24 ms·
Journalist’s phone hacked: all he had to do was visit any website
- mywacaday 6y agoWould factory resetting your phone on a regular basis remove the hack?
- gruez 6y agoConsidering that we haven't had untethered jailbreaks in forever now, I think even a restart would do.
- aeternum 6y agoPossibly, but advanced malware like this can add many re-infection paths, opening a safari tab might be sufficient to trigger a re-infect upon browser launch. Many apps also make periodic background http requests, might be enough to just hijack one of those to trigger the RCE after reboot.
- Reelin 6y agoI don't think it's safe to assume that Pegasus can't manage persistence. This isn't run-of-the-mill malware we're talking about.
- christofosho 6y agoOn HN I've seen a lot of unencrypted sites lately. I don't personally feel comfortable browsing on them, so I avoid them. Near the end of the article here, it mentions that this is only possible on an unencrypted website. Is there a reason why so many people are not encrypting their websites? Even browsers seem to have picked up on the insecure nature of http. Please correct me if I'm wrong here, I just find it very strange how many links I've inspected only to see a lack of TLS/SSL.
- qwerty456127 6y agoObviously, HTTPS adds complexity many people find unnecessary + it puts you in position of depending on a 3-rd party - a certification authority. In fact you can program almost any device (including very old and simple) to be a plain old HTTP client or a server but this is not the case with modern HTTPS.
- garmaine 6y agoThanks to Let's Encrypt, this is no longer the case.
- gtirloni 6y agoLet's Encrypt is a 3rd-party.
- garmaine 6y agoI was responding to the second paragraph. TLS is not complicated now.
- qwerty456127 6y agoBeing easy to use does not mean uncomplicated. Your TV set probably is easy to use and was easy to get but it still is an extremely complex machine. Using as simple things as possible (but not simpler ©) is a value in its own.
- toohotatopic 6y agoThen you have a signed key but you still have to implement the crypto algorithms.
- garmaine 6y agoWhich is as easy as running one of a half dozen open source TLS proxies in front of your regular, unencrypted HTTP application port.
- josephcsible 6y agoI feel like this article makes the technique sound a lot more novel/surprising than it is. It seems like a simple case of "phone had an RCE vulnerability that got exploited by an attacker in control of the network".
- olliej 6y agoSo either they had a fraudulent cert or he was using insecure sites :-/
- amatecha 6y agoIt's probable that they were intercepting the connection and the act of hitting _any_ http site resulted in the redirection to an exploit payload. Many many sites have http requests, so you can't really blame someone for hitting a non-https site.
- olliej 6y agoYou're right it may not be his fault, but that is why all sites should be https, and sites should have the hsts header set. Essentially if you are using http:// http:// anywhere on your site (including transitively loaded resources) you are putting your users at risk - the same thing was exploited with the great cannon or whatever that DoS from the Chinese gov was called.
- amatecha 6y agoOh yeah, I agree! https should be the standard, indeed.
- nsajko 6y agoThe point is how moneyed and powerful interests align, leveraging technical expertise to target specific investigative reporters, members of civil society, etc.; with the goal of killing democracy.
- rediguanayum 6y agoThe article mentions NSO's Pegasus that the journalist victim downloaded, and presumably installed surveillance tools on his iPhone. What is Pegasus? Is it platform of browser zero days that then installs surveillance tools? Does it root kit the phone?
- mywittyname 6y agohttps://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware) From the looks of the associated CVEs, it is buffer overflow attack against Safari. The exploit is probably to use a MitM attack to inject the payload into an arbitrary website.
- olliej 6y agoIt’s easy to look up, it has historically been used to spy on human rights activists and reporters. It’s sold by the NSO group, that has repeatedly tried to smear and spy on organisations that report on them knowingly selling to and supporting governments that are using these tools to attack HRAs, etc. I assume that they have updated it since it first came to light, as the vulnerabilities at the time were all fixed. Note that the vulnerabilities that they use are all the same ones used by jailbreaks, so fixing them necessarily means preventing jailbreaks.
- saagarjha 6y ago> Note that the vulnerabilities that they use are all the same ones used by jailbreaks, so fixing them necessarily means preventing jailbreaks. Well, unless there was a method to jailbreak your device that did not require a chain of software vulnerabilities.
- nsajko 6y agoAFAIK, Pegasus seems to be the name for the spyware (surveillance tools). See https://en.wikipedia.org/wiki/NSO_Group https://en.wikipedia.org/wiki/NSO_Group https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)
- sdan 6y agoHow’s this possible? Anyway this can be prevented?
