8 ms·

Police tracked a terror suspect until his phone went dark after Facebook warning

65 points by vo2maxer 7y ago

alanfranz 7y ago
This will, again, spark the debate over the need for a "legal backdoor". Facebook did a great service to the user, after all. Disclaimer: I did only read the beginning of the article, because of the paywall.
- JohnFen 7y ago
  I'm guessing that sparking the debate over backdoors is the entire reason that this article exists.
GhettoMaestro 7y ago
Non-paywall link: https://www.morningstar.com/news/dow-jones/202001026663/police-tracked-a-terror-suspect-until-his-phone-went-dark-after-a-facebook-warning https://www.morningstar.com/news/dow-jones/202001026663/poli...
ThrowawayIP 7y ago
Is this just a way of spinning that out of 1400 people targeted by this spyware, ONE was an actual suspected terrorist? Edited to show that the person was only suspected of terrorism.
- JohnFen 7y ago
  > ONE was an actual terrorist I have the disadvantage of not being able to read the article, but the headline, at least, says he's a suspected terrorist, not an actual terrorist. I know this was in western Europe, not the US, but in the US, the distinction between "suspected" and proven is really very important, because we have a strong track record of suspecting innocent people of being terrorists.
  - ThrowawayIP 7y ago
    You are very right. Edited to reflect that.
  - pergadad 7y ago
    The same distinction applies in any Western democracy. That said, most European countries wouldn't go about tracking vast numbers of people - especially with such a deep intervention there will be courts involved before they are allowed to start tracking. So while the final evidence is not there there certainly will have been quite strong hints else they'd never have gotten the court order.
  - vo2maxer 7y ago
    http://archive.md/Ndy9p http://archive.md/Ndy9p
- nimbius 7y ago
  the timing is of this article is rather suspect since NSO was recently mass-banned from Facebook...since no ones really commenting on this from the state actor or malware vendor side, i assume we just want to reaffirm the hacking groups business state in 2020
- tastroder 7y ago
  For me this quote of the investigator being informed by the software manufacturer is the best part of the article: > "No, that can't be right. Why would they do that?" the official said he asked his contact, thinking it a joke. Maybe don't buy spyware from malicious actors. It's ridiculous that investigators with this amount of power to invade on suspects most intimate areas of life aren't close to sufficiently briefed. Does somebody have a source on which agency the European official is supposed to be from? Using spyware that's also used by authoritarian regimes must be a bad joke. Not that our German homebrewn spyware would be any more ethical but I'd have thought that EU level agencies would at least do some level of due diligence.
  - AnssiH 7y ago
    > I'd have thought that EU level agencies would at least do some level of due diligence. I don't think the article made any reference to EU level agencies, though. It seemed to only talk about "European officials", "Western agencies", etc., which could be EU-level or local.
    - tastroder 7y ago
      Oh right, that's quite possible, thanks.
- deleted 7y ago
  [deleted]
bartread 7y ago
Well I can't read the entire article but here's a question: if 1400 people were notified, is that likely to indicate the approximate number of accounts targeted by NSO Group as part of this (or other) investigations?
- GhettoMaestro 7y ago
  Check this link - it is non-paywall version: https://www.morningstar.com/news/dow-jones/202001026663/police-tracked-a-terror-suspect-until-his-phone-went-dark-after-a-facebook-warning https://www.morningstar.com/news/dow-jones/202001026663/poli...
Havoc 7y ago
That's kinda how encryption works. Keeps everyones comminication safe. Incl terrorists. Society just need to decide how it wants to play this because its an either or proposition. There is no technical encryption protocol that works only for the good guys. Unfortunately the legislators are too thick to realise this simple fact.
- rubyfan 7y ago
  They aren’t too thick. They just don’t care.
- nyokodo 7y ago
  Assuming that society decided that encrypted communication was a common good and diligently protected it, something that I support, it's important to consider what this really means and what it doesn't mean. Law enforcement and national security agencies will retain all other means of investigating and tracking threats. It does mean that it's harder for them to casually snoop on everyone for no good reason.
  - matheusmoreira 7y ago
    > It does mean that it's harder for them to casually snoop on everyone for no good reason. It should be straight up impossible.
- im3w1l 7y ago
  Interesting. By making the implicit explicit you open it to questioning. Is it really either or? Backdoored encryption is an interesting concept, but suffers from the problem that the bad guys could get their hands on the key. But could there be another way? Something like k-out-of-n keyholders have to agree for the backdoor to open. Shamir's secret sharing could do it, but has the drawbacks that it's one-shot and that someone has to know the key to set the scheme up. You want every investigation to require a new k-out-of-n agreement. Ultimately we ought to design society so that a large group (legitimate protest) of people can defy the government but a small group (criminal gang) cannot.
makomk 7y ago
