5 ms·

Amazing work by Lookout and Citizen Lab. Until this point I was not aware that Lookout provided any value-add for mobile devices. I was under the impression i

Amazing work by Lookout and Citizen Lab. Until this point I was not aware that Lookout provided any value-add for mobile devices. I was under the impression it was the McAfee of mobile. It sounds mean but this is the first reference to actual vulnerability discovery done by themselves on their blog, which usually reports on security updates that Google's Android security team discovered. Previous entries include such gems as "Now available: The Practical Guide to Enterprise Mobile Security" and "Insights from Gartner: When and How to Go Beyond EMM to Ensure Secure Enterprise Mobility." I can't wait to see more great work. Lookout is now on my radar.

jonknee 10y ago
And quite the heads up move by Ahmed Mansoor to recognize the suspicious text for what it was and send it to the research team instead of clicking the link. If this thing really has been going since iOS 7 that means he is the outlier in taking precautions.
- redwards510 10y ago
  FTA: He had been targeted previously by FinFisher AND Hacking Team's malware. Avoiding malware is nothing new to this guy, something this NSO Group should have taken into account when they came up with their spear-phishing attack.
  - runesoerensen 10y ago
    Sure but how is that responsive to parent's point about Mansoor being an "outlier in taking precautions"? The reason he found out about the previous attacks was likely because he took similar precautions: "When Ahmed Mansoor opened the document, his suspicions were aroused due to garbled text displayed. His email account was later accessed from the following suspicious IPs.." https://citizenlab.org/2012/10/backdoors-are-forever-hacking-team-and-the-targeting-of-dissent/ https://citizenlab.org/2012/10/backdoors-are-forever-hacking...
    - mentat 10y ago
      I'm not sure if you call it a "precaution" when you notice someone's pwnd you. Still good job noticing it after the fact.
      - amagumori 10y ago
        Then again, he's not some comfortable first-world programmer who makes $100K a year and enjoys talking about infosec and opsec as a fun diversion, he's a guy living in a repressive third-world dictatorship who has put his entire life on the line for the human rights of others and probably has little to no computer science or infosec education, so, maybe cut the guy some fucking slack.
        bobsil1 10y ago
        > third-world Agree strongly, just a small note: UAE is quite wealthy. Higher PPP-adjusted per capita income than Sweden.
  - gengkev 10y ago
    NSO Group claims not to launch attacks itself; rather it only sells tools to do so. So it might even be that the same government has targeted him with all three hacking tools.
dropalltables 10y ago
Direct links to other resources: Technical analysis: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... CitizenLab analysis of the nation-state side of things: https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... Apple update: https://support.apple.com/en-us/HT207107 https://support.apple.com/en-us/HT207107
- deleted 10y ago
  [deleted]
- tkinom 10y ago
  Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?
  - omgbear 10y ago
    Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read calls. http://linux.die.net/man/8/tripwire http://linux.die.net/man/8/tripwire
    - eriknstr 10y ago
      Some years ago, I had Tripwire installed for a few days but quickly removed it again because whenever I upgraded installed packages, I'd get a storm of messages about files which had changed and that was just annoying since I was the one who had initiated the action that caused the files to change, but at the same time there were so many files that changed of course, that I had no way of distinguishing legitimate changes (as they all were) from any potential illegitimate changes.
davidu 10y ago
Yep -- This is legit security research. Excellent research.
mtgx 10y ago
> Amazing work by Lookout and Citizen Lab. Hopefully Apple "made it rain" on these guys (with cash).
linkregister 10y ago
When I wrote the above comment, this thread was linked to the Lookout blog page, not the more appropriate citizenlab page.

jonknee 10y ago

And quite the heads up move by Ahmed Mansoor to recognize the suspicious text for what it was and send it to the research team instead of clicking the link. If this thing really has been going since iOS 7 that means he is the outlier in taking precautions.

redwards510 10y ago
FTA: He had been targeted previously by FinFisher AND Hacking Team's malware. Avoiding malware is nothing new to this guy, something this NSO Group should have taken into account when they came up with their spear-phishing attack.
- runesoerensen 10y ago
  Sure but how is that responsive to parent's point about Mansoor being an "outlier in taking precautions"? The reason he found out about the previous attacks was likely because he took similar precautions: "When Ahmed Mansoor opened the document, his suspicions were aroused due to garbled text displayed. His email account was later accessed from the following suspicious IPs.." https://citizenlab.org/2012/10/backdoors-are-forever-hacking-team-and-the-targeting-of-dissent/ https://citizenlab.org/2012/10/backdoors-are-forever-hacking...
  - mentat 10y ago
    I'm not sure if you call it a "precaution" when you notice someone's pwnd you. Still good job noticing it after the fact.
    - amagumori 10y ago
      Then again, he's not some comfortable first-world programmer who makes $100K a year and enjoys talking about infosec and opsec as a fun diversion, he's a guy living in a repressive third-world dictatorship who has put his entire life on the line for the human rights of others and probably has little to no computer science or infosec education, so, maybe cut the guy some fucking slack.
      - bobsil1 10y ago
        > third-world Agree strongly, just a small note: UAE is quite wealthy. Higher PPP-adjusted per capita income than Sweden.
- gengkev 10y ago
  NSO Group claims not to launch attacks itself; rather it only sells tools to do so. So it might even be that the same government has targeted him with all three hacking tools.

dropalltables 10y ago

Direct links to other resources: Technical analysis: https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegas... CitizenLab analysis of the nation-state side of things: https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... Apple update: https://support.apple.com/en-us/HT207107 https://support.apple.com/en-us/HT207107

deleted 10y ago
[deleted]
tkinom 10y ago
Love that Technical Analysis. If Apple, Google, MS, Linux distribution does the following: * Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere. * Check and audit the system files from time to time and notify the user when change happen. Would it prevent these type attack or at lease notify the user that system security has be compromised?
- omgbear 10y ago
  Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read calls. http://linux.die.net/man/8/tripwire http://linux.die.net/man/8/tripwire
  - eriknstr 10y ago
    Some years ago, I had Tripwire installed for a few days but quickly removed it again because whenever I upgraded installed packages, I'd get a storm of messages about files which had changed and that was just annoying since I was the one who had initiated the action that caused the files to change, but at the same time there were so many files that changed of course, that I had no way of distinguishing legitimate changes (as they all were) from any potential illegitimate changes.

davidu 10y ago

Yep -- This is legit security research. Excellent research.

mtgx 10y ago

> Amazing work by Lookout and Citizen Lab. Hopefully Apple "made it rain" on these guys (with cash).

linkregister 10y ago

When I wrote the above comment, this thread was linked to the Lookout blog page, not the more appropriate citizenlab page.