4 ms·

Whatsapp Attributes Hack of 1,400 Users to NSO Group Technology

70 points by vuln 7y ago

brenden2 7y ago
Seems like Facebook's strategy for dealing with their PR problem is to blame someone else for the flaws in their product as a diversion tactic. It's not a good sign when FB is unwilling to take responsibility for the mess they've made. How can anyone trust this company ever again? Unfortunately, I think if they can win the PR war then they'll probably be fine. At this point the only thing that matters is public perception, and the one thing FB has going for it is that many people don't even realize that Facebook, WhatsApp, and Instagram are all the same company.
- vkou 7y ago
  So, hold on. Facebook shipped a product with a security bug. There's nothing unusual about this. Every software with non-trivial functionality has, or has had at some point in the past, many security bugs. What exactly is the scandal, here? Why are you holding Facebook to a standard that no other company, or open source project is able to meet?
  - brenden2 7y ago
    FB has enough resources to do a bit of auditing to catch these kinds of bugs. They are quite literally one of the wealthiest companies in the world. They have somewhere on the order of $40b in cash. Instead they allocate most of their resources into figuring out how to get people to click on ads.
    - kick 7y ago
      Only one person on the entire planet has demonstrated the ability to write security hole-free software, Daniel J. Bernstein, and it's unlikely that Facebook would be able to hire him and then get him to rewrite their entire stack.
ianhawes 7y ago
It will be interesting to see whether the DOJ indicts NSO Group executives in the same way that they went after the Chinese. If I were an NSO Group employee, I would think twice before entering the United States, let alone venturing outside of Israel.
- paganel 7y ago
  > It will be interesting to see whether the DOJ indicts NSO Group executives in the same way that they went after the Chinese. They most probably won’t.
  - LurkersWillLurk 7y ago
    To build on this, I don't think the US government sees NSO Group the same way they see foreign hackers. Federal law enforcement and the intelligence community probably see the defensive losses as an acceptable casualty if it means reaping the offensive benefits of NSO's software. Edit: https://www.vice.com/en_us/article/3kxk9j/dea-didnt-buy-malware-nso-group-too-expensive https://www.vice.com/en_us/article/3kxk9j/dea-didnt-buy-malw... The Drug Enforcement Administration would have bought NSO's software, but it was too expensive.
- jbob2000 7y ago
  Are you serious? Israel has the US Government by the balls. The first thing the Republicans did when Trump got elected was to move the US embassy to Jerusalem. They didn't even skip a beat, it was one of the first things they did (Speaking of that, we just had a federal election in Canada, where one of the primary election promises from our right-wing party was to move the Canadian embassy to Jerusalem... strange... Thankfully they didn't get elected). I fully expect that NSO will be allowed to act with impunity. If anyone in the US government tries to stop them, AIPAC would pull all their campaign funding from the Repubs or Dems (whichever party's lackey did it) and they'd never get elected again.
  - cc81 7y ago
    >AIPAC would pull all their campaign funding from the Repubs or Dems (whichever party's lackey did it) and they'd never get elected again. This is a pretty interesting comment because AIPAC does not even contribute directly to any candidates but it is the center of MANY conspiracy theories. I'm not going to downplay the lobbying but let us actually look at the numbers, first individuals: >Though AIPAC as an organization cannot contribute to campaigns, individuals who work for the organization have. In the 2018 election cycle, individuals affiliated with the organization donated just $21,350 to 14 different candidates, nine of whom were Democrats. No one associated with AIPAC gave any contributions to McCarthy. Not that much and I doubt it would break any campaign if they stopped. But let's see how much the organization actually donated: >AIPAC is a significant player in terms of lobbying, accounting for the vast majority of lobbying spending by pro-Israel groups, spending more than $3.5 million in 2018. The organization was staunchly opposed to the Iran Nuclear Deal in 2015, lobbied extensively against it and supported the Trump administration’s withdrawal from the agreement. Ok, 3.5 million dollars is a lot of money but let us compare them to ...let's say Google who spent over 21 million that year or any of the top 20 or so it is small potatoes. https://www.opensecrets.org/federal-lobbying/top-spenders?cycle=2018 https://www.opensecrets.org/federal-lobbying/top-spenders?cy... It is interesting how people seem to think them so powerful when they don't actually spend that much in comparison and that while of course they are successful a lot of politics align with very strong American groups (Evangelicals who are very strong Trump supporters want the embassy in Jerusalem, Neocons and other remains hate Iran etc.)
Scapeghost 7y ago
Sometimes I wonder if all these hacks are a scapegoat for companies who were giving away your data anyway.
doesanyonecare 7y ago
In the case of India, it is clear that its government used it to spy & also implant false evidence on dalit activists[0] i.e. low caste people who are still made to human waste on their heads in certain parts of the country. If any NSO/NSA employee is reading, is this the kind of oppression you want your talents to aid? Pimping your mom, sister or wife to your country's leaders could be a better job. [0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-whatsapp-of-surveillance-says-bhima-koregaon-accused-were-also-targetted https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...

