along to educate my customers of
| incomming dangers for their businesess and personal life.
| pphysch wrote:
| This line of thinking is predicated on two assumptions:
|
| 1) That the local authorities are essentially malevolent
|
| 2) That it is only the individual's (privacy/security)
| measures that are deterring the malevolent authority from
| exploiting them
|
| For most Americans/Europeans, both of these assumptions are
| false and based in paranoid fantasies. Local authorities are
| rarely malevolent (though they may commonly be corrupt and
| excessively self-interested and not care about you), and it
| is virtually impossible for the average citizen to mount a
| home defense (real or cyber) against a committed state actor,
| or even local PD. It's like trying to secure a VM guest from
| access by the host machine; you're completely surrounded.
|
| I fully support protecting yourself & your privacy against
| petty criminals, but unilaterally taking on your government
| is frankly just a waste of life.
| gjs278 wrote:
| take your meds
| nebula8804 wrote:
| Is there any confirmation this new release has any CSAM scanner
| stuff in it?
| nbzso wrote:
| At tnis point in time I would not believe anything Apple is
| saying. After all backslash they just postponed it, to make
| it better and to avoid negative PR for the new iPhone.
|
| Traces of CSAM are found in iOS 14.3
| https://appleinsider.com/articles/21/08/18/apples-csam-
| detec...
| shapefrog wrote:
| > I would not believe anything Apple is saying
|
| Rather than spending all your time moaning about them, just
| dont use their devices. Nobody is holding a gun to your
| head forcing you to use an iphone.
| nbzso wrote:
| What a response. Apple moaned about privacy with years.
| Not me. Apple used big billboards all over the world with
| clear privacy message. Only to create biggest intrusion
| on user space circumventing 4th amendment by introducing
| scanning by third party private corporation criteria
| (funded by DOJ). Creating a precedent in which all
| governments will be able to snoop and classify. And I am
| "moaning". GTFO.
| shapefrog wrote:
| I guess it is true what they say about snowflakes.
| kevin_young wrote:
| There's a shocking number of pedophiles. Shame they lobbied
| so hard against keeping kids safe.
| m3kw9 wrote:
| Now that this is out, it won't be just NSO using it. Get it patch
| now.
| lgats wrote:
| cve withdrawn? https://cve.report/CVE-2021-30860
| i_r7al wrote:
| Anyone has context of why it was withdrawn?
| modshatereality wrote:
| It's a feature, not a bug.
| kome wrote:
| A public university doing wonderful work again state sponsored
| spyware. Thank you University of Toronto! You restore my faith in
| academia.
| United857 wrote:
| I miss the days when iOS exploits were merely used for jailbreaks
| and allowing alternative app stores, instead of being
| weaponized/monetized as they are now.
| 2rsf wrote:
| Were they? maybe we simply haven't heard about those
| phendrenad2 wrote:
| Ah nice, just parse incoming gifs in your iMessage with the same
| function that also parses PSDs. What could possibly go wrong?
| Gotta be DRY, my dude!
| Ms-J wrote:
| It is increasingly bizarre in my opinion how this company (and
| others like Toka) can run active terrorist operations, that if
| anyone else smaller was doing some of the same hacks they would
| be in prison for a very long time.
|
| People have lost their lives due to these pariahs!
|
| Israel already has a massive PR issue with other countries, it
| would do them well to reign in these offensive front arms of
| their government/'companies.'
|
| Citizen Labs is really a great thing for civilization. There are
| not enough altruistic organizations.
| stirlo wrote:
| > Israel already has a massive PR issue with other countries,
|
| But for these middle eastern countries Israel selling them
| exploits which allow them to spy on dissidents may actually
| improve relations by helping out regimes which would otherwise
| be sworn enemies of theirs...
| hulitu wrote:
| This is the world we're living in: kill a man, you're a
| murdered, kill 100 you're a hero.
| thinkharderdev wrote:
| Just finished reading https://www.amazon.com/This-They-Tell-
| World-Ends/dp/16355760... which is a great book about the zero-
| day market and how it evolved over the years.
|
| The basic issue is that every nation is actively buying and
| using zero-days and doesn't want to stop. And companies like
| NSO aren't really (so they say at least) hacking anybody. They
| just develop and license hacking tools to governments to use
| for "lawful" law enforcement purposes. So nobody wants to ban
| the zero-day market because every country is a huge buyer of
| zero-days themselves and it is hard to ban selling zero-days to
| sovereign governments who are using them in accordance with
| their own laws (even if the regimes in question are terrible
| and using them to violate their citizens basic human rights).
| After all, it would be a bit awkward for the US to demand that
| the NSO Group stop selling it's hacking tools to Saudi Arabia
| while we have a multi-billion dollar defense industry selling
| the Saudis all sorts of advanced weaponry.
| azernik wrote:
| This is the international arms trade. As long as you have state
| endorsement and aren't violating UN sanctions, there are zero
| consequences.
|
| And if you think this is in any way unusual, take a look at the
| places the US and China and France sell weapons to.
|
| Israel's specialties happen to be software exploits and EW
| equipment, but this isn't a deeply different interaction.
| jasonhansel wrote:
| Why is it that iOS's PDF implementation has been the source of so
| many different exploits? This seems to be a pattern.
| tediousdemise wrote:
| It's not just iOS. PDFs have always been an insecure attack
| vector.
| madeofpalk wrote:
| PDFs are hard and complicated?
| thinkharderdev wrote:
| PDF is basically a programming language, so instead of sending
| image data you send a program which is interpreted by the PDF
| reader to render an image on the client. That makes it really
| hard to secure completely.
| mr_toad wrote:
| Adobe Reader/Acrobat used to be go-to surface for exploits back
| in the day. It's a huge specification.
| julietdg wrote:
| In my Privacy settings on iOS, in Data/Analytics where the logs
| are- iPhone has had a Pegasus framework listed since my iOS 5s.
| saagarjha wrote:
| Pegasus is the codename for picture-in-picture (and also the
| Swift Playgrounds editor that now powers Xcode).
| TaylorAlexander wrote:
| It just makes me so uncomfortable that these things keep
| happening. We always find out about these things eventually but
| what percentage of the time are our devices vulnerable? Isn't it
| close to 100% of the time that our desktops and mobile devices
| have significant security vulnerabilities?
| r00fus wrote:
| Invulnerability for your devices is a chimera. You can only do
| what's possible in your capacity to secure yourself.
|
| I am at peace with the fact that I'm doing the best I can and
| keeping those I love protected.
| buddylw wrote:
| Security has always been relative. I feel much safer knowing
| that an exploit like this is worth hundreds of thousands or
| even millions of dollars.
|
| It keeps them closely guarded and selective about use. All of
| that makes me an unlikely target and reduces individual risk.
| gitanovic wrote:
| It makes me wonder how people like Bill Gates or Jeff Bezos
| use for their phone security.
|
| For sure they are much more interesting targets than I am,
| therefore burning a few 0-days might be worth the effort.
| thinkharderdev wrote:
| Wasn't Bezos phone hacked by the Saudis?
| heavyset_go wrote:
| > _I feel much safer knowing that an exploit like this is
| worth hundreds of thousands or even millions of dollars._
|
| I don't. Look at how much companies like Apple pay out for
| responsible disclosure if they pay out at all, and then
| compare it to what exploits go for on the grey/black
| market. Typically the buyers have deep pockets and burning
| millions of dollars wouldn't make them blink.
| dkokelley wrote:
| Why does it matter if it's the "good guys" or "bad guys"
| paying?
|
| If a vulnerability only cost ~$100 then a malicious
| person could compromise an ex lover's phone, for example.
| The fact that they are expensive means that their use is
| limited to targeted, strategic attacks. You don't have to
| agree that those attacks are good, but surely pricing the
| average person out of 0-days is better than the
| alternative.
