5 ms·

> Robert Malley, a longtime American diplomat who was chief negotiator on the US-Iran deal, and who appears to have been selected as a person of interest by Mor

by mtrovo 5y ago

> Robert Malley, a longtime American diplomat who was chief negotiator on the US-Iran deal, and who appears to have been selected as a person of interest by Morocco in 2019. NSO has said its government clients are prevented from deploying its software against US numbers because it has been made “technically impossible”. Is there more info about why this is technically impossible or is it just their PR way of saying "sorry, the day we do this we're screwed as a company"?

deleted 5y ago
[deleted]
axiosgunnar 5y ago
I would assume it‘s a deliberate „if number.startsWith("+1")" precisely so nobody ends up using it on a US politician or whatever who then goes on a rampage.
- ywain 5y ago
  I like to imagine that some developer commented out that line to allow for spying on Canadian persons and left a "TODO: find better way to identify US numbers" that was never fixed.
  - deleted 5y ago
    [deleted]
  - peteretep 5y ago
    That’s hilarious, although I suspect “don’t hack the US” means “don’t hack five eyes” in practice
  - bastawhiz 5y ago
    While it would be funny, Canadian phone numbers are pretty easy to identify, generally. They have their own set of area codes. Granted, there are exceptions, though I guess it depends on your interpretation of what it means to be a "US phone number".
- notquitehuman 5y ago
  Until they release some sort of irrefutable proof, why give them the benefit of the doubt? Their track record warrants assuming dishonesty.
  - boomboomsubban 5y ago
    Everyone cares more about the optics of spying on US citizens than actually spying on US citizens. Like in this example, without the convenient excuse of "it's impossible" the headline likely would have been "Pegasus Project spies on US diplomat and French President."
- aaaxyz 5y ago
  The Israeli defense ministry has to approve sales contracts. I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating.
  - culturestate 5y ago
    > states they depend on militarily/politically or that have the capability of retaliating It's almost certainly closer to the former than to the latter. Not that anyone sane would be likely to consider actual war over something like this, but while the French military may not be the force it once was it's still formidable and they are - theoretical willingness to engage notwithstanding - one of the declared nuclear powers.
  - Leparamour 5y ago
    > I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating. It's an open secret that Israel has been conducting economic and military espionage against the US[0][1][2] and stealing civilian and military technology for decades. This "blocking +1 numbers" is rather a thin veneer to prevent third parties from endangering the "official" Israeli espionage program. [0] https://www.businessinsider.com/israeli-spying-on-us-has-reached-terrifying-levels-2014-5?r=US&IR=T https://www.businessinsider.com/israeli-spying-on-us-has-rea... [1] https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house... [2] https://www.nytimes.com/2020/12/30/world/middleeast/jonathan-pollard-israel-us-spy.html https://www.nytimes.com/2020/12/30/world/middleeast/jonathan...
mike_d 5y ago
NSO effectively operates a SaaS platform for target exploitation and collection. They can easily add a restriction that prevents specific phone numbers from being targeted. My guess is that such a restriction is in place to meet contractual obligations. If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you.
- hguant 5y ago
  >If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you. If you weaponize an exploit against US - especially US government - targets you jeopardize the military and intelligence alliance that keeps your country alive, not to mention the standing FBI warrants if you have the misfortune to enter the country, nor the forfeiture of your ability to use the world banking system.
  - nerbert 5y ago
    Well that’s probably something that hasn’t crossed their mind. Shitting on the US is not on the "avoid" list of Israelis.
kuyan 5y ago
Unclear why it's "technically impossible" but from this Washington Post article [1] it sounds more like "prevented by business logic," at least according to their source: > A person familiar with NSO operations who spoke on the condition of anonymity to discuss internal company matters said Sunday that +1 phones are safe from Pegasus no matter where they are in the world. The system is programmed to block efforts to hack them, the person said. > The person also said Pegasus can determine where a phone is geographically and block any efforts to hack a foreign-registered phone while it is inside the United States. > But there is no way to determine the nationality of the user of a phone registered to a foreign system. [1]: https://www.washingtonpost.com/national-security/2021/07/19/us-phone-numbers-nso/
- amatecha 5y ago
  This strikes me as a thing that applies "normally" but can be circumvented with a user privilege flag or so on. There's no reason an exception to that business logic isn't part of the system (and we have no way to verify/prove one way or the other).
  - deleted 5y ago
    [deleted]
  - kragen 5y ago
    Or circumvented by overwriting a conditional jump with a nop, though that might be challenging in practice if it's really SaaS.
- jahmed 5y ago
  This sounds like the ransomware services which prevent installation when Cyrillic keyboards are detected. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
rodgerd 5y ago
They have claimed in the past that they have technical measures to prevent the wrong people being targeted. If my memory of the reporting around the lawsuit by Facebook against the NSO is correct, the claims were pretty much rubbish - like, the technical measure may be there, but it pretty clearly wasn't in use.

