3 ms·

Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated gue

Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?

sp332 7y ago
Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.
detaro 7y ago
I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib. It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix. In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?
PeterisP 7y ago
It's very hard to tell because we've observed NSOs using comparable vulnerabilities both very sparingly against select individual targets, and also observed exploits used in a mass fashion against whole populations such as the recent uncovering of exploits targeting Uyghur communities.
verbify 7y ago
When you say 'authorities' that includes countries that persecute civil right activists. Amnesty International has specifically criticized NSO specifically regarding UAE activist Ahmed Mansoor. He is currently serving 10 years in jail. UN human rights experts considered his arrest and imprisonment "a direct attack on the legitimate work of human rights defenders". He was monitored by the UAE using NSO technologies. Amnesty International have also complained that they have been targeted with NSO Group technology - specifically Pegasus. They're currently launching a legal case in Israel to restrict their export license. A separate case claims that NSO Group used Pegasus to help the Saudis spy on Khashoggi, who was brutally murdered in the Saudi embassy. I don't think we need to argue about the bad guys in this case. Sources: https://www.amnesty.org/en/latest/news/2019/09/nso-spyware-human-rights/ https://www.amnesty.org/en/latest/news/2019/09/nso-spyware-h... https://www.amnesty.org/en/latest/news/2019/05/israel-amnesty-legal-action-stop-nso-group-web-of-surveillance/ https://www.amnesty.org/en/latest/news/2019/05/israel-amnest... https://www.nytimes.com/2018/12/02/world/middleeast/saudi-khashoggi-spyware-israel.html https://www.nytimes.com/2018/12/02/world/middleeast/saudi-kh...
- mehrdadn 7y ago
  This is supposed to justify putting millions of more people at an even larger risk of getting hacked?
  - verbify 7y ago
    The upside is a certainty - giving a heads up to people we know are getting hacked, and whose repercussions for getting hacked could mean imprisonment or death. The downside is allowing other hackers to maybe produce an exploit in time (before this bug gets patched), and maybe hack some more people. I'd say the upsides outweigh the downsides.

Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?

sp332 7y ago

Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.

detaro 7y ago

I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib. It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix. In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?

PeterisP 7y ago

It's very hard to tell because we've observed NSOs using comparable vulnerabilities both very sparingly against select individual targets, and also observed exploits used in a mass fashion against whole populations such as the recent uncovering of exploits targeting Uyghur communities.

verbify 7y ago

When you say 'authorities' that includes countries that persecute civil right activists. Amnesty International has specifically criticized NSO specifically regarding UAE activist Ahmed Mansoor. He is currently serving 10 years in jail. UN human rights experts considered his arrest and imprisonment "a direct attack on the legitimate work of human rights defenders". He was monitored by the UAE using NSO technologies. Amnesty International have also complained that they have been targeted with NSO Group technology - specifically Pegasus. They're currently launching a legal case in Israel to restrict their export license. A separate case claims that NSO Group used Pegasus to help the Saudis spy on Khashoggi, who was brutally murdered in the Saudi embassy. I don't think we need to argue about the bad guys in this case. Sources: https://www.amnesty.org/en/latest/news/2019/09/nso-spyware-human-rights/ https://www.amnesty.org/en/latest/news/2019/09/nso-spyware-h... https://www.amnesty.org/en/latest/news/2019/05/israel-amnesty-legal-action-stop-nso-group-web-of-surveillance/ https://www.amnesty.org/en/latest/news/2019/05/israel-amnest... https://www.nytimes.com/2018/12/02/world/middleeast/saudi-khashoggi-spyware-israel.html https://www.nytimes.com/2018/12/02/world/middleeast/saudi-kh...

mehrdadn 7y ago
This is supposed to justify putting millions of more people at an even larger risk of getting hacked?
- verbify 7y ago
  The upside is a certainty - giving a heads up to people we know are getting hacked, and whose repercussions for getting hacked could mean imprisonment or death. The downside is allowing other hackers to maybe produce an exploit in time (before this bug gets patched), and maybe hack some more people. I'd say the upsides outweigh the downsides.