| heavyset_go wrote:
| > _The fact that they are expensive means that their use
| is limited to targeted, strategic attacks._
|
| There are organized crime networks that pull in billions
| of dollars of revenue a year. If they wanted to pull off
| dragnet fraud, for example, they have the funds to do so.
| dylan604 wrote:
| >Why does it matter if it's the "good guys" or "bad guys"
| paying?
|
| Who do you think are more likely to use the vuln/exploit
| on regular everyday users? The nation state people are
| going to use it on targeted persons/groups (typically)
| while the "bad guys" are going to use it so they get the
| greatest bang for their buck.
| Aerroon wrote:
| Or the nation state uses it against everyone in a dragnet
| operation? Also, specifically targeted people by nation
| states often are "regular everyday users". They just
| happened to draw the ire of the wrong person.
| madeofpalk wrote:
| But still, I feel relatively safe knowing/thinking that
| the Saudi government doesn't want to hack my iPhone.
| heavyset_go wrote:
| Organized crime might, as they orchestrate fraud,
| blackmail etc networks all over the world.
| Aerroon wrote:
| The problem is that we're moving into a more and more digital
| world where it's not possible to even opt out. Estonia had
| their ID card photo database hacked.[0]
|
| > _A hacker was able to obtain over 280,000 personal identity
| photos following an attack on the state information system
| last Friday. The suspect is reportedly a resident of
| Tallinn._
|
| > _The culprit had already obtained personal names and ID
| codes and was able to obtain a third component, the photos,
| by making individual requests from thousands of IP
| addresses._
|
| How do you protect yourself against that when the government
| _requires_ you to have an ID card and puts you into the
| database? What happens when financial transaction logs get
| hacked or medical histories?
|
| [0] https://news.err.ee/1608291072/hacker-downloads-close-
| to-300...
| SilverRed wrote:
| Yeah I find it worrying how society only cares about what
| is technically possible and not what is realistically safe
| and secure. We could build taller and cheaper buildings if
| we ignored standards and just accepted that sometimes they
| fall over. But we don't because that is insanely dangerous.
|
| But now with tech the risk is invisible unlike a collapsed
| bridge. In Australia it is basically impossible to live a
| normal life without bringing your phone everywhere because
| they mandate that you scan QR codes before entering stores
| and the manual written forms are usually hidden behind a
| counter and on request only.
| 8eye wrote:
| you would expect quality from a commercial product because all
| of the investment being put into a product but these exploits
| are saying otherwise. open source projects may have more
| investments that care on a different level. we might have to
| figure out a way to go in that direction eventually considering
| how dangerous this is getting, many people depend on the
| quality of a product to ensure safer communication, and with
| some it is a life and death situation. do yeah it's sad that
| this keeps happening, it seems like we can think of a better
| way to not make this happen as often.
| swiley wrote:
| One company, which likely has a retention problem, is writing
| all of the code for your system and setting things up so that
| you can't easily use anything else.
|
| Do you think this is a recipe for secure computing?
| grishka wrote:
| Why do people keep writing file format parsers in unsafe
| languages?
| mastax wrote:
| I think it's mostly that people are continuing to use file
| format parsers that were written in unsafe languages in 1998.
|
| I do sometimes wonder what a "Manhattan Project" of software
| security would look like. I do think rewriting all common
| file parsers in <X> would be a very achievable project with a
| budget of a few dozen million dollars - nothing compared to
| the potential savings. The issue is then getting people to
| actually switch over. I think that a PR push by NIST et.al.
| could help convince the slowpokes that the "industry
| standard" has changed and they need to do something to avoid
| liability.
| fragmede wrote:
| _> nothing compared to the potential savings._
|
| How do you estimate the financial damages here though? It's
| not like anybody's _really_ going to stop buying iPhones
| over this. Not to any real degree. There 's some brand
| damage to Apple but that calculation's highly debatable and
| swings around wildly. Which is the problem. Digital
| security is impossible to put a price on, because until
| someone is actively exploiting it, it costs WAY less to do
| nothing about the situation.
| r00fus wrote:
| Yes, in fact, if NSA, China's MSS, Mossad and other
| nation states are betting on these kind of exploits to
| exist in order to do their really dirty work (even if
| they contract it out to NSO Group), the "benefits" would
| be detrimental to them.
| grishka wrote:
| With kinds of resources Apple has, you could be writing a
| PDF parser from scratch in Rust or Swift (it is 100%
| memory-safe, right?) or whatever else kind of "in the
| background", maybe as an experimental project, and then
| replace the existing one with it when it's mature enough.
|
| Microsoft at least started rewriting some components of
| Windows in Rust. Though they aren't saying which ones.
| j16sdiz wrote:
| 1. There are public visible Swift rewrite and sanbix
| enhancement.
|
| 2. With the number of projects Apple has, the number of
| "trivial" enhancement like this add up very quickly.
| UncleMeat wrote:
| It is starting. I've seen big companies start shifting
| towards this future over the last couple of years. In
| discussions with other security professionals across
| various companies, it is appearing more like an
| inevitability that a shift to memory safety is coming, in
| one way or another. It is moving slower than I'd want,
| but the discussion feels very different than it did just
| three or four years ago.
| mastax wrote:
| Sure, tech companies and even just random people are
| already working on it piecemeal. I just think of someone
| with resources put a concerted effort into it we could
| replace all the parsers of un-trusted data in e.g. Chrome
| within 2 years. If a government did it then it can be
| justified by benefiting all of society, rather than one
| individual product team having to justify the effort for
| their own use.
| beermonster wrote:
| In short, legacy code.
| rapind wrote:
| It might be the outrage goggles, but OpenBSD is sure looking
| good lately. https://www.openbsd.org/security.html
| schleck8 wrote:
| Until it becomes more mainstream; every os can be exploited
| if lucrative
| hulitu wrote:
| At least in Android the level of security is comparable with
| Win 3.11 for Workgroups. There is no access control except all
| or nothing. There is an OS which actively spies you.
| meibo wrote:
| When have you last used a modern Android OS? This is just not
| true, it offers exactly the same kind of controls as iOS
| does.
| overkill28 wrote:
| The way I describe it to friends and family is that there are
| basically two levels of protection:
|
| - Protecting yourself from rub of the mill malware that is
| looking to make money off of you. You can do this pretty
| effectively by always updating your software as soon as you can
| and avoiding sketchy and unnecessary apps and websites
|
| - Protecting yourself from an attack by a nation state level
| agency. I don't think there is any way to be safe from this,
| and people who are targeted like this need to use protection
| that go well beyond the choice of cell phone or chat app
| jdavis703 wrote:
| > Protecting yourself from an attack by a nation state level
| agency.
|
| My personal data was hacked by a nation-state level agency.
| The only way I could've prevented that is by not working in a
| national security position for that country's geopolitical
| rival.
|
| Now the only thing I can reasonably do is avoid ever stepping
| foot in that country lest they detain me for "extra
| questioning."
| cto_of_antifa wrote:
| I assume you knew the possible consequences when you made
| that decision, or you should have.
|
| Maybe you shouldnt have made the choice to work for a state
| level agency and actively reproduce the violence that that
| carries along with it.
| randall wrote:
| Sorry... sounds really rough.
| jdavis703 wrote:
| Eh, thanks but don't feel bad for me. There's hundreds of
| other countries I can visit. I feel bad for the
| dissidents who are targeted within their own country and
| have no hope to leave.
| dillondoyle wrote:
| And worse targeted abroad. Russia, China, Saudi. They all
| target, sometimes kill, sometimes abduct abroad. Even in
| the US... Scary.
| ipaddr wrote:
| Which country?
| basementcat wrote:
| The OPM breach was attributed to China. My personal data
| was also disclosed in the breach and I've since traveled
| to China multiple times.
|
| https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manag
| eme...
| TaylorAlexander wrote:
| But is this because computers fundamentally cannot be made
| secure, or due to backdoors and sloppy coding? I've heard BSD
| is pretty secure right? Couldn't we make phones that secure
| if we didn't bloat them with flashy new features every six
| months?