- shbooms 6y ago> All he had to do was visit one website. Any website. The author directly contradicts the headline used here: > The website must use “clear text” which means the URL starts with “http” not “https.”
- notRobot 6y agoWelcome to tech journalism. This is how it almost always is.
- bb88 6y agoConsider the following: http://google.com http://google.com https://google.com https://google.com Both wind up eventually to the same place, but the first redirects to the second. That can be a link, it can be an old bookmark, etc. Worse if it was a targeted ad, the https:// https:// link could be just a redirect back to an http:// http:// link, something the browser probably has no trouble doing.
- dmurray 6y ago> the https:// https:// link could be just a redirect back to an http:// http:// link, something the browser probably has no trouble doing. Doesn't HSTS prevent exactly this? Sure, not every website implements it, but the most visited ones overwhelmingly do - it's certainly misleading to say "any website" in that context.
- 6y ago
- nsajko 6y agoThe Citizen Lab reports (one linked from this article) about the Israeli NSO Group's Pegasus spyware have been really scary for a few years now already. This is a frightening 8-part series about the abuse of "Pegasus" in Mexico 2017-2019: https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware/ https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware... Here's a category of articles on the citizenlab.ca web site described as "Investigations into the prevalence and impact of digital espionage operations against civil society groups": https://citizenlab.ca/category/research/targeted-threats/ https://citizenlab.ca/category/research/targeted-threats/
- fortran77 6y agoNSO Group is owned by Novalpina Capital, a British company.
- CapitalistCartr 6y ago"NSO Group Technologies (NSO standing for Niv, Shalev and Omri, names of company's founders) is an Israeli technology firm whose spyware called Pegasus enables the remote surveillance of smartphones. It was founded in 2010 by Niv Carmi, Omri Lavie, and Shalev Hulio. It employed almost 500 people as of 2017, and is based in Herzliya, near Tel Aviv." --Wikipedia https://en.m.wikipedia.org/wiki/NSO_Group https://en.m.wikipedia.org/wiki/NSO_Group
- fortran77 6y agoIt's owned by a British holding firm.
- ajkjk 6y agoBecause it is an Israeli company? that's what the parent comment showed.
- titanomachy 6y ago
- bvinc 6y agoWhy aren't cell phone tower communications secured? Why aren't cell towers secured with certificates verified by the network? Why aren't stingray devices considered an attack on the cell network? If stingray devices work by tricking your phone to connect with older protocols like 3G, why aren't those protocols deprecated just like we deprecate older encryption methods that are no longer secure?
- alasdair_ 6y agoOversimplified answer: because people want their cellphone to work outside of major US cities. For example, the laws on what is allowed to use encryption and what is not differ significantly from country to country. There are also often older installations that only provide 3G support. Basically, it's complicated and there are a lot of different reasons but it mostly comes down to the world being a big place with lots of different laws and requirements, yet people want a phone that works everywhere.
- numpad0 6y agoI think it has to be 2G GSM specifically, 3G UMTS do cipher that kind of holds, also a lot of phones aren’t dynamically updatable or updated smartphones GSM downgrade attacks as well as USB SDR gears came out late 3G era, I kind of trust 3GPP guys for protection for LTE onwards but if GSM downgrade attacks are your primary concern in your life you can move to Japan and get contract on au by KDDI as KDDI flat out ignored CSFB to CDMA2000 and went all VoLTE
- gruez 6y ago>if GSM downgrade attacks are your primary concern in your life you can move to Japan and get contract on au by KDDI as KDDI flat out ignored CSFB to CDMA2000 and went all VoLTE Wouldn't it be easier (at least on android) to go to mobile network settings and change it to "lte only" or "3g only"? As for using au by KDDI, I'm not even sure whether using their SIM cards will prevent a downgrade attack. It's possible that they still support 2g for roaming use, for instance.
- 6y ago
- maerF0x0 6y agoAs recently as Nov 2019 comcast was doing this, albeit more benign https://rietta.com/blog/comcast-insecure-injection/ https://rietta.com/blog/comcast-insecure-injection/ https://news.ycombinator.com/item?id=21389657 https://news.ycombinator.com/item?id=21389657
- lxe 6y agoWould certificate pinning help here?
- close04 6y ago> the Israeli company issued a policy that vowed the company would cut off clients if they were found to misuse the surveillance technology to target journalists and human rights activists This goes right up there with "the backdoor for which only we'll have the key".
