6 ms·

I suppose that broadly, the takeaway here (and in all of this) that I’ve missed is that fundamentally, this list of phones that were targeted shouldn’t exist, o

by Shank 5y ago

I suppose that broadly, the takeaway here (and in all of this) that I’ve missed is that fundamentally, this list of phones that were targeted shouldn’t exist, or shouldn’t be leakable in this way, if we want to believe that NSO Group is targeting the most genuine targets. To frame it differently: NSO Group sells tools to governments that are apparently trustworthy. Its security and system architecture should be decentralized enough that a list of all targets should be extremely difficult to obtain. If the list is obtainable, then what else is? Are their exploit toolkits just as leakable? Are the internal controls not sufficient to stop these leaks? How can we continue to allow orgs like NSO Group to exist if they surely can’t keep something like their entire target list safe? Even if we assume of the targets are legitimate threats (which, again, requires enough suspension of disbelief to hold a small army at this point), why would we want that list leakable? If they’re all the most legitimate targets, then that list is essentially 50k people who can now discover this fact and change their patterns to hide. It’s pretty bad to tip off “all the people who we find important enough to 0-day” if that assumption holds. Now the real question? I’m not sure I know what we can do, actionably. Call Congress and ask them to care?

baybal2 5y ago
> Now the real question? I’m not sure I know what we can do, actionably. Call Congress and ask them to care? I maintain that NSO is just a deniability front for Israel's espionage agencies, otherwise I don't know how they weren't shut down for so long, knowing what kind of a state Israel is. NSO is well known to the Israeli state, after all it is their cabinet that clears every deal NSO make. Per Israeli laws, pegasus is a "weapon" So yes, the problem is primarilly in political dimension.
- aritmo 5y ago
  That looks reasonable. The NSO Group malware perform active attacks. By creating this front (the NSO Group) that is supposed to have private customers, they can put in their own targets and have some form of deniability.
- maltalex 5y ago
  Would you have said the same about HackingTeam [0] and the Italian Government? They were featured on citizen lab a LOT a few of years ago [1]. These guys still operate under the name "Memento Labs". There's obviously money to be made from selling offensive cybersecurity tools to governments. And you can hardly blame governments for buying these services in the age of end-to-end encryption in the hands of every criminal and terrorist. While I definitely don't condone spying on human rights activists, journalists, or even regular citizens for that matter, pegasus really is a weapon and as such should definitely be heavily regulated. But as with other types of weapons, the responsibility for its use (or rather misuse) should lie with the weapon's user first and foremost, not the manufacturer. If NSO/HackingTeam were in the business of selling physical weapons to foreign governments, would they have been responsible for a government killing journalists with said weapons? If they were selling to North Korea, sure. But what about the legitimate governments of stable countries not under sanctions? [0]: https://en.wikipedia.org/wiki/Hacking_Team https://en.wikipedia.org/wiki/Hacking_Team [1]: https://citizenlab.ca/tag/hacking-team/ https://citizenlab.ca/tag/hacking-team/
  - maybeOneDay 5y ago
    I think you hand wave away the responsibility born by the Governments who regulate, control, and subsidise the arms trade. Of course it is the fault of the user of the weapons as well - but UK and USA (to just name a couple more egregious examples) governments quite literally give money to foreign governments in order for them to funnel it directly back into arms deals. These weapons can then be used to destroy hospitals and schools in Yemen. Our governments are financing this loss of life in order to further propel the revolving door. I see this kind of cyber weaponry as a simple subset of the above complex.
    - maltalex 5y ago
      > I see this kind of cyber weaponry as a simple subset of the above complex. This is exactly my point. I think that NSO should be just as responsible for the outcomes as any other arms manufacturer. And I'm not waving away the government's responsibilities. Just the opposite - cyber weaponry is equivalent to other types of weaponry and should be treated as such. This is why I feel that the discussion around NSO itself misses the point. It's like discussing Colt's responsibility whenever a government uses an M-16 to shoot a human rights activists. Colt may be responsible in some cases, but the important question is who bought the weapon and why did they use them against that specific target. Also, should the buyer be sanctioned and forbidden from purchasing such weapons in the future.
- mmrezaie 5y ago
  I agree with these statements. Although I do not understand why this is not making any nosie internationally? NSO (ergo the supporting state) seems to be stealing data from EU leaders as well. Is this mean we have many NSO like companies out there that we do not know about and each country has one and everyone knows about these? Does anyone know what is the Swedish NSO?
