10 ms·
Emmanuel Macron identified in leaked Pegasus project data
- deleted 5y ago[deleted]
- mtrovo 5y ago> Robert Malley, a longtime American diplomat who was chief negotiator on the US-Iran deal, and who appears to have been selected as a person of interest by Morocco in 2019. NSO has said its government clients are prevented from deploying its software against US numbers because it has been made “technically impossible”. Is there more info about why this is technically impossible or is it just their PR way of saying "sorry, the day we do this we're screwed as a company"?
- deleted 5y ago[deleted]
- axiosgunnar 5y agoI would assume it‘s a deliberate „if number.startsWith("+1")" precisely so nobody ends up using it on a US politician or whatever who then goes on a rampage.
- ywain 5y agoI like to imagine that some developer commented out that line to allow for spying on Canadian persons and left a "TODO: find better way to identify US numbers" that was never fixed.
- deleted 5y ago[deleted]
- peteretep 5y agoThat’s hilarious, although I suspect “don’t hack the US” means “don’t hack five eyes” in practice
- bastawhiz 5y agoWhile it would be funny, Canadian phone numbers are pretty easy to identify, generally. They have their own set of area codes. Granted, there are exceptions, though I guess it depends on your interpretation of what it means to be a "US phone number".
- notquitehuman 5y agoUntil they release some sort of irrefutable proof, why give them the benefit of the doubt? Their track record warrants assuming dishonesty.
- boomboomsubban 5y agoEveryone cares more about the optics of spying on US citizens than actually spying on US citizens. Like in this example, without the convenient excuse of "it's impossible" the headline likely would have been "Pegasus Project spies on US diplomat and French President."
- aaaxyz 5y agoThe Israeli defense ministry has to approve sales contracts. I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating.
- culturestate 5y ago> states they depend on militarily/politically or that have the capability of retaliating It's almost certainly closer to the former than to the latter. Not that anyone sane would be likely to consider actual war over something like this, but while the French military may not be the force it once was it's still formidable and they are - theoretical willingness to engage notwithstanding - one of the declared nuclear powers.
- Leparamour 5y ago> I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating. It's an open secret that Israel has been conducting economic and military espionage against the US[0][1][2] and stealing civilian and military technology for decades. This "blocking +1 numbers" is rather a thin veneer to prevent third parties from endangering the "official" Israeli espionage program. [0] https://www.businessinsider.com/israeli-spying-on-us-has-reached-terrifying-levels-2014-5?r=US&IR=T https://www.businessinsider.com/israeli-spying-on-us-has-rea... [1] https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house... [2] https://www.nytimes.com/2020/12/30/world/middleeast/jonathan-pollard-israel-us-spy.html https://www.nytimes.com/2020/12/30/world/middleeast/jonathan...
- mike_d 5y agoNSO effectively operates a SaaS platform for target exploitation and collection. They can easily add a restriction that prevents specific phone numbers from being targeted. My guess is that such a restriction is in place to meet contractual obligations. If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you.
- hguant 5y ago>If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you. If you weaponize an exploit against US - especially US government - targets you jeopardize the military and intelligence alliance that keeps your country alive, not to mention the standing FBI warrants if you have the misfortune to enter the country, nor the forfeiture of your ability to use the world banking system.
- nerbert 5y agoWell that’s probably something that hasn’t crossed their mind. Shitting on the US is not on the "avoid" list of Israelis.
- kuyan 5y agoUnclear why it's "technically impossible" but from this Washington Post article [1] it sounds more like "prevented by business logic," at least according to their source: > A person familiar with NSO operations who spoke on the condition of anonymity to discuss internal company matters said Sunday that +1 phones are safe from Pegasus no matter where they are in the world. The system is programmed to block efforts to hack them, the person said. > The person also said Pegasus can determine where a phone is geographically and block any efforts to hack a foreign-registered phone while it is inside the United States. > But there is no way to determine the nationality of the user of a phone registered to a foreign system. [1]: https://www.washingtonpost.com/national-security/2021/07/19/us-phone-numbers-nso/
- amatecha 5y agoThis strikes me as a thing that applies "normally" but can be circumvented with a user privilege flag or so on. There's no reason an exception to that business logic isn't part of the system (and we have no way to verify/prove one way or the other).
- deleted 5y ago[deleted]
- kragen 5y agoOr circumvented by overwriting a conditional jump with a nop, though that might be challenging in practice if it's really SaaS.
- jahmed 5y agoThis sounds like the ransomware services which prevent installation when Cyrillic keyboards are detected. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
- rodgerd 5y agoThey have claimed in the past that they have technical measures to prevent the wrong people being targeted. If my memory of the reporting around the lawsuit by Facebook against the NSO is correct, the claims were pretty much rubbish - like, the technical measure may be there, but it pretty clearly wasn't in use.
- hanselot 5y agoInb4 fifty Liberal agents are deployed to debunk this.
- zrth 5y agoThis is great news. The more people in power have been hit, the more repercussions we can hope for. One possible way to force a bit of scrutiny upon NSO group would be to crowdfund an Pegasus subscription and use it against Netanyahu. Any serious suggestions what we can do to ensure that in the long run there will be less and not more "Hacking for hire" companies lending their tools for use against journalists and the opposition? Shit will really hit the fan when the "ransomware as a service" discovers the "targeted surveillance as a service" business model.. Interesting times to be alive.