| UncleMeat wrote:
| This is sort of in the middle. NSO Group's exploits are
| surely expensive, but they are also not pinpointed. The
| states buying these exploits aren't spending the unlimited
| resources at their disposal to do the exploitation, it just
| costs them cash. This is one of the thing that likely
| promotes proliferation of this stuff, since it is so easy to
| pick another target.
|
| So I do think there is a level between these two where you
| can be defended against nation states that will use COTS-
| equivalent exploits against you even if you won't resist an
| active attempt by a full team targeting you very
| specifically.
|
| But doing this is hard as hell in the modern world, because
| so so so much of our device surfaces is riddled with memory
| errors.
| finiteseries wrote:
| _Basically, you're either dealing with Mossad or not-Mossad.
| If your adversary is not-Mossad, then you'll probably be fine
| if you pick a good password and don't respond to emails from
| ChEaPestPAiNPi11s@ virus-basket.biz.ru. If your adversary is
| the Mossad, YOU'RE GONNA DIE AND THERE'S NOTHING THAT YOU CAN
| DO ABOUT IT. The Mossad is not intimidated by the fact that
| you employhttps://. If the Mossad wants your data, they're
| going to use a drone to replace your cellphone with a piece
| of uranium that's shaped like a cellphone, and when you die
| of tumors filled with tumors, they're going to hold a press
| conference and say "It wasn't us" as they wear t-shirts that
| say "IT WAS DEFINITELY US," and then they're going to buy all
| of your stuff at your estate sale so that they can directly
| look at the photos of your vacation instead of reading your
| insipid emails about them. In summary, https:// and two
| dollars will get you a bus ticket to nowhere. Also, SANTA
| CLAUS ISN'T REAL. When it rains, it pours._
|
| [PDF]
| https://www.usenix.org/system/files/1401_08-12_mickens.pdf
| g8oz wrote:
| I think this understates the threat of privatized hacking
| tools. Governments that can barely tie their shoelaces now
| have access to capabilities that only a few heavy hitters
| used to have. One example: In Mexico NSO software was used
| to target anti-obesity activists who were pushing for less
| soda pop consumption.
| notdang wrote:
| The funny thing is that despite all of this high end,
| super secret, extremely sophisticated technology used
| against them, those activists won in the end.
| jahlove wrote:
| https://www.nytimes.com/2017/02/11/technology/hack-
| mexico-so...
| fragmede wrote:
| It's a well known piece but it's from 2014 (or earlier),
| and the world was different back then.
| pcl wrote:
| Time to be "that guy"...
|
| "Nation state" is a well-defined term in the political
| sciences, and we misuse it here on HN all the time. To quote
| Wikipedia:
|
| "A nation state is a political unit where the state and
| nation are congruent. It is a more precise concept than
| "country", since a country does not need to have a
| predominant ethnic group."
|
| https://en.m.wikipedia.org/wiki/Nation_state
| dragonwriter wrote:
| Nation-state is often used in a different sense to
| distinguish the participants in the Westphalian system of
| sovereignty from other entities that might be labelled
| nations and/or states; this use derives in part from the
| fact that the Westphalian system is itself considered the
| turning point to nation-states (in the sense the parent
| describes) as a general norm, and that the participants in
| that system are generally also nation-states in that
| primary sense. (While "state" alone is often used for this
| where context makes it clear that this sense of "state" it
| s intended, there are lots of other uses of "state"--
| particularly for subordinate units of certain Westphalian
| sovereigns--which can create ambiguity, and "Westphalian
| sovereign" is a lot more cumbersome than "nation-state".)
| pcl wrote:
| But the Westphalian system explicitly emphasizes the
| importance of the boundaries of the state vs the size of
| those boundaries. The HN usage tends to imply that
| "nation state" is something particularly impressive. But
| "an attack by a San Marino-level agency" doesn't convey
| that same level of impressiveness.
| dragonwriter wrote:
| Yeah, in security, "nation-state level actor" is used to
| mean "the most capable category of attackers, most (all?)
| of whom are particularly powerful nation-states [0]", not
| "attacker at the level of at least the least-capable
| nation-state".
|
| [0] In the "Westphalian sovereign" sense.
| VintageCool wrote:
| Russia is 81% ethnic Russian, per Wikipedia. I think that's
| close enough to qualify for "nation and state are
| congruent".
|
| Sure, it might make more sense to define this as "state-
| level agency", but that would confuse things for Americans.
| My internet security threat model ignores the state
| agencies of Montana just as much as yours ignores those of
| San Marino.
| Angostura wrote:
| That wasn't a misuse though - was it?
| pcl wrote:
| Well, perhaps the original poster was using it
| accurately.
|
| In my experience, the common HN usage really translates
| to "country with a big military budget", which is not at
| all what the term means.
|
| Neither the US nor Russia are nation states. China and
| San Marino are both nation states. I'm guessing the
| poster meant "countries like the US, Russia and China",
| and not "countries like China and San Marino."
| jrochkind1 wrote:
| Honestly I think they just mean "state". Yes, some states
| have more resources than others, but the ones without a
| lot of resources generally aren't engaging in cyber
| attacks, and "state" as a general category is good enough
| summary.
|
| I think people say "nation state" in part just because it
| flows better rhythmically, and in part because of that
| whole "westphalian" thing; and because the word "state"
| has other confusing meanings (including in CS, state as
| in 'state machine'; and the 50 USA states).
|
| But really on HN when talking about "threat actors", they
| mostly just mean "state-level". (See I had to add -level
| to make it rhythmically like 'nation state' again, the
| one syllable 'state' is just too short it just plops into
| your sentence ruining it)
|
| [Hey, why is it called the United Nations instead of the
| United States anyway? Oops, cause there already is a
| United States. But the UN is clearly an organization of
| States not Nations. But the things are conflated and
| confused generally in European nationalist ideologies of
| the 18th-20th centuries, that have affected our
| vocabulary and concepts for these things, it's not just
| HN. "Nation" is often used as a synonym for "State", so
| "nation state" ends up just kind of doubling down]
|
| I say "state-level actor".
|
| Almost any contemporary liberal democracy (and not only
| those) at least formally defines itself as a state of
| it's citizens, not belonging to any particular "nation"
| (ie ethnicity basically) in particular. I don't see the
| point in distinguishing between states that are "nation"
| states or not in the 21st century, or think that it has a
| clear distinction.
| kingaillas wrote:
| >Hey, why is it called the United Nations instead of the
| United States anyway? Oops, cause there already is a
| United States. But the UN is clearly an organization of
| States not Nations.
|
| States are sovereign political entities; of course modern
| countries tend to have a federal state made of several
| constituent states (see: USA, Germany, etc) where each
| claims certain jurisdiction. In ancient times there were
| city-states like Athens, Sparta... and even in 18th
| century Europe cities like Venice were states (Republic
| of Venice).
|
| Nations are people united by something they have in
| common. That could be shared history, language, culture,
| the geographic area they live in, or something more
| abstract like fandom of certain sports teams or other
| hobbies.
|
| There is considerable overlap between nations and states,
| and given state is already overloaded, extra words are
| added for clarity.
|
| I like "state-level" because these sorts of exploits and
| attacks are really about resources, not sovereignty,
| territory, etc. The fact is a rich person or company
| could fund a team that does vulnerability research and
| get results on par with the top tier folks already doing
| it.
|
| And, the UN should be called the "United Countries" since
| it is really about territorial areas. They admit members
| based on geographical claims; I don't see any ethnic,
| cultural, or fandom group (that isn't in control of some
| territory and thus also country/nation) as a member.
| fragmede wrote:
| It's to distinguish the hypothetical attacker and their
| resources from an individual or group of individuals. The
| threat to my personal health if Mossad is after me vs a
| particularly violent jilted ex-lover vs if I took down
| the local gang/cartel/drug dealer (ie they all want to
| kill me) but the level (and possibility) of defense
| against each of those threats are vastly different.