by mtrovo 5y ago

deleted 5y ago

[deleted]

axiosgunnar 5y ago

I would assume it‘s a deliberate „if number.startsWith("+1")" precisely so nobody ends up using it on a US politician or whatever who then goes on a rampage.

ywain 5y ago
I like to imagine that some developer commented out that line to allow for spying on Canadian persons and left a "TODO: find better way to identify US numbers" that was never fixed.
- deleted 5y ago
  [deleted]
- peteretep 5y ago
  That’s hilarious, although I suspect “don’t hack the US” means “don’t hack five eyes” in practice
- bastawhiz 5y ago
  While it would be funny, Canadian phone numbers are pretty easy to identify, generally. They have their own set of area codes. Granted, there are exceptions, though I guess it depends on your interpretation of what it means to be a "US phone number".
notquitehuman 5y ago
Until they release some sort of irrefutable proof, why give them the benefit of the doubt? Their track record warrants assuming dishonesty.
- boomboomsubban 5y ago
  Everyone cares more about the optics of spying on US citizens than actually spying on US citizens. Like in this example, without the convenient excuse of "it's impossible" the headline likely would have been "Pegasus Project spies on US diplomat and French President."
aaaxyz 5y ago
The Israeli defense ministry has to approve sales contracts. I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating.
- culturestate 5y ago
  > states they depend on militarily/politically or that have the capability of retaliating It's almost certainly closer to the former than to the latter. Not that anyone sane would be likely to consider actual war over something like this, but while the French military may not be the force it once was it's still formidable and they are - theoretical willingness to engage notwithstanding - one of the declared nuclear powers.
- Leparamour 5y ago
  > I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating. It's an open secret that Israel has been conducting economic and military espionage against the US[0][1][2] and stealing civilian and military technology for decades. This "blocking +1 numbers" is rather a thin veneer to prevent third parties from endangering the "official" Israeli espionage program. [0] https://www.businessinsider.com/israeli-spying-on-us-has-reached-terrifying-levels-2014-5?r=US&IR=T https://www.businessinsider.com/israeli-spying-on-us-has-rea... [1] https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house... [2] https://www.nytimes.com/2020/12/30/world/middleeast/jonathan-pollard-israel-us-spy.html https://www.nytimes.com/2020/12/30/world/middleeast/jonathan...

mike_d 5y ago

NSO effectively operates a SaaS platform for target exploitation and collection. They can easily add a restriction that prevents specific phone numbers from being targeted. My guess is that such a restriction is in place to meet contractual obligations. If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you.

hguant 5y ago
>If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you. If you weaponize an exploit against US - especially US government - targets you jeopardize the military and intelligence alliance that keeps your country alive, not to mention the standing FBI warrants if you have the misfortune to enter the country, nor the forfeiture of your ability to use the world banking system.
- nerbert 5y ago
  Well that’s probably something that hasn’t crossed their mind. Shitting on the US is not on the "avoid" list of Israelis.

kuyan 5y ago

Unclear why it's "technically impossible" but from this Washington Post article [1] it sounds more like "prevented by business logic," at least according to their source: > A person familiar with NSO operations who spoke on the condition of anonymity to discuss internal company matters said Sunday that +1 phones are safe from Pegasus no matter where they are in the world. The system is programmed to block efforts to hack them, the person said. > The person also said Pegasus can determine where a phone is geographically and block any efforts to hack a foreign-registered phone while it is inside the United States. > But there is no way to determine the nationality of the user of a phone registered to a foreign system. [1]: https://www.washingtonpost.com/national-security/2021/07/19/us-phone-numbers-nso/

amatecha 5y ago
This strikes me as a thing that applies "normally" but can be circumvented with a user privilege flag or so on. There's no reason an exception to that business logic isn't part of the system (and we have no way to verify/prove one way or the other).
- deleted 5y ago
  [deleted]
- kragen 5y ago
  Or circumvented by overwriting a conditional jump with a nop, though that might be challenging in practice if it's really SaaS.
jahmed 5y ago
This sounds like the ransomware services which prevent installation when Cyrillic keyboards are detected. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

rodgerd 5y ago

They have claimed in the past that they have technical measures to prevent the wrong people being targeted. If my memory of the reporting around the lawsuit by Facebook against the NSO is correct, the claims were pretty much rubbish - like, the technical measure may be there, but it pretty clearly wasn't in use.