8 ms·

Being spied on by the makers of Pegasus, then lured them into a trap

158 points by vincent_s 5y ago

rangerdan 5y ago
Yay, a blank dark page. Thank you, page author, for contributing to making the Internet an inaccessible shithole and requiring Javascript to read simple text.
- xenophonf 5y ago
  Which is how these exploits gets delivered, so that's pretty damn ironic.
- kolla 5y ago
  Surfing the net without javascript is the most foilhat thing I've read today.
andytheant 5y ago
I'm a long time fan of this podcast! Great to see it appearing on hacker news. I would recommend going back and listening to all 99 previous episodes and the 2 since this one also.
- petersonh 5y ago
  Agreed! Definitely one of my favourite podcasts.
- drcongo 5y ago
  Same here. He does a great job of making quite technical shows very accessible, and many of the shows are just a really great story. Other particularly good episodes - The LinkedIn Incident [0], Information Monopoly [1] and OxyMonster [2] [0] https://darknetdiaries.com/episode/86/ https://darknetdiaries.com/episode/86/ [1] https://darknetdiaries.com/episode/71/ https://darknetdiaries.com/episode/71/ [2] https://darknetdiaries.com/episode/58/ https://darknetdiaries.com/episode/58/
- TwoNineFive 5y ago
  I respectfully, and strongly, disagree. Darknet Diaries is entertainment first and foremost. It's also a for-profit podcast where it's advertising becomes a problem. I say this disappointingly, as I like good technical podcasts, but I have found very few in the security space which work well for me. The information density is low. There's a whole lot of unnecessary back-and-forth banter between hosts and the the typical kind of old-school AM radio type bullshittery. A 30 minute segment often based on a four paragraph blog post. The other big problem I have with the show is that the advertisement model has a whole lot of dark patterns. It's been sometimes difficult to tell which segments are "sponsored" (paid adverts) and which is attempted-NEWS/info. In fact, most of the shows are just one advert after another, and the guest speakers are often sleazy and leave out important information. That makes Darknet Diaries a misinformation source for me. I stopped trusting what I was hearing after awhile.
hyproxia 5y ago
Yay, another page that doesn't render at all without JS. And then we sit and wonder how NSO Group is able to compromise all these machines with ease, and yes, they had/have browser exploits.
- fireball_blaze 5y ago
  What % of web users surf the web without JS turned on? (Honest question, I don't know.) And if this % is very tiny, does it make sense for devs to devote time developing an experience for this rare edge case?
  - vbezhenar 5y ago
    Would you apply this reasoning to Firefox support?
  - Wistar 5y ago
    Me, for one. I always use NoScipt. and although it can be a hassle, I am willing to bet that it has saved me some anguish over the years.
  - seba_dos1 5y ago
    Yes, it does. Not using JavaScript to present documents is the default, you actually need to devote time to make it the other way. Relying on JavaScript significantly increases your failure surface. Outdated browsers, buggy extensions, network failures, poor error handling - it becomes much more likely for your content to not display even when the user does not actually turn JavaScript off.
  - hyproxia 5y ago
    Here's another way of looking at it: Does this page really need to execute code on its users' machines? Why is this such an acceptable thing in the first place?
    - darkcha0s 5y ago
      Because lots of information is easier to take in with animation and ease of use features vs. staring at a wall of text.
DerekBickerton 5y ago
I've always wondered if I'm interesting enough or a 'person of interest'. Seems iMazing offer the ability to check your iOS device for Pegasus: https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone https://imazing.com/guides/detect-pegasus-and-other-spyware-... Not affiliated, just thought I'd mention it if anyone's concerned they have malware on their device.
RattleyCooper 5y ago
I like how NSO simultaneously claims they "hav nothing to do with the software after it's sold" but can also "shut down the software at any time, we have the technology". So pegasus operators probably have some sort of licensing data that gets sent. Either way this is no different than them selling guns to terrorists and then being like, "but they said they were going to use the guns to FIGHT terrorism. No way we could have predicted that. Whoopsie-daisy!"
- lupire 5y ago
  where are your quotes from?

