[HN Gopher] iPhone flaw exploited by second Israeli spy firm
___________________________________________________________________
iPhone flaw exploited by second Israeli spy firm
Author : caaqil
Score : 442 points
Date : 2022-02-03 14:23 UTC (8 hours ago)
(HTM) web link (www.reuters.com)
(TXT) w3m dump (www.reuters.com)
| bogwog wrote:
| usui wrote:
| I had a thought after thinking about the publicity of this second
| exploit: If Facebook says iOS is causing $10B loss of revenue
| (https://news.ycombinator.com/item?id=30190216) then it would be
| in their interest to hurt the public's opinion on iPhone
| privacy/security.
| wolverine876 wrote:
| Apple has many competitors and others they deal with, who have
| many motives. Sans evidence, everything is speculation. Drawing
| a linefrom a potential motive to action is the stuff of
| fiction.
| smoldesu wrote:
| Trying to imagine what you're insinuating here is ridiculous,
| and probably why you said the quiet part out loud (and left the
| loud part unsaid).
| rchaud wrote:
| The general public worries about Instagram/Alexa listening to
| their conversations to presumably show them targeted ads.
|
| NSO spyware isn't on their radar, because they simply aren't
| important enough to be a target. For dissidents, journalists
| and diplomats on the other hand, it could be a death sentence.
| rootsudo wrote:
| Question:
|
| If device is jailbroken, and you apply root limit and other
| things to break standard features. Would it make it harder to
| exploit an ios?
|
| I would imagine you can do default hardening like modifying the
| software version label so when the software queries it will be
| unable to automatically "arm" itself and apply persistence.
|
| Are there any packages/places where this is already discussed?
|
| If not, then I guess I will pick up some older iphone devices and
| play along - because it seems to be a great point - I highly
| doubt there is much sophistication in these malwares and there
| has to be some sanity checks that make it so that if you are
| _targetted_ it will not "reveal" itself.
|
| And of course the basic one of VPN, and forcing to change the DNS
| servers which the ios devices operates on.
| Gigachad wrote:
| Any kind of defense would be by chance. You aren't
| realistically able to "harden" the OS against attacks better
| than Apple can. Maybe you might be able to confuse some attacks
| but this would still be basically random luck.
| A4ET8a8uTh0 wrote:
| I am not sure if it was already covered, but at this point one
| has to assume that every government that can obtain it, will[1].
| I do find it odd however that FBI did given some of the more
| recent revelations about hacks against US using same software.
|
| [1]https://www.jpost.com/international/article-695290
| AtlasBarfed wrote:
| Is Israel THE go-to haven for security firm and three-letter
| agencies to arbitrage/bypass surveillance regulations?
|
| If the CIA isn't allowed to do certain things for spying, so ...
| just have Israel spy on our populace and since we basically fund
| them and let them spy on us anyway, just make sure their database
| is open to us?
|
| Where else is there 1) the talent and 2) the relative degree of
| trust?
|
| There are a lot of stories from my childhood (of debatable
| ranking on the conspiracy scale) of the dirty pool and awful
| unconstitutional behavior by the CIA and other agencies.
|
| It is my vague impression that the increased information
| awareness from the web tempered the bad behavior for a couple
| decades, but I think the old habits will start reappearing in
| "cyberspace" once they gain sufficient deniability, and people's
| live reach a level of "mortal" dependence on it.
| FridayoLeary wrote:
| Perhaps. But perhaps news outlets are singling out Israel for
| whatever reason. So i feel quite uncertain.
| bitcharmer wrote:
| I have the exact opposite observations. Criticising Israel is
| a big no-no and most media won't cover anything bad about
| Israel.
| FridayoLeary wrote:
| I always try and work with the assumption that the media is
| lying to me. Mainly by omission. These things are owned by
| private people and/or are run by people with agendas. There
| has to be limits to their trustworthiness. I salt every
| news story that gets served up to me.
| keewee7 wrote:
| >I have the exact opposite observations. Criticising Israel
| is a big no-no and most media won't cover anything bad
| about Israel.
|
| There is plenty of criticism of Israel by The Guardian,
| Washington Post, New York Times, Reuters etc.
|
| It's not the media's fault that the Democratic and
| Republican party are so pro-Israel.
| wbsss4412 wrote:
| Criticizing Israel is a big no-no when it comes to certain
| issues, but I'm not sure it's the case here. In this case
| they seem to be an easy foil to place the blame upon, when
| other governments are either doing the same thing or are
| collaborating with Israel to export the development.
| gruez wrote:
| What are the other countries that aren't being covered?
| jb12 wrote:
| For example, Ethiopia literally drone-striked a refugee
| camp last month and there was almost no media coverage.