For context, this is the malware which Saudi Arabia used to gather the conversations with journalist and activist Jamal Khashoggi that led them to decide to brutally murder and dismember him in their embassy. If there was ever any moral justification for keeping the users who'd been compromised in the dark, I reckon it died with him.
- jonplackett 7y ago
  Politicians just aren’t willing to get involved with the feasibility and the nitty gritty of what it would mean to break encryption. Or maybe they aren’t technically minded enough. They ask for what seems like a reasonable request - let us read terrorists’ emails if we have a warrant, without affecting everyone else. Anyone non-technical would probably vote for this no problem. They don’t understand it’s just not possible without creating some impossible to keep secret master key. I guess politicians are used to giving other people problems and just expecting them to figure it out.
  - Haga 7y ago
    Like factory managers demanding robots to go faster then the physics of momentum and brakes would allow.
alasdair_ 7y ago
As a reminder, the NSO group routinely sells to authoritarian regimes that use the software to crack down on human rights activists and political opponents. Their software was used in the murder of Jamal Kashogi by the Saudis as well as being used to spy on journalists worldwide.
deleted 7y ago
[deleted]
SeekingMeaning 7y ago
http://archive.is/ndYJv http://archive.is/ndYJv
- antpls 7y ago
  I get an "ERR_CONNECTION_REFUSED" from France trying to access this link
meowface 7y ago
This might be an unpopular opinion, but I think it's fine if Facebook refrains from sending (attempted) breach notifications if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order sent to Facebook. Then the relevant law enforcement agencies can just tell Facebook "hey, please don't warn [X future-mass murder suspect] about anything", and they can comply with a clean conscience. I think people should have a right to privacy, and I think law enforcement agencies should have a right to monitor potential near-future massacre-committers on a limited and singly-targeted basis. Dragnet surveillance is very different from surveiling a single individual for a specific and dire reason. Now, if they never sent Facebook a signed court order related to this matter, then it's entirely the agency's fault. So, in my opinion, the issue here is the choice of contractor (and the agency apparently not sending Facebook a court order??); NSO has so many ethical issues (specifically that they're a hired gun that'll fire no matter the wielder or their intent) that Facebook has a moral obligation to send these warnings. Pick someone who actually aligns with your goals, agencies. A firm you could actually theoretically work for yourself and still sleep peacefully at night. And if you can't get one, then do it yourself.
- JumpCrisscross 7y ago
  > if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order. How is Facebook supposed to determine this? All they know is X was breached by an NSO Group tool. Nobody presented Facebook with a warrant. Nobody even told them who is doing the breaching. It could be the French or the FBI or the Saudis, or a terrorist cell.
  - meowface 7y ago
    Right, that's why I brought up the issue about the lack of warrant/court order. The agency involved are idiots and should have completely expected this if they didn't send Facebook a court order. (I've now edited my post to make that clearer.) I'm just trying to argue that, I think, in a grand theoretical sense, this sort of behavior is not necessarily unethical of law enforcement agencies if they send a signed court order and work with an ethical contractor instead of NSO or Black Cube or whoever.
rubyfan 7y ago
It’s interesting that as a corporation one can do things that would otherwise be illegal as an individual. It’s also interesting that governments are willing to use these services which probably are illegal.
- o-__-o 7y ago
  >It’s interesting that as a corporation one can do things that would otherwise be illegal as an individual. Can you elaborate on this one more? A corporation that does illegal things cannot be criminally prosecuted, but if a member or director authorizes criminal activity then the government can pierce the corporate veil and prosecute the individual(s) directly. Example: eCorp directors have a grudge against xCorp's cleaning lady so they hire a hitman and pay for her death. the police would arrest the directors and any parties involved and they will seize both personal and business assets related to the crime. Cleaning lady's family hires a lawyer and sues eCorp and each director personally for damages. eCorp loses and pays gobs of money. each director loses and pays whatever gobs of money they have left. Ergo, a corporation did something that was illegal (conspired and then paid for a killing) which left them civilly liable. Then the corporate veil was pierced and all of the guilty were found and charged. The government wouldn't use this service because it is illegal. If you are making an overly general and vague comment on the legality of stingrays.. there is nothing illegal about hosting a BSS/LTE station with Voip and SMS integration and logging all of the MACs of local phones as they connect. The secrecy comes from the police not wanting their methods coming out in legal texts for public knowledge.
  - rubyfan 7y ago