| [deleted]
| x0x0 wrote:
| > _I don 't think there is any way to be safe from this_
|
| Apple could certainly do a lot more to protect their
| customers, and we generally let Apple off far too lightly
| here. For starters: using their enormous revenues to bid up
| the prices for these cracks. Writing better software, eg
| using well-known techniques to harden imessage. etc.
| Hackbraten wrote:
| Also they could treat their employees better so there's
| less churn. Every newly-hired kernel engineer is bound to
| repeat the same technical mistakes that their predecessor
| made a decade ago.
| gitanovic wrote:
| Might be a business model for a Kernel engineer:
|
| * Go work for Apple
|
| * Learn vulnerabilities
|
| * Resign
|
| * Sell vulnerabilities for cash on the dark market
|
| Edit: formatting
| dylan604 wrote:
| Until run of the mill malware learns of a vuln only thought
| to be known by nation states, and then all hell breaks loose.
| jonplackett wrote:
| Don't know why you're getting down voted, that's literally
| what happened with WannaCry
|
| https://www.acronis.com/en-gb/articles/nhs-cyber-attack/
| Gxtaillon wrote:
| That's exactly why I started scratching my head as to why the
| web entire security model assumes a trusted execution
| environment. That no longer makes sense in today's world.
|
| Naively to me it looks like it's an artifact of 90s OS security
| model. The modern web, and the threats of the modern world
| require more stringent security facilities at the OS level to
| allow isolation of security context even to super users and
| specifically per program-origin, per identity, and per-process
| context isolation. Super users having the ability to read-write
| in any security context is no longer appropriate, at most super
| users should only be able to deny and delete, that's the only
| way to protect end-user privacy.
| UncleMeat wrote:
| Sandbox escapes are part of most serious exploit chains
| nowadays. They make things harder for exploit authors but
| absolutely do not fix the problem at a fundamental level.
| iMessage runs in a sandboxed environment. Doesn't stop the
| exploit in the article from getting root.
| fsflover wrote:
| Qubes OS [0] is based on a different security model: security
| through compartmentalization.
|
| [0] https://www.qubes-os.org/
| beermonster wrote:
| I can't find a link to it now, but there was a blogpost on
| how all other non-compartmentalization approaches to
| security had failed.
| saagarjha wrote:
| This is largely how iOS works.
| dcsommer wrote:
| For those that are uncomfortable with this state of affairs, I
| recommend this presentation: "Quantifying Memory Unsafety and
| Reactions to It" https://www.youtube.com/watch?v=drfXNB6p6nI
| teawrecks wrote:
| It's the same as asking, what percentage of the time is science
| wrong? 100% of the time, yes. We're trying to approximate
| correctness and the plan is to get a bit closer every day as
| new information becomes available.
| shapefrog wrote:
| > Isn't it close to 100% of the time that our desktops and
| mobile devices have significant security vulnerabilities?
|
| It is 100%. The sader reality is that the most likely weak link
| when it comes to exploiting your device is you.
| sneak wrote:
| Yes, but it can be somewhat mitigated by not using SMS or
| iMessage.
|
| Don't share the phone number of your sim with anyone for any
| reason whatsoever (or don't put a sim in the phone at all and
| use an external wifi router (this is what I do), or use a data-
| only sim), and ensure that iMessage and iCloud is disabled.
|
| This doesn't make your phone invulnerable, it just makes it
| less vulnerable.
| RattleyCooper wrote:
| If I knew anybody at NSO Group I'd start messaging them
| unsolicited PDFs and shit :P
| Apofis wrote:
| When are we going to start building software differently so that
| exploits start going away?
| NoPicklez wrote:
| Great question and how do you propose they do that?
| [deleted]
| est wrote:
| PSD should have the same fate as SWF. Maybe we will witness pdf
| exploits every month from iDevices in someday.
| bluefox wrote:
| The simple solution for those who are concerned about this is to
| use a dumbphone. It's simple, easily hackable, and most
| importantly does not promote a false sense of security.
| coliveira wrote:
| I believe it is completely wrong to believe that software can be
| made secure. It is inherently unsafe, by nature. I believe every
| internet facing computer should be partitioned in two virtual
| machines, one that connects to the outside world, and another
| that contains user data. Processes in the user data partition
| shouldn't be allowed to connect to the internet.
|
| The result of current design is that I have practically lost the
| right to write and use potentially unsafe software, even if I
| wrote it - something I may want to do for performance or
| practical reasons.
| zaptrem wrote:
| People need that user data to interact with the internet and
| inevitably code from the internet will be introduced to the
| "safe" VM.
| tediousdemise wrote:
| My fiancee already received a large group iMessage that had 40+
| unknown numbers on it that all shared the same area code and
| first 3 digits of the phone number. The contents of the message
| was unintelligible (random words).
| saagarjha wrote:
| Probably spam?
| tediousdemise wrote:
| Let's hope... we updated her phone. I'm wondering if a
| factory reset would be sufficient to blow away any malware.
| Hackbraten wrote:
| Regular reboots and applying updates already go a long way.
| Factory reset can also help get rid of persistent malware.
|
| But if she's being targeted, you're out of luck. No matter
| what she does, there's always one more 0day that can be
| used in a watering-hole attack.
| fhrhdhd wrote:
| Was anyone wearing a black hoodie?
| baobabKoodaa wrote:
| > Despite the [gif] extension, the file was actually a 748-byte
| Adobe PSD file.
|
| I wish programmers would stop "helpfully parsing" files which are
| named with an "incorrect" extension. If a random unknown person
| sends me a file with .gif extension that is actually a PSD file,
| I most definitely do not want my machine parsing whatever that
| thing is.
| willis936 wrote:
| Discourse avatars point to a page with a .png extension
| regardless of what the actual file is (jpg, gif, or svg).
| Parsing file headers should not be a dangerous operation and in
| my opinion is the right thing to do.
| traceroute66 wrote:
| Recently my iPhone started rebooting itself occasionally and
| randomly. I've been a long-term iPhone user and never seen this
| behaviour before on previous or current device.
|
| I'm not one to wear a tin-foil hat, but I have to admit NSO did
| come to mind.
| jaywalk wrote:
| Do you have reason to believe NSO Group would target you?
| azinman2 wrote:
| Unless you're a high profile target occom's razor says hardware
| failure.
| ericbarrett wrote:
| Yup, probably a bad bit in RAM or a just-on-the-edge bus
| error.
| ls612 wrote:
| My mom's iPad was doing the same thing for a long time and I
| suspected hardware failure (it was getting kinda old), so I
| told her to take it into the Apple store for diagnosis and
| repair. It turned out that the iOS install was just corrupted
| by bit flips and the Apple employee did a factory reset and it
| was all good afterwards. There's many things that can go wrong
| with even modern computers that aren't exploit related
| SilverRed wrote:
| The worst part is it is all just too complicated to work out
| why. My desktop seems to freeze and full crash once every few
| days and I have no idea why or even how to work out. Since it
| is custom built, I can't just take it to the apple store and
| say I want a new one.
| spockz wrote:
| It usually is the RAM that has developed a fault. Run
| memtest[0] to detect errors. Otherwise, in descending order
| of likelihood, it could be the motherboard, psu, some
| driver/kernel crash caused by peripheral, or bad cpu.
|
| [0]: http://www.memtest.org/#downiso
| theshadowknows wrote:
| I always wonder what it takes to find this kind of exploit. Are
| the programmers at NSO group just the best in the world? Or are
| they incredibly lucky? Both? I'd love to know what a normal day
| at work is like for their engineers. Clock in, sit down at
| a...crazy expensive hardware and software testing station? Crack
| open a brand new iPhone and start probing away while referencing
| internet sourced chip documentation and software manuals? What
| does it even look like?
| sophacles wrote:
| There's an entire "gray market" of exploit brokers. NSO group
| is one of the many players. There's a good chance this is an
| off-the-shelf exploit.