| Compared with the wall to wall breathless coverage of the
| Gaza conflict last year.
| joecool1029 wrote:
| You're right, we could really use some more coverage of
| how terrible Israel treats Ethiopians too. [1][2]
|
| [1] https://forward.com/culture/481124/with-no-land-
| ethuopian-je...
|
| [2] https://www.bbc.com/news/world-middle-east-32813056
| gashmol wrote:
| You can always cherry pick news items to depict Israel as
| bad or as good as you want to. But remember, reality is
| more complex than what's on the news. While there are
| some terrible mistakes, Israel's treatment of Ethiopian
| Jews is definitely not terrible.
| joecool1029 wrote:
| >While there are some terrible mistakes, Israel's
| treatment of Ethiopian Jews is definitely not terrible.
|
| Our definition of 'not terrible' surely must be
| different.
|
| I first became aware of the issues this community faces
| when the news broke last decade about the government
| sterilizing immigrant Ethiopian women without their
| knowledge or consent. A matter of record:
| https://www.haaretz.com/israel-news/.premium-ethiopians-
| fool...
| gashmol wrote:
| How about the time when Israel rescued some 14,000 people
| of this community in 36 hours from Addis Ababa just
| before rebel forces arrived at the city?
|
| Israel made some great things for this community and it
| made some awful things as well.
|
| My point is that if you get your information only from
| the news than you are bound to get a biased picture of
| reality.
| keewee7 wrote:
| >If the CIA isn't allowed to do certain things for spying, so
| ... just have Israel spy on our populace
|
| You basically described various "X eyes" programs. Western
| intelligence services are completely out of control.
|
| My country (Denmark) was involved in a similar program with the
| NSA:
|
| >Danish intelligence (FE) also helped the US agency to spy on
| the Danish foreign and finance ministries as well as a Danish
| weapons manufacturer. The FE also cooperated with the NSA on
| spying operations against the US government itself.
|
| https://www.dw.com/en/danish-secret-service-helped-us-spy-on...
| jb12 wrote:
| > Is Israel THE go-to haven for security firm and three-letter
| agencies to arbitrage/bypass surveillance regulations?
|
| No, why bother going all the way to Israel? They just do it in
| the US. When have regulations ever made a difference to
| surveillance?
| 0xedd wrote:
| Highest Nobel prize per capita. Has an advanced military
| intelligence arm and released soldiers are great employees for
| the IT security sector. These two combined create a strong
| cyber security presence.
|
| Regardless, I don't know what regulations you refer to when the
| US and China lead the charge on actively spying on the entire
| world. The US drags down with it many western countries. Which
| is how the "5 eyes" was created. And no one bats an eyelash.
|
| After the US was exposed for what the NSA did against its
| allies, no one was persecuted and the Senate was powerless to
| do anything. All inquires were met with "classified". So, at
| best, the propaganda over there convinced one person that there
| are regulations restraining military intelligence and the CIA.
| unfocussed_mike wrote:
| Also they have (or had) a very high technology export tax;
| this has the tendency to concentrate certain kinds of
| development entirely within Israel.
|
| So it's not just that they have a high level of expertise;
| there is a strong economic disincentive for firms to move
| tech business out of Israel.
| tguvot wrote:
| tech firms actually add presence in israel but ip is
| usually owned by other entities, outside of israel.
|
| usually the biggest problem with ip in israel, it's in case
| that there was investment into company/development by chief
| scientist. it comes with a lot of strings attached and
| requires payoff to transfer ip outside of state
| pthread_t wrote:
| > Highest Nobel prize per capita
|
| Israel is #11 [0]
|
| [0] https://en.wikipedia.org/wiki/List_of_countries_by_Nobel_
| lau...
| lostlogin wrote:
| Interesting list. I think you can ignore the first 2 or 3
| as places that have one 1 or 2 winners and have a small
| population skew it.
|
| However that doesn't move Israel up much.
|
| The Scandinavian countries are looking good as per usual.
| snthd wrote:
| >Where else is there 1) the talent and 2) the relative degree
| of trust?
|
| https://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gch...
|
| >When GCHQ does supply the US with valuable intelligence, the
| agency boasts about it. In one review, GCHQ boasted that it had
| supplied "unique contributions" to the NSA during its
| investigation of the American citizen responsible for an
| attempted car bomb attack in Times Square, New York City, in
| 2010.
|
| >No other detail is provided - but it raises the possibility
| that GCHQ might have been spying on an American living in the
| US. The NSA is prohibited from doing this by US law.