  - fighterpilot 5y ago
    No evidence of that yet. Their numbers were in the list, but hasn't been confirmed yet whether Pegasus was installed.
- srean 5y ago
  A very believable hypothesis. NSO is also not the only one of this kind, Candiru is another.
- signal11 5y ago
  “Deniability front” might be a bit harsh, but revolving doors between government and private sector exist all over the world. Ignoring NSO for a moment, in general they are not always malicious. But with regards to NSO in particular, there definitely is some linkage, even if it’s not necessarily malicious. According to this Bloomberg columnist[1], (linked article has further hyperlinks to sources) > How much of this technology is being developed in the U.S., including by U.S. government agencies, and making its way to illiberal autocrats? NSO’s founders are, according to multiple reports, thought to be alumni of Israel’s signals intelligence division, Unit 8200. And we know — including through the Edward Snowden leak — that the U.S. National Security Agency provides Israeli intelligence “controlled access to advanced U.S. technology and equipment.” [1] https://www.bloomberg.com/opinion/articles/2021-07-19/pegasus-spyware-scandal-should-prompt-new-u-s-controls https://www.bloomberg.com/opinion/articles/2021-07-19/pegasu...
  - markdown 5y ago
    > but revolving doors between government and private sector exist all over the world. No... no they don't. It's not normal at all.
    - ComodoHacker 5y ago
      What do you mean? Should you be denied a job in the government after working in the private sector and vice versa?
      - markdown 5y ago
        In most countries, you simply wouldn't qualify for a job in government if you've spent a career working in the private sector. Civil servants are... civil servants.
        ComodoHacker 5y ago
        Never heard about it. Can you name a few? What a waste of human resources!
deleted 5y ago
[deleted]
hkai 5y ago
I don't think anyone should have the authority to "allow" or "disallow" such companies to exist.
kmlx 5y ago
> this list of phones that were targeted isn’t this just an assumption at this point? what makes you think those were targets? > How can we continue to allow orgs like NSO Group to exist if they surely can’t keep something like their entire target list safe? what exactly is the difference to the NSA leaks from years ago? they couldn’t keep their secrets, allegedly same as this company.
throwaway4good 5y ago
It makes perfect sense to me that there would exists a centralized list inside the company of the people being targeted. There would need to a server serving the exploit and also collecting the data from the comprised phones. Naturally that server would have a list of the phones it collected from, probably keyed by phone number as that would be the most straightforward identifier. Also I assume nso bills their clients pr. target.
- throwaway4good 5y ago
  Implicit assumption here is that these super hackers would also have super security. I am not sure I buy that. My guess is that NSO operational corpse is made up of young young Israelis straight out of the military plus maybe an engineering school. They are trained in systematic hacking and probably have access to a privileged set of exploits provided by the Israeli military and maybe the US. But not much beyond that in terms of engineering skills. In short I wouldn’t be surprised if their exploit server and data collection server is maybe with php and mysql. Also. How do you sell a service like this? Getting Orban and similar as customers. Requires quite a bit of a network.
  - belter 5y ago
    "Everything We Know About NSO Group" https://www.forbes.com/sites/thomasbrewster/2016/08/25/everything-we-know-about-nso-group-the-professional-spies-who-hacked-iphones-with-a-single-text/?sh=4a049ded3997 https://www.forbes.com/sites/thomasbrewster/2016/08/25/every... From 2016 but has the core personalities and the partners owning the company. San Francisco and London based... Some additional context: https://www.bloomberg.com/news/features/2021-01-26/private-equity-firm-francisco-partners-profits-from-surveillance-censorship https://www.bloomberg.com/news/features/2021-01-26/private-e...
fortran77 5y ago
I can't imagine that there's a "list of targeted phones." Either this alleged "leak" is nonsense, or it's some unrelated collection of data.
- sbarre 5y ago
  Can you expand on why you find this unimaginable? NSO is a spyware-as-a-service company. How else would they provide that service, if not by having a list of all the phones their clients need spied on?
  - fortran77 5y ago
    Because the customers who use NSO’s forensic tools aren’t going to share their use cases with NSO without a good reason.
    - sbarre 5y ago
      They are a SaaS platform. Or are we debating whether or not that part is even true? If they are not a SaaS platform, then I would agree with you, but so far everything I've seen claims that they are, so by that nature the customer would have to put their use case data into NSO's platform, would they not?
- deleted 5y ago
  [deleted]