    I was specifically referring to this case. To hack a phone or account is generally an illegal activity. The government seems not even interested in piercing the veil on this type of activity which is the issue I’m bringing up. I’m not entirely sure why you’re mentioning stingrays and IANAL but what you describe sounds illegal under 18 U.S. Code § 2511[1]. But again for some reason a corporation is making these devices and selling them (also illegal under §2512[2]). I presume they are selling to law enforcement and pseudo law enforcement for use where a wiretap is not obtained (otherwise they can just lean on the carrier who is legally obliged) which would seem illegal under ECPA [3] even with its problems. There’s a whole section of EU law that covers man in the middle, hacking, data protection, etc. that would also make this specific case cut and dry. A government agency crying that Facebook notified an account holder their account was hacked by their corporate contractor seems beyond the pale. Further that news agencies publish this story with a slant that Facebook or Apple have somehow enabled terrorists is shameful. We should be holding our governments accountable to follow the law and obtain warrants. In the US all the corporate support they need is built into laws like CALEA and USA PATRIOT Act, the least our governments can do is follow the laws we entrust them to protect. [1] https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2511 [2] https://www.law.cornell.edu/uscode/text/18/2512 https://www.law.cornell.edu/uscode/text/18/2512 [3] https://en.m.wikipedia.org/wiki/Electronic_Communications_Privacy_Act https://en.m.wikipedia.org/wiki/Electronic_Communications_Pr...
JumpCrisscross 7y ago
> The European official said his own unit is so secretive that senior security and government officials in his own country don’t know about the methods and tools they deploy. When evidence gathered by his unit is used in court, efforts are made to hide the true source of the evidence. The "official" shot their pitch in the leg with this line.
- ClumsyPilot 7y ago
  Accountability? Check and balances? Potential to abuse of power and position? Justice and "hide the true source of the evidence in court"? If this guy bragging or trolling? I am genuinely confused. But I can only assume that many in intelligence services act in a similar manner, i.e. NSA, GCHQ, etc.
yellow_lead 7y ago
Would love more details about how Fb detected this. As usual, the article is light on those though.
- Scoundreller 7y ago
  My guess is that WhatsApp is continuously doing scans of its binaries, memory and other states that should be constant, and phones home with those signatures. When the phone homes are unexpected, a lot more than the signatures start getting phoned home for further investigation. Add some other constraints on how big the binary/memory space can be in the sandbox and an attacker would have trouble running a shadow copy to provide the right responses. Maybe some timing checks too where the system denies anything that starts taking longer than it should and phones home with it. All just a thought though.
  - londons_explore 7y ago
    WhatsApp keeps debug logs of a lot of things. The exploit NSO used required a video call, which requires Facebook's servers to initiate, so is probably logged. I would guess all those video calls had a few fields set differently compared to the official client, so it was easy to filter the logs and find all instances of it.
Scoundreller 7y ago
This is a risk that all “non-authoritarian” regimes face when renting RATs: if the same RAT is being rented to “authoritarian” regimes, there’s a lot more motivation by everyone to close the vuln. “Not your 0day.... so not your 0day”.
chkaloon 7y ago
Sounds like the court and agency messed up by not including Facebook in the original court order. I don't blame Facebook here.
newnewpdro 7y ago
"Technology companies such as Facebook and Apple Inc. over recent years have strengthened the security of their systems to the point where even the tech companies themselves can't provide law-enforcement agencies with messages created on their own systems." Riiight, that's certainly what they'd like the world to believe! When the software can be modified OTA without the user's knowledge, even if you did have e2e encryption without any sidechannels or backdoors at the client software today, you might not when you wake up tomorrow.
- londons_explore 7y ago
  So far, the principle that a company must not be required to do work to assist law enforcement (ie. Make a new version of WhatsApp to upload to the suspects phone) has held strong. I suspect it won't for long though.
brlewis 7y ago
I use Android, but I thought iOS had good defenses against this kind of attack NSO's Pegasus used, as described in Forbes in this article under "A malicious text arrives". What's the UX after a user clicks the link? https://www.forbes.com/sites/thomasbrewster/2018/11/21/exclusive-saudi-dissidents-hit-with-stealth-iphone-spyware-before-khashoggis-murder/#404a8c462e8b https://www.forbes.com/sites/thomasbrewster/2018/11/21/exclu...
lazylizard 7y ago
Or. Maybe. Instead of moaning about how tech is not helping. Fbi/nsa/cia can roll a few crypto libraries of their own and then mandate that all american companies/services must use those. And I'll use something else...
neonate 7y ago
http://archive.md/ndYJv http://archive.md/ndYJv
bf03ea71160 7y ago
Oh, perhaps the govt shouldn't have imported this person to begin with? Perhaps the govt also shouldn't have forced normal people to fund obviously crazy people. ...but go on.