| temptemptemp111 wrote:
| shmatt wrote:
| This is comical. Of course more than one person knows about each
| 0-day at NSO. Maybe they even brought it over from a different
| place. And they can forward it (for money or ego) to 1000 other
| people. There truly is no limit, once someone has committed the
| idea to anyone but themselves
|
| NSO (and the smaller, anonymous companies) are famous for
| bringing in people from Israeli NSA (8200) or Mossad. Why?
| They're not just smart, they also have a bank of 0-days in their
| brains. Even if they're not bringing over actual code, they
| remember all of the 0-days they were exposed to. There is no way
| to stop them from "uploading" their knowledge to a new company
| with a 7 figure compensation package
|
| At some point the UAE figured this out, and Dark Matter opened an
| office in Cyprus. Offering ex-8200 7 figures (in $) to come build
| cyber weapons for them, limiting their dependency on NSO and
| export licenses[1]. The Israeli Govt. was furious but it wasn't
| illegal to move abroad and work for a foreign country
|
| [1]https://www.themarker.com/technation/.premium-1.7972249 -
| requires translation to english
| golergka wrote:
| > NSO (and the smaller, anonymous companies) are famous for
| bringing in people from Israeli NSA (8200) or Mossad.
|
| Literally every tech company in Israel has people from 8200. I
| worked at a few mobile game companies, and each had 22 year old
| kids straight from the 8200.
| thinkingemote wrote:
| also worth stating that Israel has compulsory military
| service, so a huge number of computer geeks, like you and me,
| will get into this service for the mandated time rather than
| the more physical and distasteful alternatives. It's (i
| imagine) like an enforced first year MIT cyber security
| course for the majority of people in that service.
|
| In summary, the label of belonging to them means not that
| much in reality - rather one should look at length of
| service, age of entry and any subsequent / previous
| activities when they leave. (basically like any other
| cybersecurity job, really)
| shmatt wrote:
| true, and 8200 is huge, being there doesn't mean much in
| terms of ability to remotely take over an iPhone
|
| The more accurate description is - these cyber weapon
| companies bring in the 22 year olds that were building cyber
| weapons in 8200
|
| Its an elite group of a couple hundred at most. who are then
| snatched up for their existing knowledge, even if they can't
| figure out how to find new exploits
| [deleted]
| dc-programmer wrote:
| This is getting out of hand. Now there are two them!
| paulis wrote:
| Haha, took me a minute to remember the reference. Great stuff!
| a4isms wrote:
| https://www.youtube.com/watch?v=hrYV7wS3JUk
| YaBomm wrote:
| chezzwizz wrote:
| The only thing that I took from this was NSO Group, blacklisted
| for selling to foreign governments, demonstrated an iPhone
| exploit and another reason to stay awake in foreign countries.
|
| in related news: * https://arstechnica.com/tech-
| policy/2022/02/report-nso-offer... *
| https://www.techdirt.com/articles/20220121/13492148329/spyin...
| mcoliver wrote:
| For those who are just being exposed to this stuff, This Is How
| They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole
| Perlroth was an entertaining read that covers some of the history
| in this space.
| jrm4 wrote:
| My most shocking takeaway from this book was _certainly_
| discovering the extent to which GOOGLE relied on outsourcing
| security.
|
| Google. Outsources. Security.
|
| The kind of thing that makes it seem miraculous that any of it
| is still standing.
| ma2rten wrote:
| Google certainly does a lot of security in house.
| bhedgeoser wrote:
| It also stores passwords in plain text. I once got an email
| from them sayingthat their crawlers found my password
| somewhere online.
| pbhjpbhj wrote:
| That conclusion doesn't necessarily follow, fwiw. If you
| find a password list, then you hash all the passwords and
| see if any match the hashes you store, now you know if
| the password found online belonged to someone on your
| system but at no point did you keep your own system
| password in plaintext.
|
| Mind you with salt and pepper (roughly, ways to modify
| the hash and overcome rainbow tables) checking anything
| other than the very highest frequency passwords found
| would seem onerous.
| ummonk wrote:
| They're probably just checking against a stolen passwords
| list when the user logs in.
| hasty wrote:
| That doesn't mean it's stored in plain text. They could
| be storing a nice hash, and then when the crawler finds
| your email and password on some site some where, it could
| try to hash it as if you were logging in and see if it
| matches.
| jart wrote:
| Do you know how computationally expensive it is to hash
| passwords?
| hasty wrote:
| It's computationally expensive to hash every single
| possible password, but given a proposed login/password
| combo, it's not expensive to check just the one. If
| Google, in crawling, finds a dump of several million
| accounts and their purported passwords, it's not a heavy
| lift to check each password.
| ummonk wrote:
| Salting (which they absolutely should be doing precisely
| to make mass dictionary attacks computationally
| expensive) would make that infeasible.