|
| The podcast Darknet Diaries had an episode about the topic
| recently: https://darknetdiaries.com/episode/98/
|
| (that episode is tied to this book:
| https://www.amazon.com/gp/product/1635576059/ about the topic)
|
| Also, I like that podcast in general - highly recommend it if
| you're into infosec stuff!
| thinkharderdev wrote:
| Just read that book after listening to the DND episode with
| the author and it is really great.
| ThisIsTheWay wrote:
| Episode 100 is specifically about NSO and dives deeper into
| Pegasus. Highly recommended listening after episodes 98 and
| 99.
|
| https://darknetdiaries.com/episode/100/
| trollied wrote:
| Saw the thread title & clicked through to post exactly the
| same :)
|
| It's a great set of episodes. This is without a doubt my
| favourite podcast. 2nd favourite being Knowledge Fight,
| which debunks Alex Jones and the nonsense that he spews on
| a daily basis.
| myself248 wrote:
| That goes very well with this prior episode as background
| info: https://darknetdiaries.com/episode/28/
| staticassertion wrote:
| Exploit development is a skill like any other. Instead of
| learning things like software design patterns, distributed
| systems, software reliability, etc you would have spent time
| learning about memory layouts, OS designs, mitigation
| techniques, decompilers, etc.
| tester756 wrote:
| Here's ranking of top people for this kind of job
|
| https://ctftime.org/
|
| Members of those teams are often Security Engineers at e.g
| Google, Banks, computer emergency response team (CERT) and so
| on.
| schleck8 wrote:
| They are not as secretive as I expected, even running a
| twitter account. Kind of uncanny
|
| >We have two Canadians, two Estonians, an Israeli and a
| Korean
| saagarjha wrote:
| These are security teams doing capture-the-flag
| competitions, you can literally walk up to them at in-
| person events and say hi if you'd like. There's nothing
| illegal going on here.
| chelmzy wrote:
| They may have purchased it from an exploit broker.
| badRNG wrote:
| Zerodium will pay up to $2,500,000 for no-click
| iPhone/Android exploits [1]. I'm sure they'd only pay that
| much if they were highly confident they have clients who'd
| pay enough to make the risk and investment worth it.
|
| [1] https://zerodium.com/program.html
| jbay808 wrote:
| _Someone_ still had to discover it though!
| russb wrote:
| Ian Beer with Google's Project Zero gives an amazing walk-
| through of what it took for him to build a similar exploit.
|
| https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c...
| [deleted]
| 1vuio0pswjnm7 wrote:
| "Are the programmers at NSO group just the best in the world?"
|
| The parent comment seems to imply that someone who can find
| programmer mistakes is a better programmer than one who
| actually writes software for the public. If thats true then
| wouldnt it be reasonable to prefer to use message software
| written by NSO instead of Apple. Why dont "security
| researchers" write the software we use instead of "software
| engineers".^1 Which group would be more likely to have "the
| best programmers in the world" who would be the least likely to
| make mistakes. Honest question. Im not trolling. I think about
| this question all the time.
|
| 1. Some of the programs I use and rely on everyday, even more
| than something like "iMessage", were written by people who
| claim to work in "security" or "research" (or even teaching
| math to university students) not "engineering". I have no
| complaints about these programs. Yet I have plenty of
| complaints about the software foisted upon us by Big Tech.
| thinkharderdev wrote:
| The hard part is not necessarily finding the programming
| mistake so much as figuring out a way to reliably exploit
| them. Back in the day before ASLR and other mitigations it
| was really straightforward, but modern OSs have much more
| sophisticated countermeasures to prevent buffer overflows and
| user-after free bugs to enable RCE.
| soVeryTired wrote:
| It's just a matter of the two groups having different skills.
| One group writes for the general case while the other
| specialises in corner cases.
|
| The latter looks really impressive when it's done well, but
| it'd be silly to expect someone with deep security knowledge
| to sit down and build a spreadsheet manager from scratch. The
| two skill sets are just different. There is no "best".
| mozey wrote:
| "Debugging is twice as hard as writing the code in the first
| place. Therefore, if you write the code as cleverly as
| possible, you are, by definition, not smart enough to debug
| it."
| moritonal wrote:
| Engineers need to write 1k lines of perfect code all the
| while being chased by their bosses to finish fast.
|
| Hacker's need to find just one mistake out of 1k lines of
| code.
| jcstauffer wrote:
| The few most recent episodes of the "Darknet Diaries" podcast,
| which are relevant, including interviews with CitizenLab,
| descriptions of how NSO works, Black Cube, and the market for
| buying exploits from Argentina.
|
| https://darknetdiaries.com/
| baybal2 wrote:
| > I always wonder what it takes to find this kind of exploit.
| Are the programmers at NSO group just the best in the world?
|
| Not much different too how software exploitation was done in
| Win98-ME-xp era was done.
|
| A lot of vulnerabilities are very obvious from disassembly, and
| often can even be found with automated tools.
|
| Today, it's easy. Back in early 200x, everybody was not only
| hiding their sources well, but obfuscating binaries in every
| way possible.
|
| People just forgot the scale of binary only exploitation on its
| peak.
| [deleted]
| dogma1138 wrote:
| They recruit people who were trained to find exploits, it's
| less about having the best programmers and more about having
| people with a specific set of learned skills and dedicating
| them to this task.
|
| I would be surprised if their core iOS research team is much
| more than 10 or so people at any given time.
|
| They also probably use brokers and buy at least some of the
| exploits they use from freelancers if they offer ~7 figures for
| a zero click exploit a lot of freelancers will be working on
| this too.
|
| It's just like any bug bounty program, internally you run a
| small and dedicated team and externally you pay enough to
| entice freelancers to spend their free time on your systems to
| scale it further.
| Ms-J wrote:
| It's not too esoteric, fortunately. The short explanation is
| they are a part of the Israeli gov, as with all tech companies
| in that territory, so that gives certain material advantages to
| their preferred companies, just like how USA does with offense
| contractors like Northrop.
|
| Basically, they are propped up by their gov, and that is the
| major problem.
| diskzero wrote:
| They probably hunt exploits like that, but what is quite likely
| is that they have access to stolen Apple source code and scour
| it for type overruns like the one in CoreGraphics that is the
| cause of this exploit. I would estimate that the majority of
| exploits are the result of source code theft, leaks of
| potential vulnerabilities from people who have access to the
| source code and social engineering. There isn't anything
| particularly special about a "Mossad" trained or "NSA" trained
| hacker. They are engineers like many of us and prefer the path
| of least resistance. Trying to brute force buffer overruns
| without having source code access is tedious. Why go to all the
| effort to black box exploits when you can take advantage of
| source code analysis.
|
| I mentioned in another post about why people would leak to the
| press, when you most likely will get caught and fired. Leakers
| of a different caliber will leak source code to governments and
| companies like NSO and have much less likelihood of being
| caught and much higher remuneration.
| saagarjha wrote:
| > I would estimate that the majority of exploits are the
| result of source code theft, leaks of potential
| vulnerabilities from people who have access to the source
| code and social engineering.
|
| No. Some Apple source code has publicly leaked (iBoot) but
| stealing this kind of stuff is bound to leak. And reversing
| binaries for vulnerabilities is not that much harder.
| marcan_42 wrote:
| You estimate wrong. I've been in infosec for over a decade.
| We look at binaries. It's not that hard. In fact, it's often
| easier, since type conversion errors are often a lot more
| apparent in a disassembly, where you can see exactly what
| operations are being performed without having to know exactly
| what the language rules around signedness and integer
| promotion are, and without having to follow through
| complicated type hierarchies. Similarly, a good optimizer
| will strip away layers of software abstraction and make
| what's actually happening more evident.
|
| There is value in source audits, but you're wrong that
| exploits come out of stolen source. That's exceedingly rare,
| and usually quickly publicly leaked when it happens.