65 points by vo2maxer 7y ago

This will, again, spark the debate over the need for a "legal backdoor". Facebook did a great service to the user, after all. Disclaimer: I did only read the beginning of the article, because of the paywall.

JohnFen 7y ago
I'm guessing that sparking the debate over backdoors is the entire reason that this article exists.

GhettoMaestro 7y ago

Non-paywall link: https://www.morningstar.com/news/dow-jones/202001026663/police-tracked-a-terror-suspect-until-his-phone-went-dark-after-a-facebook-warning https://www.morningstar.com/news/dow-jones/202001026663/poli...

ThrowawayIP 7y ago

Is this just a way of spinning that out of 1400 people targeted by this spyware, ONE was an actual suspected terrorist? Edited to show that the person was only suspected of terrorism.

JohnFen 7y ago
> ONE was an actual terrorist I have the disadvantage of not being able to read the article, but the headline, at least, says he's a suspected terrorist, not an actual terrorist. I know this was in western Europe, not the US, but in the US, the distinction between "suspected" and proven is really very important, because we have a strong track record of suspecting innocent people of being terrorists.
- ThrowawayIP 7y ago
  You are very right. Edited to reflect that.
- pergadad 7y ago
  The same distinction applies in any Western democracy. That said, most European countries wouldn't go about tracking vast numbers of people - especially with such a deep intervention there will be courts involved before they are allowed to start tracking. So while the final evidence is not there there certainly will have been quite strong hints else they'd never have gotten the court order.
- vo2maxer 7y ago
  http://archive.md/Ndy9p http://archive.md/Ndy9p
nimbius 7y ago
the timing is of this article is rather suspect since NSO was recently mass-banned from Facebook...since no ones really commenting on this from the state actor or malware vendor side, i assume we just want to reaffirm the hacking groups business state in 2020
tastroder 7y ago
For me this quote of the investigator being informed by the software manufacturer is the best part of the article: > "No, that can't be right. Why would they do that?" the official said he asked his contact, thinking it a joke. Maybe don't buy spyware from malicious actors. It's ridiculous that investigators with this amount of power to invade on suspects most intimate areas of life aren't close to sufficiently briefed. Does somebody have a source on which agency the European official is supposed to be from? Using spyware that's also used by authoritarian regimes must be a bad joke. Not that our German homebrewn spyware would be any more ethical but I'd have thought that EU level agencies would at least do some level of due diligence.
- AnssiH 7y ago
  > I'd have thought that EU level agencies would at least do some level of due diligence. I don't think the article made any reference to EU level agencies, though. It seemed to only talk about "European officials", "Western agencies", etc., which could be EU-level or local.
  - tastroder 7y ago
    Oh right, that's quite possible, thanks.
deleted 7y ago
[deleted]