by Shank 5y ago

baybal2 5y ago

> Now the real question? I’m not sure I know what we can do, actionably. Call Congress and ask them to care? I maintain that NSO is just a deniability front for Israel's espionage agencies, otherwise I don't know how they weren't shut down for so long, knowing what kind of a state Israel is. NSO is well known to the Israeli state, after all it is their cabinet that clears every deal NSO make. Per Israeli laws, pegasus is a "weapon" So yes, the problem is primarilly in political dimension.

aritmo 5y ago
That looks reasonable. The NSO Group malware perform active attacks. By creating this front (the NSO Group) that is supposed to have private customers, they can put in their own targets and have some form of deniability.
maltalex 5y ago
Would you have said the same about HackingTeam [0] and the Italian Government? They were featured on citizen lab a LOT a few of years ago [1]. These guys still operate under the name "Memento Labs". There's obviously money to be made from selling offensive cybersecurity tools to governments. And you can hardly blame governments for buying these services in the age of end-to-end encryption in the hands of every criminal and terrorist. While I definitely don't condone spying on human rights activists, journalists, or even regular citizens for that matter, pegasus really is a weapon and as such should definitely be heavily regulated. But as with other types of weapons, the responsibility for its use (or rather misuse) should lie with the weapon's user first and foremost, not the manufacturer. If NSO/HackingTeam were in the business of selling physical weapons to foreign governments, would they have been responsible for a government killing journalists with said weapons? If they were selling to North Korea, sure. But what about the legitimate governments of stable countries not under sanctions? [0]: https://en.wikipedia.org/wiki/Hacking_Team https://en.wikipedia.org/wiki/Hacking_Team [1]: https://citizenlab.ca/tag/hacking-team/ https://citizenlab.ca/tag/hacking-team/
- maybeOneDay 5y ago
  I think you hand wave away the responsibility born by the Governments who regulate, control, and subsidise the arms trade. Of course it is the fault of the user of the weapons as well - but UK and USA (to just name a couple more egregious examples) governments quite literally give money to foreign governments in order for them to funnel it directly back into arms deals. These weapons can then be used to destroy hospitals and schools in Yemen. Our governments are financing this loss of life in order to further propel the revolving door. I see this kind of cyber weaponry as a simple subset of the above complex.
  - maltalex 5y ago
    > I see this kind of cyber weaponry as a simple subset of the above complex. This is exactly my point. I think that NSO should be just as responsible for the outcomes as any other arms manufacturer. And I'm not waving away the government's responsibilities. Just the opposite - cyber weaponry is equivalent to other types of weaponry and should be treated as such. This is why I feel that the discussion around NSO itself misses the point. It's like discussing Colt's responsibility whenever a government uses an M-16 to shoot a human rights activists. Colt may be responsible in some cases, but the important question is who bought the weapon and why did they use them against that specific target. Also, should the buyer be sanctioned and forbidden from purchasing such weapons in the future.
mmrezaie 5y ago
I agree with these statements. Although I do not understand why this is not making any nosie internationally? NSO (ergo the supporting state) seems to be stealing data from EU leaders as well. Is this mean we have many NSO like companies out there that we do not know about and each country has one and everyone knows about these? Does anyone know what is the Swedish NSO?
- fighterpilot 5y ago
  No evidence of that yet. Their numbers were in the list, but hasn't been confirmed yet whether Pegasus was installed.
srean 5y ago
A very believable hypothesis. NSO is also not the only one of this kind, Candiru is another.
signal11 5y ago
“Deniability front” might be a bit harsh, but revolving doors between government and private sector exist all over the world. Ignoring NSO for a moment, in general they are not always malicious. But with regards to NSO in particular, there definitely is some linkage, even if it’s not necessarily malicious. According to this Bloomberg columnist[1], (linked article has further hyperlinks to sources) > How much of this technology is being developed in the U.S., including by U.S. government agencies, and making its way to illiberal autocrats? NSO’s founders are, according to multiple reports, thought to be alumni of Israel’s signals intelligence division, Unit 8200. And we know — including through the Edward Snowden leak — that the U.S. National Security Agency provides Israeli intelligence “controlled access to advanced U.S. technology and equipment.” [1] https://www.bloomberg.com/opinion/articles/2021-07-19/pegasus-spyware-scandal-should-prompt-new-u-s-controls https://www.bloomberg.com/opinion/articles/2021-07-19/pegasu...
- markdown 5y ago
  > but revolving doors between government and private sector exist all over the world. No... no they don't. It's not normal at all.
  - ComodoHacker 5y ago
    What do you mean? Should you be denied a job in the government after working in the private sector and vice versa?
    - markdown 5y ago
      In most countries, you simply wouldn't qualify for a job in government if you've spent a career working in the private sector. Civil servants are... civil servants.
      - ComodoHacker 5y ago
        Never heard about it. Can you name a few? What a waste of human resources!