| ShroudedNight wrote:
| > Similarly, a good optimizer will strip away layers of
| software abstraction and make what's actually happening
| more evident.
|
| I can attest to this, I've found it's frequently far more
| satisfying to debug at -O3 than -O0. At O3, the disassembly
| really lays bare the invalid assumptions that were relied
| upon.
| diskzero wrote:
| I respect your expertise and agree that good tools can help
| find potential vulnerabilities.
|
| You aren't the first person to say that exploits created as
| a result from source code theft are rare and the theft is
| quickly publicly leaked when it happens. Why do you think
| this? I would think that unethical players like NSO Group
| would have even more motivation to ensure the use of stolen
| source code is never revealed.
| tomc1985 wrote:
| I think it's more that the possibility space for exploits is so
| large that a dedicated force of highly creative reverse-
| engineers is all you need to dig them up.
|
| From what I've heard it can be almost trivial to find them if
| you know what to look for. But it seems that very few people
| know exactly where to look, and fewer still understand how to
| interpret the results.
| rasz wrote:
| https://www.youtube.com/watch?v=zyHI2Ht3OAI Jiska usually finds
| couple remote exploits a year by just looking at new
| component/subsystem. Its all dumpster fire underneath :(
| joedoejr wrote:
| Come on, since jailbreak discovered (checkm8 as king of it) you
| can run pretty much anything just on iphone itself including
| automated tests, fuzzing, debug and crash dump analyses. Break
| is always easier than build. iMessage plagued with such bugs
| since 2010, the question is how it is not yet rebuild up to
| decent quality. Retarded security measures like blastdor or
| aslr is irrelevant as these mostly a security theatre that just
| require extra step to avoid.
| belter wrote:
| The NSO group are ex-Mossad who decided working for the
| government does not pay as well as making money out of
| exploits, probably obtained at the highest levels of top secret
| work.
|
| So far, they have been tolerated by the Israeli government as
| they all went to the same schools, all did the armed forces
| service together, and all know each other. This allowed them to
| get a free pass so far. Privately, many of their ex-colleagues,
| are very critical of their lack of ethics.
|
| All this will change, the day some of the NSO exploits will be
| used against Israel, the same way some of the NSA leaked tools
| are now used in the wild.
| Leparamour wrote:
| It wouldn't be too far-fetched to imagine that NSO is running
| malware campaigns against Apple and Google employees.
| ianmiers wrote:
| NSO group is ex unit 8200, which is military signals
| intelligence. So in American terms, it's the NSA not the CIA.
| The distinction is important in a country with mandatory
| military service. You get a large number of people who go
| through, get trained, and then leave because it never was a
| career. A number of them take their skills to the private
| sector.
|
| Mossad, on the other hand, is a civilian intelligence service
| and I'm told there's a strong tradition that its members
| don't freelance their services after leaving.
| belter wrote:
| Not sure the distinction is relevant in a country with such
| a small intelligence community:
|
| "The Israeli Unit 8200 An OSINT-based study"
| https://css.ethz.ch/content/dam/ethz/special-
| interest/gess/c...
|
| "Most of this data is shared internally across the IDF (as
| well as sometimes externally, cf. 3.3 below) to the Unit's
| relevant stakeholders, whether combat troops, decision-
| makers or other intelligence agencies such as Mossad. Or as
| Yair Cohen, who served 33 years in Unit 8200, the last five
| (2001-05) as its commander, put it, "90% of the
| intelligence material in Israel is coming from 8200 [...]
| there isn't a major operation, from the Mossad or any
| intelligence security agency, that 8200 is not involved in"
|
| >"...Mossad, on the other hand, is a civilian intelligence
| service and I'm told there's a strong tradition that its
| members don't freelance their services after leaving..."
|
| Tradition is not what it used to be:
|
| "Black Cube: The Bumbling Spies of the 'Private Mossad'"
|
| https://www.wsj.com/amp/articles/black-cube-the-bumbling-
| spi...
|
| "...Despite some missteps, Black Cube "has to turn clients
| away because it cannot service all the demands," said Mr.
| Halevy, a former head of the Mossad, an Israeli government
| intelligence agency. He said Black Cube has worked on 300
| cases since being founded in 2010 by two former Israeli
| military intelligence officers, Dan Zorella and Avi
| Yanus..."
|
| "Harvey Weinstein hired ex-Mossad agents to suppress
| allegations, report claims"
|
| https://www.theguardian.com/film/2017/nov/07/harvey-
| weinstei...
| compsciphd wrote:
| "by two former Israeli military intelligence officers,
| Dan Zorella and Avi Yanus."
|
| emphasis on "military intelligence officers" i.e. not
| mossad. this is like mixing up the CIA and FBI. to an
| outsider they might appear the same, but that's not
| really the case.
| belter wrote:
| "Ilan Mizrachi, a former deputy head of the Mossad,
| Israel's intelligence agency, said that he sees nothing
| inherently wrong with former intelligence operatives
| working for civilian enterprises. "Some people I know
| went into journalism, some are consultants," he said.
| "Among many other professions, some work for companies
| like Black Cube."
|
| https://www.latimes.com/world/la-fg-israel-black-
| cube2017110...
| belter wrote:
| Quote from the article: "Despite some missteps, Black
| Cube "has to turn clients away because it cannot service
| all the demands," said Mr. Halevy, a former head of the
| Mossad, an Israeli government intelligence agency..."
| scatters wrote:
| Which determines that he is qualified to speak _about_
| Black Cube, not that he works _for_ Black Cube. There 's
| a difference.
| belter wrote:
| Please read the article first...
|
| "Efraim Halevy, former director of Mossad, an Israeli
| intelligence service, is a member of Black Cube's
| advisory board."
| compsciphd wrote:
| ok, those are better pull quotes than the original :)
| just noting that mossad and aman (military intelligence)
| are 2 different things.
| ianmiers wrote:
| It's an important distinction. The fact that huge numbers
| of people rotate through the hacking side of 8200 (like
| the NSA, vast majority of 8200 members don't work on
| that) is what drives the supply.
|
| Intelligence services typically have less turnover.
| Though that is changing, particularly for NSA, where
| people leave to go to contractors.
|
| Also, frankly, describing NSO as ex Mossad just makes
| phone malware sound much more complicated than it is and
| much harder to stop. At the end of the day, its software,
| written by people in much the same way any software is
| written. It just exploits mistakes other software devs
| made so that it can run.
| walrus01 wrote:
| the high tech industry in Israel is not _that big_. If you
| look at the companies that make COTS microwave and millimeter
| wave telecommunications equipment, they 're not too different
| from the other .IL companies which make advanced radar
| systems, jammers, and avionics for aircraft.
|
| I imagine it's similar for black/grey-hat software
| development.
| 2rsf wrote:
| The tech industry in Israel is RELATIVELY huge, not in
| absolute numbers of course.
|
| I didn't get the connection between microwave and spying
| tools
| walrus01 wrote:
| RF/microwave/millimeter wave engineering, SIGINT,
| cryptographic stuff and unit 8200 + spying tools are
| linked.
|
| https://en.wikipedia.org/wiki/Unit_8200
| DSingularity wrote:
| It's also the Mossad/Israeli government realizing that their
| capabilities and interests can be advanced by having the
| hacker mercenary services for sell.
| KoftaBob wrote:
| > So far, they have been tolerated by the Israeli government
|
| Why wouldn't the Israeli government tolerate them? If
| anything, doesn't their government benefit from groups like
| this?
|
| They get access to spy tools that they didn't have to use
| taxpayer money to fund, and because it's former members of
| their own intelligence working on it, they have some
| semblance of influence over how it's used.
|
| Am I missing something?
| 2rsf wrote:
| That's my understanding too. Funding is not really an
| issue, 8200 has one of the biggest budgets in the army but
| they are bound to the law and regulations, NSO on the other
| hand can pass the lines and keep Israel uninvolved
| cafecitoking wrote:
| Not really. Israel likely openly shares secrets with other
| Five Eyes countries and so it gets a sort of free pass from
| geopolitical pressures. Its a mutually beneficial exchange.