bartread 7y ago

Well I can't read the entire article but here's a question: if 1400 people were notified, is that likely to indicate the approximate number of accounts targeted by NSO Group as part of this (or other) investigations?

GhettoMaestro 7y ago
Check this link - it is non-paywall version: https://www.morningstar.com/news/dow-jones/202001026663/police-tracked-a-terror-suspect-until-his-phone-went-dark-after-a-facebook-warning https://www.morningstar.com/news/dow-jones/202001026663/poli...

Havoc 7y ago

That's kinda how encryption works. Keeps everyones comminication safe. Incl terrorists. Society just need to decide how it wants to play this because its an either or proposition. There is no technical encryption protocol that works only for the good guys. Unfortunately the legislators are too thick to realise this simple fact.

rubyfan 7y ago
They aren’t too thick. They just don’t care.
nyokodo 7y ago
Assuming that society decided that encrypted communication was a common good and diligently protected it, something that I support, it's important to consider what this really means and what it doesn't mean. Law enforcement and national security agencies will retain all other means of investigating and tracking threats. It does mean that it's harder for them to casually snoop on everyone for no good reason.
- matheusmoreira 7y ago
  > It does mean that it's harder for them to casually snoop on everyone for no good reason. It should be straight up impossible.
im3w1l 7y ago
Interesting. By making the implicit explicit you open it to questioning. Is it really either or? Backdoored encryption is an interesting concept, but suffers from the problem that the bad guys could get their hands on the key. But could there be another way? Something like k-out-of-n keyholders have to agree for the backdoor to open. Shamir's secret sharing could do it, but has the drawbacks that it's one-shot and that someone has to know the key to set the scheme up. You want every investigation to require a new k-out-of-n agreement. Ultimately we ought to design society so that a large group (legitimate protest) of people can defy the government but a small group (criminal gang) cannot.

makomk 7y ago

For context, this is the malware which Saudi Arabia used to gather the conversations with journalist and activist Jamal Khashoggi that led them to decide to brutally murder and dismember him in their embassy. If there was ever any moral justification for keeping the users who'd been compromised in the dark, I reckon it died with him.

jonplackett 7y ago
Politicians just aren’t willing to get involved with the feasibility and the nitty gritty of what it would mean to break encryption. Or maybe they aren’t technically minded enough. They ask for what seems like a reasonable request - let us read terrorists’ emails if we have a warrant, without affecting everyone else. Anyone non-technical would probably vote for this no problem. They don’t understand it’s just not possible without creating some impossible to keep secret master key. I guess politicians are used to giving other people problems and just expecting them to figure it out.
- Haga 7y ago
  Like factory managers demanding robots to go faster then the physics of momentum and brakes would allow.

alasdair_ 7y ago

As a reminder, the NSO group routinely sells to authoritarian regimes that use the software to crack down on human rights activists and political opponents. Their software was used in the murder of Jamal Kashogi by the Saudis as well as being used to spy on journalists worldwide.

deleted 7y ago

[deleted]