- MeinBlutIstBlau 5y ago> The more people in power have been hit, the more repercussions we can hope for. This reminds me of a story I heard at a presentation when working at a bank. A politician was going through a closing process for property he was purchasing. He had an issue and found out that the banks automatically tac on PMI for his type of loan, regardless of loan to value ratios. A year later, their state passed legislation saying PMI cannot be forced on mortgaged loans with certain ratios and must be disclosed before closing. Funny how things work :)
- mixmastamyk 5y agoHad to look up, PMI = Private mortgage insurance.
- MeinBlutIstBlau 5y agoFor reference, normally banks mandate that stuff when the loan to value (LTV) ratio is very high. Meaning they didn't put a large down payment there. It's insurance you pay so that in case you quit paying or cant, the bank can recoup their losses. Essentially you're forced to pay to insure the bank's investment. Now normally you can remove it once you reach whatever LTV the financial has in their policy (usually 75-80%), but at the time when the politician was dealing with it, you basically had it on for the "life of loan."
- MrDresden 5y ago
- greatgib 5y agoThis looks like a shocking news, but there are probably hundreds of countries that are trying to tap on the French and other presidents. This is just the moroccan gov that is too incompetent to do it by themselves but have to use a third party consulting firm for the job. And so, there will be no consequence, because all the other governments know very well that they are dirty too, so there will just be a few soft offense word and then trying to have the population forget as fast as possible...
- peteretep 5y ago> This looks like a shocking news It _is_ shocking news: the Israelis are selling munitions to the Moroccan government explicitly for use against the French state.
- azinman2 5y agoIs it more shocking news than the market places that offer exploits to Russia and China that are used as munitions against the US?
- rich_sasha 5y agoIsrael is notionally one of US’ top allies, Russia and China are adversaries.
- peteretep 5y agoYes, Russia and China are openly hostile to the US and to the world order in general.
- behindai 5y agoSo, who stands behind the hack? Scary Russians?
- boomboomsubban 5y agoThere wasn't necessarily a hack, I don't think how the information leaked has been shared.
- skywhopper 5y agoInteresting that in one recent article NSO claimed they had no control or information about who their customers targeted with their software and in this article they insist Macron was definitely not a target of any of their customers...
- Leparamour 5y agoIt's a typical PR strategy for damage control to only admit what you can not longer plausibly deny.
- swayvil 5y agoIf Macron is involved then the shenanigan is definitely for a good cause. The trampling of our rights is a small price to pay for safety from the covid demon.
- NicoJuicy 5y agoNot only Macron, but also Charles Michel of the EU. By the same Morrocan government. > Charles Michel, the president of the European Council, who appears to have been chosen as a person of interest by Morocco in 2019, when he was prime minister of Belgium.
- tpmx 5y agoThe French have a pretty dirty history of spying on "friendly allies", too, including European competitors to Airbus/Dassault.
- galgot 5y agoInteresting, you have a source on that please ?
- tpmx 5y agohttps://www.rfi.fr/en/europe/20190919-airbus-probed-over-alleged-spying-France-Germany https://www.rfi.fr/en/europe/20190919-airbus-probed-over-all... https://www.thelocal.se/20120525/41042/ https://www.thelocal.se/20120525/41042/ (not quite a smoking gun, there)
- galgot 5y agoSeems the gun is not quite smoking for both... Tittle of the first paper : "French plane constructor Airbus in spying probe" Airbus is not a French Company, it's a European company. France and Germany States hold each 11% of the shares, while Spain as about 4%. So that is less than 30% in States ownership shares. The rest is privately owned free float. True the main production line and headquarters are in Toulouse, France, but that doesn't make it a "French Company". It's as much German than French, with some Spanish too... Tittle is completely misleading and incorrect. Other paper is behind a paywall for me.
- rdtwo 5y agoThis is like the biggest non issue ever. If governments did not what this type of thing to happen just make an example of of the ceo/leaders of this company and raise the stakes of all future terrorists. Espionage for hire should be a capitol offense.
- rossdavidh 5y agoThis will likely not result in much, EXCEPT for in Morocco. If the King and Prime Minister believe that their own security forces were spying on them, well, that might result in some consequences for them...
- m3kw9 5y agoGiven they’d never admit to it and that the phone number showed up, it’s very likely
- m3kw9 5y agoHow come it’s all crickets at Apple when it comes to this?
- deleted 5y ago[deleted]
- bjelkeman-again 5y agohttps://arstechnica.com/information-technology/2021/07/apple-under-pressure-over-iphone-security-after-nso-spyware-claims/ https://arstechnica.com/information-technology/2021/07/apple...
- Nuzzerino 5y agoAny word yet on where we can see the full list? I have some friends that may qualify and it would be nice to see how close I am to this mess. They should just get on with it and release the data instead of dragging it out for clicks and ad impressions.
- Leparamour 5y agoDragging the reporting on this a bit out prevents it from being easily buried under a single (manufactured) 'distraction'[0] news cycle in US media. Also this gives NSO the opportunity to hang themself with their own rope: have NSO specifically deny allegations from one update, then show the allegations to be true in the next update and thereby revealing the company management to be liars. [0]https://www.npr.org/2021/07/19/1017844801/biden-administration-accuses-china-microsoft-hack?t=1626846995324 https://www.npr.org/2021/07/19/1017844801/biden-administrati...
- ossusermivami 5y agoI would assume the president of a country like France would not use a common Android or iPhone with WhatsApp and I message, dont they have special blackberries like in the US?
- ohgodplsno 5y agoThe French government has custom made phones by Thales, running neither Android or iOS, for secure, important communications. It's not surprising that the president would still have a personal phone too.
- throwawayThales 5y ago> The French government has custom made phones by Thales, ..., for secure, important communications. Secured ... by Thales?