| Additional to the Mossad comment, the Israeli students who
| work for these group take an entrance exam at 17 and that
| recommends them for what's known as UNIT 8200 which is a
| feeder network/NSA clone.
| dboreham wrote:
| 6 eyes
| monocasa wrote:
| Israel isn't part of five eyes.
| alexeldeib wrote:
| I think GP was referring to geopolitical alignment and
| intelligence sharing rather than membership per se.
| azernik wrote:
| Which Israel is also not part of.
|
| Israel is only peripherally and reluctantly involved in
| the confrontations with Russia and China at the heart of
| 5E interests, and it neither trusts nor is trusted by 5E
| countries to the level of sharing intelligence sources or
| tools except in specific, transactional interactions.
|
| American and Israeli politicians like to talk about
| Israel being America's "closest ally", but those are just
| pretty words. Israel's real selling point to the US is
| that it's a low-maintenance ally.
| quesera wrote:
| > Israel's real selling point to the US is that it's a
| low-maintenance ally.
|
| Hm, that's interesting. Israel seems to be the _highest_
| -maintenance ally the US has. Other than, perhaps,
| Pakistan.
|
| I would say that Israel is politically necessary in the
| US, but they are expensive and prickly.
|
| And I don't think I've ever seen the "closest ally"
| quote.
|
| We surely inhabit different media worlds, but FWIW that's
| the perspective from this side. No arguments intended.
| jmnicolas wrote:
| > The NSO group are ex-Mossad
|
| There's no such thing as ex-Mossad or ex-CIA or ex-KGB etc.
|
| Apparently it's not Mossad but unit 8200, but I'd bet
| anything that nothing happen without their blessing.
| throw0101a wrote:
| > _All this will change, the day some of the NSO exploits
| will be used against Israel_ [...]
|
| There's a reason why Russian malware software does not attack
| systems that have an RU locale for the keyboard: don't sh_t
| where you eat.
| mikeevans wrote:
| Is this true? I've never heard that before. (But makes
| sense)
| vbezhenar wrote:
| This is myth. Russian systems are suffering from malware
| just like others. And probably more, because it's easier
| for local criminals to target local companies. It might
| be true for a very tiny fraction of malware, but that's
| definitely an exception, rather than rule.
|
| Of course if there are state-sponsored hackers (I'm not
| really aware if those exist, but I allow this
| possibility), they will target whatever their management
| points at. And with corruption it's pretty possible that
| some local business could be targeted as a part of some
| financial wars.
|
| But majority of hackers are just some guys with some IT
| knowledge and zero morale. They'll buy some exploits and
| tools on black markets, duct tape them into something and
| release in the wild, waiting for profits (or police).
| They'll rob banks or babushkas, they don't care.
| Stevvo wrote:
| It is not myth for ransomware. Many documented cases.
| It's essential to the survival of these groups; local
| cops more likely to leave them alone if they leave local
| businesses alone.
| orbital-decay wrote:
| _> It 's essential to the survival of these groups; local
| cops more likely to leave them alone if they leave local
| businesses alone._
|
| Which is a huge misconception outsiders have about this
| scene. They are Russian-speaking, not Russian, just like
| English speaking gangs are not necessarily English. These
| groups may (and often do) consist of nationals of
| different exUSSR countries, sometimes without even
| knowing each other personally. They might not even be a
| single group, just some individuals doing different parts
| of the scheme. (including "press releases" and
| "interviews" they sometimes do)
|
| It has been the case long before all this ransomware fad.
| Russia, Ukraine, Kazakhstan, Belarus, and partially
| Lithuania had world's top CC theft gangs for a couple
| decades, and they always been of mixed origin. They
| mostly steal EU and US cards because it offers better
| reward/risk ratio, compared to the home countries which
| are poor. But nothing stopped them from stealing CCs in
| Russia or Ukraine either, certainly not some mythical
| cops (who couldn't care less in reality); in fact,
| skimmers are widespread in those countries as well.
|
| Ransomware groups are the same as CC thieves, it's just a
| different scheme; they probably avoid home countries for
| the same reason (same risk, less reward). The state can't
| possibly have too much influence on them, it just
| triggers the bullshit detector for anyone who lives in
| any former Soviet republic and knows about this stuff at
| least superficially.
| marcan_42 wrote:
| It's specifically because Russian prosecutors couldn't
| care less if there are no Russian victims. By doing this
| they know there is next to zero chance of criminal
| proceedings.
| sephamorr wrote:
| I think poster is referring to this:
| https://krebsonsecurity.com/2021/05/try-this-one-weird-
| trick...
| AdamN wrote:
| Possibly but even if so it's just in a few examples that
| probably won't be repeated in the future now that it's
| known.
| GcVmvNhBsU wrote:
| It's the system language, not the keyboard settings.
|
| https://ke-la.com/lockbit-2-0-interview-with-russian-osint/
| badRNG wrote:
| > All this will change, the day some of the NSO exploits will
| be used against Israel, the same way some of the NSA leaked
| tools are now used in the wild.
|
| Has the leak of NSA tools changed anything?
| JumpCrisscross wrote:
| > _Has the leak of NSA tools changed anything?_
|
| Yes. The bipartisan USA Freedom Act limited several aspects
| of the NSA's dragnet [1]. Amendments weakening the bill
| were defeated [2]. Less materially, a documentation
| requirement for SS 702 searches of U.S. persons was added
| in 2018 [3].
|
| [1] https://www.eff.org/deeplinks/2014/11/usa-freedom-act-
| week-w...
|
| [2] https://www.eff.org/deeplinks/2015/05/usa-freedom-act-
| passes...
|
| [3] https://www.lawfareblog.com/summary-fisa-amendments-
| reauthor...
| Amezarak wrote:
| I'm skeptical the NSA doesn't just ignore or creatively
| interpret laws it doesn't like, given their past history
| and the consequences for their misbehavior.
|
| I mean when the CIA got busted not only spying on
| Congress a few years ago, but also lying about spying on
| Congress, they were told "don't do that again please."
| ndesaulniers wrote:
| "Not wittingly."
| sneak wrote:
| http://www.hasjamesclapperbeenindictedyet.com/
|
| Statute of limitations has expired, IIRC.
| rapind wrote:
| It's mind boggling Clapper wasn't crucified for this.
| This sort of thing keeps happening and some sketchy
| outsider may get elected with catch phrases like "Drain
| the swamp". Oh wait...
| nyolfen wrote:
| i can't believe nobody went after the org with
| algorithmic dossiers for everybody on earth
| tiahura wrote:
| Google or Facebook?
| sneak wrote:
| There is only one org that has access to all of this data
| and more.
| kuroguro wrote:
| > I always wonder what it takes to find this kind of exploit.
|
| A lot of knowledge about the target system's internals (comes
| with experience) and probably a lot of investment in fuzzing
| infrastructure or A LOT of time reverse engineering and
| reviewing manually. Finding bugs in closed source software by
| hand is incredibly slow and painful.
| rodgerd wrote:
| > Are the programmers at NSO group just the best in the world?
|
| Most people who are good at this are working for national
| security orgs, blue team in the private sector, or cash focused
| criminals. This is the relatively small group of people who are
| comfortable selling tools to help dictators hack journalists up
| with saws.
| tveita wrote:
| Look at the exploits Google's Project Zero find for a less
| clandestine example. No doubt they employ clever people but you
| don't have to be superhuman to find vulnerabilities in code.
| Part of it is paying people to sit down and work on it
| fulltime.
|
| An interesting quote:
|
| https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c...