SeekingMeaning 7y ago

http://archive.is/ndYJv http://archive.is/ndYJv

antpls 7y ago
I get an "ERR_CONNECTION_REFUSED" from France trying to access this link

meowface 7y ago

This might be an unpopular opinion, but I think it's fine if Facebook refrains from sending (attempted) breach notifications if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order sent to Facebook. Then the relevant law enforcement agencies can just tell Facebook "hey, please don't warn [X future-mass murder suspect] about anything", and they can comply with a clean conscience. I think people should have a right to privacy, and I think law enforcement agencies should have a right to monitor potential near-future massacre-committers on a limited and singly-targeted basis. Dragnet surveillance is very different from surveiling a single individual for a specific and dire reason. Now, if they never sent Facebook a signed court order related to this matter, then it's entirely the agency's fault. So, in my opinion, the issue here is the choice of contractor (and the agency apparently not sending Facebook a court order??); NSO has so many ethical issues (specifically that they're a hired gun that'll fire no matter the wielder or their intent) that Facebook has a moral obligation to send these warnings. Pick someone who actually aligns with your goals, agencies. A firm you could actually theoretically work for yourself and still sleep peacefully at night. And if you can't get one, then do it yourself.

JumpCrisscross 7y ago
> if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order. How is Facebook supposed to determine this? All they know is X was breached by an NSO Group tool. Nobody presented Facebook with a warrant. Nobody even told them who is doing the breaching. It could be the French or the FBI or the Saudis, or a terrorist cell.
- meowface 7y ago
  Right, that's why I brought up the issue about the lack of warrant/court order. The agency involved are idiots and should have completely expected this if they didn't send Facebook a court order. (I've now edited my post to make that clearer.) I'm just trying to argue that, I think, in a grand theoretical sense, this sort of behavior is not necessarily unethical of law enforcement agencies if they send a signed court order and work with an ethical contractor instead of NSO or Black Cube or whoever.

rubyfan 7y ago

It’s interesting that as a corporation one can do things that would otherwise be illegal as an individual. It’s also interesting that governments are willing to use these services which probably are illegal.

o-__-o 7y ago
>It’s interesting that as a corporation one can do things that would otherwise be illegal as an individual. Can you elaborate on this one more? A corporation that does illegal things cannot be criminally prosecuted, but if a member or director authorizes criminal activity then the government can pierce the corporate veil and prosecute the individual(s) directly. Example: eCorp directors have a grudge against xCorp's cleaning lady so they hire a hitman and pay for her death. the police would arrest the directors and any parties involved and they will seize both personal and business assets related to the crime. Cleaning lady's family hires a lawyer and sues eCorp and each director personally for damages. eCorp loses and pays gobs of money. each director loses and pays whatever gobs of money they have left. Ergo, a corporation did something that was illegal (conspired and then paid for a killing) which left them civilly liable. Then the corporate veil was pierced and all of the guilty were found and charged. The government wouldn't use this service because it is illegal. If you are making an overly general and vague comment on the legality of stingrays.. there is nothing illegal about hosting a BSS/LTE station with Voip and SMS integration and logging all of the MACs of local phones as they connect. The secrecy comes from the police not wanting their methods coming out in legal texts for public knowledge.
- rubyfan 7y ago
  I was specifically referring to this case. To hack a phone or account is generally an illegal activity. The government seems not even interested in piercing the veil on this type of activity which is the issue I’m bringing up. I’m not entirely sure why you’re mentioning stingrays and IANAL but what you describe sounds illegal under 18 U.S. Code § 2511[1]. But again for some reason a corporation is making these devices and selling them (also illegal under §2512[2]). I presume they are selling to law enforcement and pseudo law enforcement for use where a wiretap is not obtained (otherwise they can just lean on the carrier who is legally obliged) which would seem illegal under ECPA [3] even with its problems. There’s a whole section of EU law that covers man in the middle, hacking, data protection, etc. that would also make this specific case cut and dry. A government agency crying that Facebook notified an account holder their account was hacked by their corporate contractor seems beyond the pale. Further that news agencies publish this story with a slant that Facebook or Apple have somehow enabled terrorists is shameful. We should be holding our governments accountable to follow the law and obtain warrants. In the US all the corporate support they need is built into laws like CALEA and USA PATRIOT Act, the least our governments can do is follow the laws we entrust them to protect. [1] https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2511 [2] https://www.law.cornell.edu/uscode/text/18/2512 https://www.law.cornell.edu/uscode/text/18/2512 [3] https://en.m.wikipedia.org/wiki/Electronic_Communications_Privacy_Act https://en.m.wikipedia.org/wiki/Electronic_Communications_Pr...