|
| More likely they're just checking against the stolen
| passwords database whenever the user logs in, as
| passwords are typically submitted in plain text.
| hasty wrote:
| Salting doesn't matter in this case. They're not finding
| a list of free-floating passwords and then seeing if
| anyone has that password; they're finding a list of
| accounts and associated passwords. So they only have to
| check that particular combination, just as they would for
| a regular login.
| guiriduro wrote:
| Its still standing precisely because the outsourced and
| likely compromised security is far more useful if it appears
| to be working than if it collapses in an act of digital
| vandalism.
| silisili wrote:
| That I didn't know, interesting.
|
| That said, I cannot recall Google ever having a breach, a la
| Yahoo, Sony, and basically most other companies. Does that
| mean everyone else should use who Google is using?
| wolverine876 wrote:
| They had breaches attributed to China and North Korea,
| IIRC. The former led to their exit from China.
| drexlspivey wrote:
| I recommend the darknet diaries episode "The Athens Shadow
| Games" where the CIA murdered a Greek telecommunications
| engineer after their wiretapping of the whole Greek cabinate
| (including the Prime minister and his wife) was exposed.
| belter wrote:
| EP 64: "The Athens Shadow Games"
| https://darknetdiaries.com/episode/64/
| someotherperson wrote:
| Pretty sure this was known since last year[0], although it may be
| slightly different.
|
| The smaller firms are just alphabet soup remixes of the larger
| ones. I wouldn't be surprised if they have the same owners, same
| staff, same offices -- just with a different logo at the top of a
| second set of business cards.
|
| [0] https://www.haaretz.com/israel-news/tech-
| news/.premium.HIGHL...
| mzs wrote:
| Nice find, maybe there's something here to how KSA was allowed
| to continue spying using this tech:
| https://www.nytimes.com/2022/01/28/magazine/nso-group-israel...
|
| > Years prior, NSO had formed an ethics committee, made up of a
| bipartisan cast of former U.S. foreign-policy officials who
| would advise on potential customers. After the Khashoggi
| killing in 2018, its members requested an urgent meeting to
| address the stories circulating about NSO involvement. Hulio
| flatly denied that Pegasus had been used to spy on the
| Washington Post columnist. Pegasus systems log every attack in
| case there is a complaint, and -- with the client's permission
| -- NSO can perform an after-the-fact forensic analysis. Hulio
| said his staff had done just that with the Saudi logs and found
| no use of any NSO product or technology against Khashoggi. The
| committee nonetheless urged NSO to shut off the Pegasus system
| in Saudi Arabia, and it did. The committee also advised NSO to
| reject a subsequent request by the Israeli government to
| reconnect the hacking system in Saudi Arabia, and it stayed
| off.
|
| > Then, the following year, the company reversed course.
| Novalpina, a British private-equity firm, acting in cooperation
| with Hulio, purchased Francisco Partners' shares of NSO, with a
| valuation of $1 billion -- more than five times more than it
| was when the American fund acquired it in 2014. In early 2019,
| NSO agreed to turn the Pegasus system in Saudi Arabia back on.
|
| > Keeping the Saudis happy was important for Netanyahu, who was
| in the middle of a secret diplomatic initiative he believed
| would cement his legacy as a statesman -- an official
| rapprochement between Israel and several Arab states. In
| September 2020, Netanyahu, Donald Trump and the foreign
| ministers of the United Arab Emirates and Bahrain signed the
| Abraham Accords, and all the signatories heralded it as a new
| era of peace for the region.
|
| > But behind the scenes of the peace deal was a Middle East
| weapons bazaar. The Trump administration had quietly agreed to
| overturn past American policy and sell F-35 joint strike
| fighters and armed Reaper drones to the U.A.E., and had spent
| weeks assuaging Israel's concerns that it would no longer be
| the only country in the region with the sophisticated F-35.
| Pompeo would later describe the aircraft deals in an interview
| as "critical" to obtaining M.B.Z.'s consent to the historic
| move. And by the time the Abraham Accords were announced,
| Israel had provided licenses to sell Pegasus to nearly all the
| signatories.
|
| > Things hit a snag a month later, when the Saudi export
| license expired. Now it was up to the Israeli Defense Ministry
| to decide whether or not to renew it. Citing Saudi Arabia's
| abuse of Pegasus, it declined to do so. Without the license,
| NSO could not provide routine maintenance on the software, and
| the systems were crashing. Numerous calls among Prince
| Mohammed's aides, NSO executives, the Mossad and the Israeli
| Defense Ministry had failed to resolve the issue. So the crown
| prince placed an urgent telephone call to Netanyahu, according
| to people familiar with the call. He wanted the Saudi license
| for Pegasus renewed.