70 points by vuln 7y ago

Seems like Facebook's strategy for dealing with their PR problem is to blame someone else for the flaws in their product as a diversion tactic. It's not a good sign when FB is unwilling to take responsibility for the mess they've made. How can anyone trust this company ever again? Unfortunately, I think if they can win the PR war then they'll probably be fine. At this point the only thing that matters is public perception, and the one thing FB has going for it is that many people don't even realize that Facebook, WhatsApp, and Instagram are all the same company.

vkou 7y ago
So, hold on. Facebook shipped a product with a security bug. There's nothing unusual about this. Every software with non-trivial functionality has, or has had at some point in the past, many security bugs. What exactly is the scandal, here? Why are you holding Facebook to a standard that no other company, or open source project is able to meet?
- brenden2 7y ago
  FB has enough resources to do a bit of auditing to catch these kinds of bugs. They are quite literally one of the wealthiest companies in the world. They have somewhere on the order of $40b in cash. Instead they allocate most of their resources into figuring out how to get people to click on ads.
  - kick 7y ago
    Only one person on the entire planet has demonstrated the ability to write security hole-free software, Daniel J. Bernstein, and it's unlikely that Facebook would be able to hire him and then get him to rewrite their entire stack.

ianhawes 7y ago

It will be interesting to see whether the DOJ indicts NSO Group executives in the same way that they went after the Chinese. If I were an NSO Group employee, I would think twice before entering the United States, let alone venturing outside of Israel.

paganel 7y ago
> It will be interesting to see whether the DOJ indicts NSO Group executives in the same way that they went after the Chinese. They most probably won’t.
- LurkersWillLurk 7y ago
  To build on this, I don't think the US government sees NSO Group the same way they see foreign hackers. Federal law enforcement and the intelligence community probably see the defensive losses as an acceptable casualty if it means reaping the offensive benefits of NSO's software. Edit: https://www.vice.com/en_us/article/3kxk9j/dea-didnt-buy-malware-nso-group-too-expensive https://www.vice.com/en_us/article/3kxk9j/dea-didnt-buy-malw... The Drug Enforcement Administration would have bought NSO's software, but it was too expensive.
jbob2000 7y ago
Are you serious? Israel has the US Government by the balls. The first thing the Republicans did when Trump got elected was to move the US embassy to Jerusalem. They didn't even skip a beat, it was one of the first things they did (Speaking of that, we just had a federal election in Canada, where one of the primary election promises from our right-wing party was to move the Canadian embassy to Jerusalem... strange... Thankfully they didn't get elected). I fully expect that NSO will be allowed to act with impunity. If anyone in the US government tries to stop them, AIPAC would pull all their campaign funding from the Repubs or Dems (whichever party's lackey did it) and they'd never get elected again.
- cc81 7y ago
  >AIPAC would pull all their campaign funding from the Repubs or Dems (whichever party's lackey did it) and they'd never get elected again. This is a pretty interesting comment because AIPAC does not even contribute directly to any candidates but it is the center of MANY conspiracy theories. I'm not going to downplay the lobbying but let us actually look at the numbers, first individuals: >Though AIPAC as an organization cannot contribute to campaigns, individuals who work for the organization have. In the 2018 election cycle, individuals affiliated with the organization donated just $21,350 to 14 different candidates, nine of whom were Democrats. No one associated with AIPAC gave any contributions to McCarthy. Not that much and I doubt it would break any campaign if they stopped. But let's see how much the organization actually donated: >AIPAC is a significant player in terms of lobbying, accounting for the vast majority of lobbying spending by pro-Israel groups, spending more than $3.5 million in 2018. The organization was staunchly opposed to the Iran Nuclear Deal in 2015, lobbied extensively against it and supported the Trump administration’s withdrawal from the agreement. Ok, 3.5 million dollars is a lot of money but let us compare them to ...let's say Google who spent over 21 million that year or any of the top 20 or so it is small potatoes. https://www.opensecrets.org/federal-lobbying/top-spenders?cycle=2018 https://www.opensecrets.org/federal-lobbying/top-spenders?cy... It is interesting how people seem to think them so powerful when they don't actually spend that much in comparison and that while of course they are successful a lot of politics align with very strong American groups (Evangelicals who are very strong Trump supporters want the embassy in Jerusalem, Neocons and other remains hate Iran etc.)

Scapeghost 7y ago

Sometimes I wonder if all these hacks are a scapegoat for companies who were giving away your data anyway.

doesanyonecare 7y ago

In the case of India, it is clear that its government used it to spy & also implant false evidence on dalit activists[0] i.e. low caste people who are still made to human waste on their heads in certain parts of the country. If any NSO/NSA employee is reading, is this the kind of oppression you want your talents to aid? Pimping your mom, sister or wife to your country's leaders could be a better job. [0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-whatsapp-of-surveillance-says-bhima-koregaon-accused-were-also-targetted https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...