158 points by vincent_s 5y ago

Yay, a blank dark page. Thank you, page author, for contributing to making the Internet an inaccessible shithole and requiring Javascript to read simple text.

xenophonf 5y ago
Which is how these exploits gets delivered, so that's pretty damn ironic.
kolla 5y ago
Surfing the net without javascript is the most foilhat thing I've read today.

andytheant 5y ago

I'm a long time fan of this podcast! Great to see it appearing on hacker news. I would recommend going back and listening to all 99 previous episodes and the 2 since this one also.

petersonh 5y ago
Agreed! Definitely one of my favourite podcasts.
drcongo 5y ago
Same here. He does a great job of making quite technical shows very accessible, and many of the shows are just a really great story. Other particularly good episodes - The LinkedIn Incident [0], Information Monopoly [1] and OxyMonster [2] [0] https://darknetdiaries.com/episode/86/ https://darknetdiaries.com/episode/86/ [1] https://darknetdiaries.com/episode/71/ https://darknetdiaries.com/episode/71/ [2] https://darknetdiaries.com/episode/58/ https://darknetdiaries.com/episode/58/
TwoNineFive 5y ago
I respectfully, and strongly, disagree. Darknet Diaries is entertainment first and foremost. It's also a for-profit podcast where it's advertising becomes a problem. I say this disappointingly, as I like good technical podcasts, but I have found very few in the security space which work well for me. The information density is low. There's a whole lot of unnecessary back-and-forth banter between hosts and the the typical kind of old-school AM radio type bullshittery. A 30 minute segment often based on a four paragraph blog post. The other big problem I have with the show is that the advertisement model has a whole lot of dark patterns. It's been sometimes difficult to tell which segments are "sponsored" (paid adverts) and which is attempted-NEWS/info. In fact, most of the shows are just one advert after another, and the guest speakers are often sleazy and leave out important information. That makes Darknet Diaries a misinformation source for me. I stopped trusting what I was hearing after awhile.

hyproxia 5y ago

Yay, another page that doesn't render at all without JS. And then we sit and wonder how NSO Group is able to compromise all these machines with ease, and yes, they had/have browser exploits.

fireball_blaze 5y ago
What % of web users surf the web without JS turned on? (Honest question, I don't know.) And if this % is very tiny, does it make sense for devs to devote time developing an experience for this rare edge case?
- vbezhenar 5y ago
  Would you apply this reasoning to Firefox support?
- Wistar 5y ago
  Me, for one. I always use NoScipt. and although it can be a hassle, I am willing to bet that it has saved me some anguish over the years.
- seba_dos1 5y ago
  Yes, it does. Not using JavaScript to present documents is the default, you actually need to devote time to make it the other way. Relying on JavaScript significantly increases your failure surface. Outdated browsers, buggy extensions, network failures, poor error handling - it becomes much more likely for your content to not display even when the user does not actually turn JavaScript off.
- hyproxia 5y ago
  Here's another way of looking at it: Does this page really need to execute code on its users' machines? Why is this such an acceptable thing in the first place?
  - darkcha0s 5y ago
    Because lots of information is easier to take in with animation and ease of use features vs. staring at a wall of text.

DerekBickerton 5y ago

I've always wondered if I'm interesting enough or a 'person of interest'. Seems iMazing offer the ability to check your iOS device for Pegasus: https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone https://imazing.com/guides/detect-pegasus-and-other-spyware-... Not affiliated, just thought I'd mention it if anyone's concerned they have malware on their device.

RattleyCooper 5y ago

I like how NSO simultaneously claims they "hav nothing to do with the software after it's sold" but can also "shut down the software at any time, we have the technology". So pegasus operators probably have some sort of licensing data that gets sent. Either way this is no different than them selling guns to terrorists and then being like, "but they said they were going to use the guns to FIGHT terrorism. No way we could have predicted that. Whoopsie-daisy!"

lupire 5y ago
where are your quotes from?