[HN Gopher] Pegasus: A Spy in Your Pocket Threatens the End of P...
___________________________________________________________________
Pegasus: A Spy in Your Pocket Threatens the End of Privacy
Author : galaxyLogic
Score : 53 points
Date : 2023-01-17 20:08 UTC (2 hours ago)
(HTM) web link (www.tatteredcover.com)
(TXT) w3m dump (www.tatteredcover.com)
| johnea wrote:
| Pegasus might make handy click bait, but NSO Group doesn't get a
| tiny fraction of the data that Goggle Corp gathers.
|
| But, since pretty much everyone in the US is allowing goggle to
| continue it's massive violation of the 4th amendment, it's not
| really news worthy.
| czx4f4bd wrote:
| Google isn't a branch of the US government, so the 4th
| amendment doesn't apply. If you want adtech surveillance to be
| regulated, lobby for GDPR-style regulation in the US.
| cheeseomlit wrote:
| If the US Gov has access to the data Google collects without
| issuing a warrant, which they do according to the Snowden
| leaks, then the distinction is meaningless as far as the
| intent of the 4th amendment goes
| orthecreedence wrote:
| Yes, the separation of state and industry has long been
| eroded in the US. Yet people are still under the illusion
| that democracy exists.
| czx4f4bd wrote:
| The US government obtained that data by illegally tapping
| into Google's data centers, which means the government was
| still the entity violating the 4th amendment.
|
| If you want to criticize Google's data collection, fine,
| but doing it in terms of the 4th amendment is just
| nonsensical. If you want to criticize companies for
| collecting data that could subsequently be illegally
| collected by the government, then every single company that
| collects any PII/private information could be criticized on
| the same basis.
| cheeseomlit wrote:
| It's not like they hacked into Google's servers without
| their knowledge or consent, they were given access to the
| data. Obviously those who knew about it at Google were
| under gag orders, but one would hope that somebody
| involved would have the balls to leak the government's
| blatantly unconstitutional and illegal demands to the
| press regardless. Those gag orders wouldn't have held up
| in court if anybody at one of the PRISM companies had the
| conscience to go rogue. Every company involved in PRISM
| can be rightfully accused of colluding with the
| government to violate the basic 4th amendment rights of
| millions of people, knowingly and willingly.
| roywiggins wrote:
| I didn't get the impression that MUSCULAR (intercepting
| Google's inter-datacenter links, distinct from PRISM)
| involved Google's cooperation.
| EMM_386 wrote:
| > It's not like they hacked into Google's servers without
| their knowledge or consent, they were given access to the
| data.
|
| This is not true. The NSA hacked Google without their
| consent.
|
| The relevant slide from the Snowden leak is here:
|
| https://i.imgur.com/7IHE6sG.png
|
| > Snowden leaks: Google 'outraged' at alleged NSA hacking
|
| https://www.bbc.com/news/world-us-canada-24751821
| webdoodle wrote:
| There's a word for that: FASCISM, and both parties enabled
| it:
|
| -Bush Jr. set up the surveillance system using a classified
| executive order
|
| -Obama gave access to it to 16 Law Enforcement agencies
| (via EO) and didn't renew the Smith-Mundt Act to legalize
| psychological warfare on U.S. Citizens
|
| -Trump could have shut it down by the same Executive Order
| system , but instead did nothing but whine and remove a
| single Top Security clearance from Brennan. He also ordered
| the DHS to create lists of journalists and media
| influencers to target for surveillance.
|
| -Biden weaponized social media against us to silence us and
| ostracize us from society.
| drooopy wrote:
| -Biden weaponized social media against us to silence us
| and ostracize us from society.
|
| Huh?
| vuln wrote:
| Users typically agree to send their data to Google.
|
| With NSO and Pegasus the purchaser agrees, but the intended
| victim (the one being exploited) never agreed to send their
| data to whomever purchased Pegasus from NSO or the NSO.
|
| So it doesn't really matter if NSO has less data than Google.
| It matters _HOW_ the NSO Group/ customer got the data which
| 99.9% is against the wishes of the victim.