|
| "This has been the longest solo exploitation project I've ever
| worked on, taking around half a year. But it's important to
| emphasize up front that the teams and companies supplying the
| global trade in cyberweapons like this one aren't typically
| just individuals working alone. They're well-resourced and
| focused teams of collaborating experts, each with their own
| specialization. They aren't starting with absolutely no clue
| how bluetooth or wifi work. They also potentially have access
| to information and hardware I simply don't have, like
| development devices, special cables, leaked source code,
| symbols files and so on."
| ehsankia wrote:
| Yep, Apple themselves will find exploits, white hat hackers
| will find exploits, Project Zero or Microsoft teams will find
| exploits, and so will NSO or other blackhats. It is a mix of
| luck, skill and putting in the time. NSO has successfully
| monetized their exploits, allowing them into then invest the
| money back into hiring more people, which increases the
| luck/time put into it.
| gerash wrote:
| If you have an organization that can legally hire people, pay
| them a stable salary and legally sell exploits to all sorts of
| people around the world you end up with NSO.
|
| NSA finds exploits for their own mission and Google Project
| Zero researches vulnerabilities to [per their claim] ensure
| internet stays a secure platform but neither of them sell
| exploits for profit like NSO.
|
| So, no, they're not the only "genius"es out there. They just
| are less ethical about it.
| Puts wrote:
| I could really recommend you the book A Bug Hunter's Diary by
| Tobias Klein which is a practical walk-trough in finding these
| kinds of security bugs.
|
| https://nostarch.com/bughunter
| Thaxll wrote:
| It takes IDA Pro, some low level asm/C++/Python programming
| skills and a lot of hours.
|
| Reverse engineering is not that complicated, however getting
| some results is difficult and time consuming.
|
| In that example it's basically looking at how some libraries
| are parsing input, that's it. Since everything in those phones
| are C/C++ nothing is "safe".
|
| It's the same skills you need to crack games, cheat in online
| games etc ...
| kaladin-jasnah wrote:
| It would be quite difficult if you can't get access to the
| binaries that you have to put into IDA (or, well, Ghidra, for
| that matter, but IDA Pro is probably better).
| saagarjha wrote:
| The binaries are available in OS restore images that Apple
| makes publicly available.
| helge9210 wrote:
| These are ex-military engineers (security researchers).
| Selection starts from age of 4. By the time they receive
| special training in technological units of the army they
| basically have a CS degree (at age of 19-20).
|
| > What does it even look like?
|
| Boring. Usually a group of introverted young kids that look at
| their own shoes while talking to you, led by an extroverted
| young kid, that looks at your shoes while talking to you.
| java-man wrote:
| You just leaked that the extrovert is a Finn! (the original
| joke is about a Finnish extrovert).
| yonatank wrote:
| As someone who has some familiarity with the people and
| processes, this response seems extremely off to me.
|
| > Selection starts from age of 4
|
| Care to share your sources for that? As far as I know most
| are self taught and get some further training in military.
|
| > Boring.
|
| It might be boring to some and might be extremely interesting
| for others. People who like solving puzzles and facing hard
| challenges usually like it. Of course, if your passion is
| building you wouldn't like it as you don't "build" something
| new.
|
| > Usually a group of introverted young kids that look at
| their own shoes while talking to you, led by an extroverted
| young kid, that looks at your shoes while talking to you.
|
| Have you met these people at all? Because it definitely
| sounds like you haven't and you just describe the typecast
| some movie would use.
| helge9210 wrote:
| > Care to share your sources for that?
|
| I'm Israeli.
|
| My children were attending/graduated/served
| kindergarten/school/army in Israel and I saw selection
| process as a parent.
|
| My wife was a school teacher in Israel. She described to me
| some of the evaluation metrics she was supposed to submit
| every half a year over each and every pupil she had.
|
| > Have you met these people at all?
|
| I cannot confirm nor deny I met these people.
| samhw wrote:
| You witnessed the hiring process of the NSO Group, which
| begins at 4 years old in kindergarten? For a company
| which has existed for 11 years?
|
| I can't agree more with what the above commenter said.
| This is not infosec hiring, it's Spy Kids.
| CyanBird wrote:
| He didn't say it was NSO, but the Israeli military and
| specifically 8200
| ChrisKnott wrote:
| So when you said "Selection starts from age of 4", you
| mean that schoolchildren of this age receive standardised
| testing?
|
| What does this have to do with the military? What does
| the "selection" actually entail?
| helge9210 wrote:
| What my daughters went through:
|
| 1) at age of 4 all the parents were gathered to meet
| kindergarten personnel. They explained that kids will
| play games all year. Parents were separated to groups and
| given logical puzzles to solve. Results were noted.
|
| For the next two years children were playing games with
| changing rules to negate natural ability for specific
| game and to select for ability to find the best strategy
| within current constraints.
|
| At the same time each parent is given a day to present
| his/her profession. Results are noted.
|
| Results were passed to school class selection committee.
|
| 2) According to results in kindergarten kids are grouped
| in schools. Some are given opportunity to participate in
| electrical engineering or robotic activities (my daughter
| was Top 5 in Israeli competition for 6-9 years old with
| reduced team).
|
| 3) By the end of the second year some of the parents are
| notified that there will be an examination. Test is
| analogous to IQ (math, language, general knowledge).
| Graded on the curve for municipality. Top 8% are invited
| for one day a week for additional activities. Top 2% are
| invited to special schools with much more intensive
| program. My daughter made it to top 8%. Activities are:
| decision making, finding solutions within constraints,
| leading groups of people to solve bigger problems.
|
| 4) By the end of elementary, depending on previous
| results, kids get access to full math program (as opposed
| to reduced arithmetic). Additional activities include
| software and electrical engineering, robotics, chemistry,
| physics and so on. Parents and kids, that didn't made it
| to Top 8% at previous years, are not aware of these
| activities (invitations are sent personally).
|
| 5) At age of 15 kids pass initial evaluation by IDF. Good
| grades at high school will guarantee initial evaluation
| will be upheld. Bad grades will negatively impact the
| chances.
|
| 6) By the end of high school whole history and
| psychological profile are passed to IDF for final
| evaluation.
|
| > What does this have to do with the military?
|
| In Israel everything has everything to do with military.
| devenvdev wrote:
| I have lots of friends who are ex-8200 (high levels of
| hightech are surprisingly full of them actually) and this
| is the first time I hear about that. If you mean that
| selection that happens at 17yo is based on grades and
| teachers evaluations since kindergarten - that might be,
| but it sounds different than "selection starts at 4yo"
| which implies that 4yo kids are selected and followed all
| their life.
| CyanBird wrote:
| > selection starts at 4yo" which implies that 4yo kids
| are selected and followed all their life.
|
| I mean, _they were_ followed all their life when they
| arrive at the final selection process, it is a track
| record after all
| [deleted]
| fragmede wrote:
| One person's boring is another's career culmination.
| Breaking system security often consists of dead end after
| dead end, and even if you get a lucky break, you may hit
| another dead end after that. Finding an exploit often isn't
| enough these days, they need to be chained together to
| actually get somewhere interesting. Personally, it's very
| unrewarding (aka boring, imho) work most of the time
| because you don't find anything a lot of the time. (The
| high off of finding something is something else tho, lemme
| tell you.) If you're interested in the sort of work
| involved, http://microcorruption.com is a good CTF to start
| out on.
| SavantIdiot wrote:
| A lot of times it is just poring over code looking for bugs
| that have already been found in other locations in the code.
|
| For example. this is a use after free bug. You can statically
| analyze disassembled code to find places where this might be
| happenning, and then figure out how to exploit that instance of
| the bug.
| viktorcode wrote:
| Most likely they buy exploits on the market, like basically
| everyone else. No reason to limit yourself only to the first
| party knowledge.
| baybal2 wrote:
| Why does iMessage automatically open every picture?
| coolspot wrote:
| Message notification has little tiny preview of the image
| attached.
| baybal2 wrote:
| Then... the question is now why do they show a preview if the
| user can click the message himself?
___________________________________________________________________
(page generated 2021-09-14 23:03 UTC)