|
| > Prince Mohammed had a significant amount of leverage. His
| ailing father, King Salman, had not officially signed on to the
| Abraham Accords, but he offered the other signatories his tacit
| blessing. He also allowed for a crucial part of the agreement
| to move forward: the use of Saudi air space, for the first time
| ever, by Israeli planes flying eastward on their way to the
| Persian Gulf. If the Saudis were to change their mind about the
| use of their airspace, an important public component of the
| accords might collapse.
|
| > Netanyahu apparently had not been updated on the brewing
| crisis, but after the conversation with Prince Mohammed his
| office immediately ordered the Defense Ministry to have the
| problem fixed. That night, a ministry official called NSO's
| operations room to have the Saudi systems switched back on, but
| the NSO compliance officer on duty rebuffed the request without
| a signed license. Told that the orders came directly from
| Netanyahu, the NSO employee agreed to accept an email from the
| Defense Ministry. Shortly afterward, Pegasus in Saudi Arabia
| was once again up and running.
|
| > The next morning, a courier from the Defense Ministry arrived
| at NSO headquarters delivering a stamped and sealed permit.
| DSingularity wrote:
| Hard not to view these expiration of permits or
| recommendations of ethical committees as calculated moves to
| create leverage and to increase valuations. Especially when
| within 12 months a 5x return on investment is realized
| followed by an immediate policy reversal or when the Israelis
| suddenly gain the blessings of the gulf to annex Jerusalem.
|
| What a shame on every computer scientist involved and every
| one who is an expert in this domain and. Is staying silent.
|
| You know these efforts don't work without the involvement of
| academics and venture capitalists and skilled programmers.
| And what did they create? A tool that was used to spy on a
| dissident journalist in order to put together a savage
| assassination operation.
|
| Shame on the Saudis and shame on their Israeli enablers.
| pomian wrote:
| Very interesting comment! Ps(what is MBZ?)
| drc500free wrote:
| https://www.nytimes.com/2019/06/02/world/middleeast/crown-
| pr...
| johnyzee wrote:
| Mohammad Bin Zayed, hereditary ruler of Abu Dhabi (and
| thus, the United Arab Emirates, which include Dubai).
| shmatt wrote:
| This Novalpina thing has been creating a lot of drama in the
| past few weeks. It turns out
|
| 1) The purchase was done as a leveraged purchase, very odd in
| the Israeli high tech/startup world. maybe even
| unprecedented. NSO is about to default on said debt
|
| 2) Novalpina are now at odds with Hulio, blaming him on
| trying to move all of the debt to 3 of the companies
| "healthy" subsidiaries. Apparently NSO is built like a maze,
| with lots of smaller companies, some of those aren't on the
| US ban list, and Hulio is trying to move all of the debt to
| them. The Israeli courts are now in the mix, trying to figure
| out who owns what
|
| Unfortunately I couldn't find an article in english, but here
| is one in Hebrew with the ability to Google Translate
|
| https://www.calcalist.co.il/local_news/article/rksf58atf
| gataca wrote:
| Why doesn't Apple just buy NSO and use them as an internal
| defense group?
| ohgodplsno wrote:
| Having wads of cash doesn't mean you can buy any company
| without their agreement.
| kadoban wrote:
| Having a few trillion dollars makes it a little harder to say
| no to, but yeah this would not make much sense for Apple.
| Sahbak wrote:
| Pegasus is legally considered a weapon in Israel and I doubt
| the government will allow it.
| hibernator149 wrote:
| How could you make sure that you haven't just bought a very
| expensive Trojan Horse?
| vlozko wrote:
| Assuming NSO would even allow itself to be purchased, various
| nations would get involved to prevent it. Too many national
| security issues on the line for them. If anything, Apple would
| be better off starting up a new office and try to hire
| individuals within the NSO Group.
| fortran77 wrote:
| NSO has changed owners several times. They're now owned by a
| UK firm called Novalpina Capital.
| rl3 wrote:
| Whether poached or acquired, NSO employees are almost
| certainly already under the influence of Israeli security
| agencies.
|
| If your players in this hypothetical are Apple, NSO, Israel,
| and USG--each could probably have a pretty convincing list of
| arguments for and against. I could see it going either way.
| radicaldreamer wrote:
| If by "under the influence" you mean alumni of. They're
| similar to the staff of military contractors in the US,
| roving from company to company to use all the skills they
| learned on the inside for massive profits privately.
| KoftaBob wrote:
| NSO seems to essentially be a front for Israel's Mossad
| intelligence agency. They get to wash their hands of whatever
| NSO does by saying "hey that wasn't a nation state spying,
| they're a private company and we'll punish them for you don't
| worry."