deleted 5y ago

[deleted]

hkai 5y ago

I don't think anyone should have the authority to "allow" or "disallow" such companies to exist.

kmlx 5y ago

> this list of phones that were targeted isn’t this just an assumption at this point? what makes you think those were targets? > How can we continue to allow orgs like NSO Group to exist if they surely can’t keep something like their entire target list safe? what exactly is the difference to the NSA leaks from years ago? they couldn’t keep their secrets, allegedly same as this company.

throwaway4good 5y ago

It makes perfect sense to me that there would exists a centralized list inside the company of the people being targeted. There would need to a server serving the exploit and also collecting the data from the comprised phones. Naturally that server would have a list of the phones it collected from, probably keyed by phone number as that would be the most straightforward identifier. Also I assume nso bills their clients pr. target.

throwaway4good 5y ago
Implicit assumption here is that these super hackers would also have super security. I am not sure I buy that. My guess is that NSO operational corpse is made up of young young Israelis straight out of the military plus maybe an engineering school. They are trained in systematic hacking and probably have access to a privileged set of exploits provided by the Israeli military and maybe the US. But not much beyond that in terms of engineering skills. In short I wouldn’t be surprised if their exploit server and data collection server is maybe with php and mysql. Also. How do you sell a service like this? Getting Orban and similar as customers. Requires quite a bit of a network.
- belter 5y ago
  "Everything We Know About NSO Group" https://www.forbes.com/sites/thomasbrewster/2016/08/25/everything-we-know-about-nso-group-the-professional-spies-who-hacked-iphones-with-a-single-text/?sh=4a049ded3997 https://www.forbes.com/sites/thomasbrewster/2016/08/25/every... From 2016 but has the core personalities and the partners owning the company. San Francisco and London based... Some additional context: https://www.bloomberg.com/news/features/2021-01-26/private-equity-firm-francisco-partners-profits-from-surveillance-censorship https://www.bloomberg.com/news/features/2021-01-26/private-e...

fortran77 5y ago

I can't imagine that there's a "list of targeted phones." Either this alleged "leak" is nonsense, or it's some unrelated collection of data.

sbarre 5y ago
Can you expand on why you find this unimaginable? NSO is a spyware-as-a-service company. How else would they provide that service, if not by having a list of all the phones their clients need spied on?
- fortran77 5y ago
  Because the customers who use NSO’s forensic tools aren’t going to share their use cases with NSO without a good reason.
  - sbarre 5y ago
    They are a SaaS platform. Or are we debating whether or not that part is even true? If they are not a SaaS platform, then I would agree with you, but so far everything I've seen claims that they are, so by that nature the customer would have to put their use case data into NSO's platform, would they not?
deleted 5y ago
[deleted]