- mirkules 6y agoIf a system’s purpose is to protect citizens from bad actors, it is only a matter of time before the citizens become suspected bad actors, and the machinery is turned against the citizens. This is a concept that is sadly missing in well-intentioned people.
- pbhjpbhj 6y agoSounds more like "if you get caught using this then you'll need to use a third-party to purchase it and we're going to charge you extra", but perhaps that's too cynical.
- modeless 6y agoWorth noting that the Safari and iOS vulnerabilities that allow this to happen are worth up to $1 million if reported to Apple.
- titanomachy 6y agoNSO is worth a billion dollars, and they've probably made a lot more by renting out these hacks to governments than they ever could have made through responsible disclosure. It seems like Apple has patched it in iOS 9.3.5, though: https://nvd.nist.gov/vuln/detail/CVE-2016-4657 https://nvd.nist.gov/vuln/detail/CVE-2016-4657
- thoughtstheseus 6y agoMaybe $1 million is not enough.
- tarikjn 6y agoDoes Apple allow anonymous reports/crypto payouts? There could be anti-money laundering issues to sort out, but perhaps this could incentivize individual actors to break ranks and leak vulnerabilities upstream.
- inglor 6y ago"Break ranks"? If you work for one of these actors (NSO with intentionally "sassy" PR or "quiet" ones like Verint or ones in the middle like Cellebrite) and leak info - you will get jailed. Breaking ranks in this case is a 10 year jail sentence if you get caught. Funnily enough, the ex-head of malware analysis for NSO recently released this https://www.jsof-tech.com/ripple20/ https://www.jsof-tech.com/ripple20/ and "switched ranks" to the light side.
- hn_throwaway_99 6y agoI saw this discussed on reddit, and I was surprised that there was so much confusion about how this happened. It wasn't just "network injection" - quite clearly (unfortunately very poorly described in the article) there was a vulnerability in iOS/Safari that allowed remote code execution; network injection alone wouldn't have been enough. Does anyone know what the CVE was that allowed this?
- VWWHFSfQ 6y agoAlso, does iOS have something similar to SELinux? I know it's not perfect, and there have been RCEs in Android as well. But I'm surprised there are still things out there like the original tiff jailbreak exploit that allows full root access to a person's device from just visiting a webpage.
- johncolanduoni 6y agoThe iOS equivalent would be the app sandboxing mechanism, which very heavily restricts kernel access from most of Safari (most importantly the process that is JITing javascript). It’s structured differently than SELinux and has some complications like entitlements that have led to vulnerabilities in the past, but it largely allows iOS to apply the same sort of app-level access control.
- saagarjha 6y agoiOS has a number of features that provide similar functionality; getting kernel level privileges on iOS requires multiple vulnerabilities to be chained together. It's not like RCE in the web browser process instantly compromises the entire system.
- nsajko 6y agoIt seems the iOS vulnerability itself is not known, from reading the Amnesty International report.
- roblabla 6y agoA code execution vulnerability isn't enough. To work on truly any website, they need: - A remote code execution vulnerability. There are almost certainly multiple vulnerabilities at play here, since long gone are the days where a single vuln gave arbitrary code execution. - a way to bypass the encryption/https, unless the remote code execution was on a layer before encryption (which seems unlikely). EDIT: Apparently the hack only works on non-encrypted websites. - Once remote code is achieved, they most certainly need a way to elevate privileges in order to make the hack more persistent and tap into other apps. There are most likely several CVEs at play here. The amount of effort that went into this hack is, frankly, terrifying.
- mirimir 6y agoThis is one reason why I don't use cellphones. I suspect that Mr. Radi would have been safe if he had 1) used a PinePhone, with cellular and WiFi radios turned off, and a USB-connected cellular modem; and 2) hit the Internet through a VPN, Orchid, Tor or LokiNet. If you think not, please share, because I hate spreading BS. Edit: Well, someone seems to think that I'm wrong, but they aren't saying why. Just sayin'.
- bronco21016 6y agoIt seems this attack exploited the browser on the device via non-HTTPS sites. So the elaborate networking scheme really wouldn't do much. They just had to inject their browser exploits on every non-HTTPS site the user visited. Just because the PinePhone runs non-Android/iOS doesn't mean there aren't 0-days for the browser it runs.
- mirimir 6y agoIn TFA, it says that they injected the exploit via stingray or cellular network compromise. I'm pretty sure that better isolation of the browser and other apps from the cellular network would have prevented that. But yes, he would have been vulnerable to malicious sites exploiting browser bugs, as one always is. I mitigate that by compartmentalizing activities in multiple machines and VMs. For example, the host that this VM is running on contains absolutely no information about my meatspace identity.