|
| For a more public facing version of this from the CIA, look at
| their unofficial Venture Capital wing:
| https://www.iqt.org/about-iqt/
| 0xedd wrote:
| It's usually ex intelligence that work in such companies.
| That being said, that's not how the tools work. Data
| exfiltration wasn't tracked to the vendor.
|
| You must remember the US' interest in spying and conquest is
| a rather unique trait. Most countries don't go looking for
| trouble worldwide.
| tut-urut-utut wrote:
| How would that benefit Apple?
|
| They are already able to spy on their phone users if ordered by
| the right three letter agency, they don't need NSO/Pegasus for
| that.
|
| And if they still do so, it would basically be official: "look
| a phone vendor that develop tools to spy on phone usage". Not a
| good marketing either.
| mwint wrote:
| Apple would presumably fix the vulnerabilities, rather than
| exploit them themselves.
| not2b wrote:
| And the people at that company who enjoy developing attacks
| more than they enjoy defending against attacks would just
| leave and form a new company, that would then sell its
| attacks to the highest bidder.
| [deleted]
| iratewizard wrote:
| Red team still develops attacks. They just do it directly
| for the blue team that fixes them.
| not2b wrote:
| But some people might not decide that this is the career
| for them. You can't eliminate a threat to iPhone security
| by buying the company, because you can't enslave its
| employees.
| mathverse wrote:
| Because it makes no sense. NSO is just one of the many
| companies doing offensive netsec.
| core-utility wrote:
| Not to mention, they're one of many _public_. One has to
| think that there are many more like NSO that don 't have huge
| media publicity around them.
| kingcharles wrote:
| I don't even think NSO is designing these exploits. They are
| almost certainly buying them in. Apple just needs to outbid
| NSO.
| fortran77 wrote:
| I suspect some are sold by disgruntled employees who are
| disturbed by the internal culture.
| pcwalton wrote:
| That's a serious accusation to make without evidence.
| Anyone doing this would rightly face significant jail time.
| pthread_t wrote:
| > I don't even think NSO is designing these exploits.
|
| That's interesting. Why do you think that?
| kingcharles wrote:
| NSO, while having the blessing of a nation state, is still
| a private company, but has access to some very high-end
| exploits that would almost certainly require a very large
| team to develop and to keep ahead of the fixes. It is just
| more likely they are going the cheaper route of buying the
| exploits and copy/pasting them into their system. This way
| they can outbid most others as they are reselling the
| exploits multiple times to many different nations - the
| other potential buyers, e.g. intelligence services are
| buying only for themselves and are limited in their
| budgets.
| smashah wrote:
| ProAm wrote:
| turminal wrote:
| The closed system is just fancy words for "you don't really own
| your phone, we do". Doesn't help a tiny bit against the devices
| getting pwned, if you'll excuse the pun.
| npteljes wrote:
| Why did you think that?
| smoldesu wrote:
| Probably because Apple has invested a lot of money in their
| "Privacy: That's iPhone" advertising campaign, and used the
| closed nature of the iOS ecosystem to defend their position
| in the highly popularized Epic Games v. Apple trial.
| lern_too_spel wrote:
| Because that's how Apple publicly justifies the closed
| ecosystem. You and I are savvy enough to know that it's
| hogwash, but you would be surprised by how many people,
| including technologists, buy that marketing.
| rat9988 wrote:
| He didn't.
| teejmya wrote:
| The closed ecosystem prevents this exploit from ending up on
| the public App Store and infecting devices en mass...
| zibzab wrote:
| You realize store evaluation is just a PR and is mainly used
| as a control tool.
|
| I mean, how could something like this happen if there was any
| real security?
|
| https://en.m.wikipedia.org/wiki/XcodeGhost
| caddybox wrote:
| What makes you feel that malicious apps are the only vector
| for these exploits. The web is open and iOS users can still
| download files on their devices. Let's disable file downloads
| altogether and limit people to an alternative "reviewed" web.
|
| Please don't use the flimsiest of excuses to bootstrap an
| argument for a more restrictive world.
| moonchrome wrote:
| Umm if it's zero click why would it need to get on the App
| Store ? And what does getting something on App Store have to
| do with the system being open or closed ?
| [deleted]
| smoldesu wrote:
| The App Store is not the delivery mechanism for this attack,
| so no.
| nomel wrote:
| I think the argument is that having a completely open App
| Store would increase the attack surface, since the average
| user will click any install icon.
| smoldesu wrote:
| I think the greater argument to be made is that it
| doesn't matter, since iOS has had no-click zero-days for
| longer than it's had an App Store.