| etc-hosts wrote:
| > If they've found a way to hack one iPhone," says Edward
| Snowden, "they've found a way to hack all iPhones."
|
| I thought the way this works is that NSO Group determines there's
| a vulnerability in ios or android that lets them insert Pegasus,
| but soon after it gets deployed to spy on 1 person by a NSO Group
| client, Apple and Google eventually detects it and patches the
| vulnerability.
|
| I don't think it scales to 'all iphones'.
|
| There is a recent Frontline episode where NSO Group denies any
| knowledge of how Pegasus gets deployed once they sell the exploit
| system to a client, but that seems false to me since it is my
| understanding NSO Group runs a large amount of infrastructure to
| collect data from infected phones and to report data to the
| client, a multi tenant system.
|
| I can't find a source for Snowden saying this either.
| gtvwill wrote:
| Oh such innocence. Apples probably backdoored permanently and
| so is android. Churrs aus gov law that means they can force you
| the employee to implement a backdoor and your not even allowed
| to tell your boss. Remember if the products sold in aus or has
| any form of business HQ here it has to be assumed it is not
| free from gov eyes.
|
| Also thanks to 5 eyes knowledge sharing your gov in US and my
| gov here don't need warrants to spy on their own citizens. They
| just have your data pass through a foreign but 5 eyes hosted
| service in one of their partner nations and pass data back via
| intel sharing agreements.
|
| The only safe assumption is all your devices are compromised or
| can easily be.
| tedunangst wrote:
| "Any" would be more apt than "all", although they may be able
| to do a coordinated blast targeting every phone at once. Not
| very stealthy though.
| crystaln wrote:
| Also, if a phone is in an attacker's custody, it will no longer
| be updated, and they can wait for an exploit to no longer be
| day one when it will be cheaper.
| hsbauauvhabzb wrote:
| I wormable vulnerability would do well, my iPhone seems to want
| to patch only a few days after release.
| dayre wrote:
| Agreed, basically all phones having exploits that NSO has
| discovered and have yet to be patched by the owner of the phone
| are vulnerable. I think Apple's lawsuit against NSO is still in
| the courts, they mention a specific exploit that has since been
| patched.
|
| https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-gro...
| moltude wrote:
| Interview with the authors on the Lawfare podcast
|
| https://www.lawfareblog.com/lawfare-podcast-how-spy-your-poc...
| DerekBickerton wrote:
| I'm probably reading this HN thread from a Pegasus-infected
| iPhone right now, and I have no way of knowing! The only
| commercial solution to detect Pegasus I know of is iMazing's
| Pegasus detection tool[0] which borrows techniques from Amnesty
| International's Mobile Verification Toolkit (MVT)[1] to detect
| Pegasus. Not sure how reliable it is though.
|
| Anyway with something like Pegasus, all the forensic artifacts
| would be random and heavily mutated for each infected device, so
| it's not as easy as running a tool to detect its presence.
| Pegasus is known for doing anti-forensics under the hood.
|
| [0] https://imazing.com/blog/detecting-pegasus-spyware-with-
| imaz...
|
| [1]
| https://www.amnesty.org/en/latest/research/2021/07/forensic-...
| keyme wrote:
| The smartphone: A Spy in Your Pocket Threatens the End of Privacy
|
| Pegasus was just a way of some governments to get their hands on
| a small part of the action GOOG & FB are swimming in.
| raybb wrote:
| PBS Frontline released a documentary about Pegasus earlier this
| month and it's pretty good, though a bit slow.
|
| https://www.pbs.org/wgbh/frontline/documentary/global-spywar...
| zeitgeistcowboy wrote:
| It was cool to see the listing of this book at The Tattered Cover
| Bookstore website. This is an old school bookstore and well worth
| a visit. It looks like there are eight locations around Colorado.
| I grew up going to the one in Colorado Springs on Tejon street in
| the 90s. It goes to show that used bookstores offer a great
| service for very modern topics like digital privacy.
___________________________________________________________________
(page generated 2023-01-17 23:01 UTC)