JumpCrisscross 7y ago

> The European official said his own unit is so secretive that senior security and government officials in his own country don’t know about the methods and tools they deploy. When evidence gathered by his unit is used in court, efforts are made to hide the true source of the evidence. The "official" shot their pitch in the leg with this line.

ClumsyPilot 7y ago
Accountability? Check and balances? Potential to abuse of power and position? Justice and "hide the true source of the evidence in court"? If this guy bragging or trolling? I am genuinely confused. But I can only assume that many in intelligence services act in a similar manner, i.e. NSA, GCHQ, etc.

yellow_lead 7y ago

Would love more details about how Fb detected this. As usual, the article is light on those though.

Scoundreller 7y ago
My guess is that WhatsApp is continuously doing scans of its binaries, memory and other states that should be constant, and phones home with those signatures. When the phone homes are unexpected, a lot more than the signatures start getting phoned home for further investigation. Add some other constraints on how big the binary/memory space can be in the sandbox and an attacker would have trouble running a shadow copy to provide the right responses. Maybe some timing checks too where the system denies anything that starts taking longer than it should and phones home with it. All just a thought though.
- londons_explore 7y ago
  WhatsApp keeps debug logs of a lot of things. The exploit NSO used required a video call, which requires Facebook's servers to initiate, so is probably logged. I would guess all those video calls had a few fields set differently compared to the official client, so it was easy to filter the logs and find all instances of it.

Scoundreller 7y ago

This is a risk that all “non-authoritarian” regimes face when renting RATs: if the same RAT is being rented to “authoritarian” regimes, there’s a lot more motivation by everyone to close the vuln. “Not your 0day.... so not your 0day”.

chkaloon 7y ago

Sounds like the court and agency messed up by not including Facebook in the original court order. I don't blame Facebook here.

newnewpdro 7y ago

"Technology companies such as Facebook and Apple Inc. over recent years have strengthened the security of their systems to the point where even the tech companies themselves can't provide law-enforcement agencies with messages created on their own systems." Riiight, that's certainly what they'd like the world to believe! When the software can be modified OTA without the user's knowledge, even if you did have e2e encryption without any sidechannels or backdoors at the client software today, you might not when you wake up tomorrow.

londons_explore 7y ago
So far, the principle that a company must not be required to do work to assist law enforcement (ie. Make a new version of WhatsApp to upload to the suspects phone) has held strong. I suspect it won't for long though.

brlewis 7y ago

I use Android, but I thought iOS had good defenses against this kind of attack NSO's Pegasus used, as described in Forbes in this article under "A malicious text arrives". What's the UX after a user clicks the link? https://www.forbes.com/sites/thomasbrewster/2018/11/21/exclusive-saudi-dissidents-hit-with-stealth-iphone-spyware-before-khashoggis-murder/#404a8c462e8b https://www.forbes.com/sites/thomasbrewster/2018/11/21/exclu...

lazylizard 7y ago

Or. Maybe. Instead of moaning about how tech is not helping. Fbi/nsa/cia can roll a few crypto libraries of their own and then mandate that all american companies/services must use those. And I'll use something else...

neonate 7y ago

http://archive.md/ndYJv http://archive.md/ndYJv

bf03ea71160 7y ago

Oh, perhaps the govt shouldn't have imported this person to begin with? Perhaps the govt also shouldn't have forced normal people to fund obviously crazy people. ...but go on.