| asah wrote:
| you forgot the /s
| 58x14 wrote:
| This is unsurprising; the number of individual exploits needed to
| chain together into a functioning compromise often requires a lot
| of joint effort.
|
| It's funny this release comes out at the same time as the FBI's
| disclosure that they "tested" (aka purchased) Pegasus, NSO
| group's packaged exploit software.
| https://www.reuters.com/world/us/fbi-says-it-tested-israeli-...
| usmcnapier wrote:
| It only figures. They do pretty good coverage on it at all at
| forbiddenstories.org
| gostsamo wrote:
| What are the chances that they bought the vulnerability from the
| same place? Finding something like that at the same time if it
| was there for awhile is rather suspect.
| kryptiskt wrote:
| It could be reverse-engineered too if they got their hand on an
| exploited phone, but these firms don't seem to offer any
| defensive cybersecurity services. It seems to me that would be
| a great synergy, if they can scoop up exploits used against the
| customers they are defending, they could then use those
| exploits in their offensive products.
| not2b wrote:
| It's even possible that one of the companies was spying on
| the other one.
| keewee7 wrote:
| >In Uganda, for example, NSO's ForcedEntry was used to spy on
| U.S. diplomats, Reuters reported.
|
| This was the incident that made US authorities go after NSO. I
| remember reading that these diplomats were actually involved in
| espionage.
| suifbwish wrote:
| Any reason in particular that these spy firms seem to be coming
| out of Israel?
| stjohnswarts wrote:
| I imagine they cut deals with the spy agencies and other
| authorities there to be able have much fewer regulations on
| what they are working on, particularly if they share it at a
| very discounted price with the Israeli government.
| ILMostro7 wrote:
| conducive environment; maybe even shared knowledge or
| spillover from one company to another...
| just_steve_h wrote:
| The US has been using Israel as high-tech offshore military
| R&D for at least the past 40 years. The US "gives" $4 Billion
| in "military aid" to Israel each year.
|
| You may also be aware that Israel invaded territory in 1967
| which it continues to occupy in flagrant violation of
| "international law," and that this occupation continues to be
| violently resisted.
|
| Those are a few of the more salient reasons why Israel is a
| hotbed of military/cyber/border/security technology. It's all
| developed, tested, and deployed against a vulnerable occupied
| population, then sold to the "friendly" (ahem) nations of the
| world.
| atlasunshrugged wrote:
| I think they have a really strong culture/ecosystem around
| cybersecurity given the close relationships between the IDF
| and the startup ecosystem and given how many Israelis serve,
| there's likely much more understanding (if not interest) of
| govtech/defensetech compared to the U.S. where it's an all
| volunteer force and not that much crossover in Silicon Valley
| and DoD, although lots of folks trying to change that like
| DIU, AFWERX, SOFWERX, etc.
| guelo wrote:
| Russians, Chinese, and Americans prefer keeping these
| capabilities internal to their militaries. Israel seems to
| want to use cyber weapons exporting for building diplomatic
| ties.
| ummonk wrote:
| And Google's Project Zero is just as productive at finding
| 0-days - they just conduct responsible disclosure instead
| of selling the 0-days they discover.
| syoc wrote:
| Not surprising as diplomat and spy is often interchangeable and
| there probably was a reason they were spied on.
| optimalsolver wrote:
| It's also a bit rich for the US to be complaining about this
| kind of thing.
| IncRnd wrote:
| An idealistic equality of actions using right vs. wrong is
| not exactly how diplomats look at things.
| sudosysgen wrote:
| Agreed, but they are the ones that peddle that way of
| viewing things to their own population to get what they
| want, and they should be called out for it.
| JumpCrisscross wrote:
| > _also a bit rich for the US to be complaining about this
| kind of thing_
|
| The U.S. isn't complaining as much as shutting down a
| threat vector. Shooting back isn't hypocritical.
|
| Also, you get the right to complain when you're allies,
| just as Germany had the right to complain when the NSA was
| caught tapping Merkel.
| jdavis703 wrote:
| Come on everyone spies. There's no point in establishing an
| embassy if you're not also getting an understanding of both
| stated and unstated intentions.
| sudosysgen wrote:
| That's not the issue. The issue is the US getting mad at
| counter-espionage by Uganda while they are themselves
| engaging in espionage. It's very hypocritical.
| cgriswald wrote:
| It is the issue. Everybody spies. Everybody spies _and is
| hypocritical about it_.
| pieter_mj wrote:
| But USA is the most hypocritical about it. It
| systematically spies on its allies, with the exception of
| Israel and these 2 countries take active measures for
| some cybertools not to spy on each other. (or Israel
| tries to make it seem that way).