- g8oz 6y agoJournalists have to communicate with sources though and often that means using WhatsApp.
- mirimir 6y agoOne can run WhatsApp in Linux. Or one can use Session, and there are apps for Windows, MacOS, Linux, Android and iOS.
- 6y ago
- MintelIE 6y agoJournalists need to take a page out of Assange's playbook and use ancient Thinkpads and Powerbooks and use VPNs which would make this technique obsolete.
- oska 6y agoIronically, Firefox gave me a fingerprinting warning for the website this article appears on. (The fingerprinting was being done by eyereturn.com)
- saagarjha 6y agoSafari says this page has 21 trackers ¯\_(ツ)_/¯
- Reelin 6y agoBetween uBlock Origin and uMatrix I hadn't even realized. Prior to seeing these comments I had actually been impressed by the site's (apparent) responsiveness combined with the (apparently) clean and mostly pain text layout. Whoops.
- oska 6y agoI'm running UBlock Origin and UMatrix too. And both of them are blocking eyereturn.com. But because I've got Firefox to alert me to fingerprinting (not a default option I think) I also got a little pop-up informing me that the site was using it. Which advice I appreciated even though I was already protected by those two earlier mentioned services.
- deeblering4 6y agoWhat methods and tools are available to the average “power user” to detect and mitigate mobile device malware? Just reboot my phone every morning?
- saagarjha 6y agoOn iOS there are pretty much none. Any that claim to detect such things are generally selling snake oil. (Rebooting your phone is usually a good way to get rid of an infection, since persistence is generally not a part of these attacks, but you might just be infected again.)
- DenisM 6y agoOnly built in browsers and mail clients have high privilege, so use replacements.
- ReptileMan 6y agoRoot some android, install obscure build, install firewall, use exotic browser.
- dredmorbius 6y agoBe fingerprinted by unique stack signature anyway.
- AaronFriel 6y agoTime for everyone to install HTTPS Everywhere and turn on Encrypt All Sites Eligible (EASE) on desktop. On mobile, highly recommend using a browser that supports extensions or pressuring companies to enable third party browsers. It's not overstating it to say that our legislators should compel that competition, it's a national security issue that journalists, intelligence officials, and the President using devices by a certain manufacturer cannot change the browser or use helpful extensions like HTTPS Everywhere. https://www.eff.org/deeplinks/2018/12/how-https-everywhere-keeps-protecting-users-increasingly-encrypted-web https://www.eff.org/deeplinks/2018/12/how-https-everywhere-k...
- deleted 6y ago[deleted]
- cycomanic 6y agoI think the developer community need to start ostracising people working for these companies. Don't hire former employees, don't hang hang out with people who work for these companies and conferences. Don't supply services to these companies (build their website, network...). I believe by letting people of the hook for participating in this (similar things can be said for e.g. the NSA) we are essentially endorsing the behaviour. If you work on at e.g. NSO group, you are personally responsible for governments surpressing and even killing (just look at SA) critics
- ezoe 6y agoI think the developer community need to start refusing to use the cellphone. It cannot be trusted. It's tainted by non-free software on top of non-free OS on top of non-free firmware with the separate processor whose behaviour we cannot observe from the main processor. It also relies on central wireless network from only a handful of providers. Easy single point of vulnerable target. I do refuse to own a cellphone. What about you. Since you're suggesting the boycott, can you?
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- msh 6y agoMobile phones are way safer for normal users compared general purpose computers.
- bad_user 6y agoWhat does Free/OSS software have to do with the article? If the phone wasn't proprietary, would it have made any difference? The answer is obvious.
- Reelin 6y ago> The answer is obvious. Is it? I'm not overly familiar with any security exploits, but my understanding is that (at least for Android) the phone OS is often woefully out of date simply because the vendor stopped supplying updates. The end user generally can't supply updates themselves because everything is locked down in a decidedly user hostile manner. For the vendor's part, they often stop supplying updates (as I understand it) because the proprietary hardware doesn't have it's drivers upstreamed into the kernel (they're proprietary after all) which leads to a completely unjustifiable maintenance burden. They can't simply open source things because the hardware manufacturers generally require NDAs. As far as the hardware goes, my (probably woefully incomplete) understanding is that it remains proprietary due to a combination of attempting to maintain a competitive edge through secrecy, licensing complexities due to containing third party IP, and DRM issues (which are again a licensing concern).