| godelski wrote:
| I guarantee you that the US spies on Israel and vise
| versa. I'd honestly be surprised if there was a single
| country both didn't spy on. But I'd say the same about
| Germany, Australia, France, Spain, UK, Russia, China, and
| many more.
| aerostable_slug wrote:
| Hell, DLI teaches Hebrew (once euphemized as "special
| Arabic" in some settings) [0]. That's not just for
| exchange/liaison officers... Not to dig up that bucket of
| worms, but there were Hebrew linguists aboard the USS
| Liberty.
|
| [0] https://www.dliflc.edu/about/languages-at-dliflc/
| sudosysgen wrote:
| That is simply false. Few countries hypocritical about
| counter-intelligence. You absolutely have to draw the
| difference between intelligence work and counter-
| intelligence work. Saying that going after someone for
| catching your spies is normal is totally insane, no one
| except the US does it.
|
| If Uganda was spying on the US in the US, then you would
| have a point. That's not what happened.
| markdown wrote:
| > Come on everyone spies.
|
| That's what they want everyone to think so that they can
| use it to excuse their antisocial behaviour.
|
| Tonga, Samoa, Solomon Islands, Fiji, Peru, Mongolia...
| there's a very long list of countries that don't.
| itsokimbatman wrote:
| I don't know about all of them, but a quick Google search
| shows that both Mongolia and Puru have intelligence
| agencies, which means very likely they have some sort of
| collection capability for HUMINT and/or SIGINT.
|
| The ones that don't have intelligence capabilities are
| probably the exception rather than the rule, and I doubt
| they're doing out of good will vs just not having the
| resources for it.
| samhw wrote:
| I can't tell if you're being sarcastic, or genuinely
| giving a list of minuscule island chains, culminating in
| the country that's literally the universal metonym for
| 'middle of nowhere'.
| demadog wrote:
| They would if they could. Those are mostly tiny countries
| with almost no resources to spy.
| judge2020 wrote:
| You won't stay a world power by allowing others to attack
| you, even at a smaller scale with lesser weapons.
| sudosysgen wrote:
| Counter-intelligence is not attack, it's defence. What
| this is is the US attacking Uganda and throwing a hissy
| fit when they defend themselves.
|
| If those were Ugandan spies in the US they could have
| gotten dissappeared.
| martimarkov wrote:
| First the US is not Saudi Arabia - they won't make any
| diplomat disappear.
|
| Second - how did the US attack Uganda?
|
| I think your comment sounds a bit biased that's all. If
| you share some light - happy to accept the points raised.
| sudosysgen wrote:
| Where did I say diplomats? Of course, you wouldn't
| disappear the diplomats. However, they almost never
| operate alone - whenever there is a diplomat engaged in
| intelligence there are almost always other assets without
| diplomatic status.
|
| Offensive intelligence operations that the US has been
| conducting in Uganda are, well, offensive in nature, and
| are thus an attack. Not all attacks are an act of war.
|
| > I think your comment sounds a bit biased that's all. If
| you share some light - happy to accept the points raised.
|
| I don't see how it is biased. The US applying sanctions
| on Uganda after they got caught spying by Ugandan
| counter-intelligence (under other pretenses, of course)
| is massively hypocritical. As far as I know using
| economic pressure to coax a country into _accepting_
| espionage is a new low. The US is trying to normalize and
| establish as basic expectations that weaker countries
| should just let it spy on them, and that 's hypocritical
| above and beyond the norm.
| aerostable_slug wrote:
| Offensive counterintelligence is indeed a thing.
|
| We don't disappear people under diplomatic cover, we PNG
| them just like everyone else does. And when we do catch
| foreign agents without diplomatic cover, we imprison
| them. Why kill a useful asset that could be traded for
| someone on our team?
|
| https://en.wikipedia.org/wiki/Cuban_Five
| sudosysgen wrote:
| Offensive counterintelligence is not the same as catching
| a spy and hacking them.
|
| Offensive counterintelligence involves manipulation or
| long-term disruption of adversaries. Hacking someone's
| phone doesn't qualify, that's just normal defensive
| counterintelligence.
|
| >We don't disappear people under diplomatic cover, we PNG
| them just like everyone else does.
|
| Sure.
|
| >nd when we do catch foreign agents without diplomatic
| cover, we imprison them. Why kill a useful asset that
| could be traded for someone on our team?
|
| We both know that's not true. When it's more useful to
| trade them, that's done. When you want to send another
| signal, the US is not shy at all about killing them.
| samhw wrote:
| > When you want to send another signal, the US is not shy
| at all about killing them.
|
| What information is this based on? I don't have any
| particularly strong opinions on this subject, but I can't
| recall ever reading about anything like this.
___________________________________________________________________
(page generated 2022-02-03 23:01 UTC)