- ezoe 6y ago>Yet Radi was trained in encryption and cyber security. He hadn’t clicked on any suspicious links and... If you were properly trained for, you should have already realized that cellphone is not trustworthy way of communication.
- deleted 6y ago[deleted]
- pdimitar 6y agoI'm probably naive here because I'm not versed in networks -- but couldn't he avoid surveillance by using a VPN? Wasn't one of the design features of VPNs that your connection can't be hijacked?
- vonquant 6y agoOf course, the VPN could be the one doing the hijacking.
- pdimitar 6y agoWell let's assume that he f.ex. has friends in several countries to whose VPN servers he has a direct unimpeded access (by IP, not hostname). Would a trusted VPN help? Or would hijacking the traffic at the point of departure (his phone / the air) still manage to corrupt the payloads?
- Jon_Lowtek 6y ago"So do you trust some shady foreign VPN provider more than your government approved ISP?" might return true from journalists in autocratic states that have a record of censorship, surveillance and imprisoning journalists.
- inglor 6y agoOk, so I want to make something clear to the (smart but mostly not "in-the-know" about NSO) HN crowd. Let's say you're a Mexican drug lord or Saudi prince. You know this tech exists and the US/Israeli/European governments use it. Then, you see this article, and see all the comments in the comment section about how competent, scary and balance-changing the technology is. Basically: I think these pieces are bought for and paid by NSO through a PR firm, but you are not the target. When we leave comments like "NSO's tech is so good it has to be regulated!" or "NSO's tech is dangerous!" we are playing directly into the PR firm's clever hands. It's like an article about how good the AR-15 or the F-35 are. Obviously to me (and most of the readers) it's mostly "why are we focusing on technology of death" but we are not the target.
- kavalg 6y agoWhat you are saying makes a lot of sense. Then does it mean that the NSO capabilities are not quite as "advertised"?
- inglor 6y agoOf course, NSO and other players in that field can do much, much, much more than advertised to the media. Remember, the vast majority of people working for NSO worked for Israeli and US intelligence bodies. They serve in the 8200 unit doing malware analysis trailed by the NSA and then go work for NSO on the same sort of technology. (If you want to get an idea of how much, I recommend "Permanent Record" but if you don't like Snowden then check out how far ahead intelligence bodies were _historically_ compared to public knowledge - WW2 crypto being a good analogy) This lets the US government (and the Israeli government in turn) to make money off the technology without going through the same international regulatory systems. The US government (or Israeli government) can stop companies like NSO in a single decision but they are not since it is making them money. It's up to us (the citizens) to pressure them to do so and to promote security best practices and work on better tools to make it harder to breach peoples' privacy.
- kavalg 6y agoThanks for your through reply. My question was more in line with enterprise PR/sales. More precisely, to what extent does such a PR activity drive sales for NSO. In my early engineering career I did enterprise pre-sales for two different companies and we always relied on more direct touch points with potential customers (e.g. doing seminars, workshops).
- LatteLazy 6y agoSo just by being redirected, you can have root access to your iPhone taken without warning? That sounds like an insane vulnerability. Anyone with a security concern should immediately drop iPhone shouldn't they? I admit the intercept process is clever, but if that's all that is needed for total security failure, the real issue is the browser/OS.
- atommclain 6y agoWould using something like Opera Mini have prevented this attack from happening? I’m imagining a proxy like tool that lets high exposure individuals to request webpages, have them downloaded/parsed, and possibly rendered before handing them off to the client device. Perhaps it would let the client download https normally but switch modes for any http requests (if I understand what happened here correctly.)
- elchin 6y agoWould using a trusted VPN prevent this attack, since even HTTP requests would be tunneled through a secure connection?
- rustybolt 6y agoI'd love to see a more technical explanation of the method that is used!
- joann56 6y agoThe lock-down order in the UK to help curb the spread of the global pandemic caused by the COVID-19 has given me more time to understudy my husband. I watch him has he goes to the lobby to answer phone calls................................. He locks his phone with a passcode to prevent me from looking it up as he knows I suspect he has an affair. The only time my husband is without his phone is when he charges it. I don't get as much love like I would like. We have been married for 7 years with two kids. I hired a penetration EAGLE SPY HACKER CONTACT= eaglespyhacker at gmail dot com. He remotely hacked into his iPhone and gave me a portal which I logged into revealing his Whatsapp messages, Text messages, facebook messages and phone conversations in real time. It has been 2 days since the hack and it is apparent I married a cheat. He doesn't know I see his messages and I have this deep-seated resentment for him. Sarah A