4 ms·

I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean

by Cyph0n 5y ago

I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean nothing.

mike_d 5y ago
Well since they do the exploitation on behalf of customers, yes? NSO is very popular with governments that don't have robust domestic intelligence because all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.
- spiderice 5y ago
  > all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone. You have a source for this? I genuinely want to know if they make it that simple
  - mike_d 5y ago
    Publicly? No. Should all come out in the Apple lawsuit though. Edit: Rereading the NSO statement they said they blocked exploitation of numbers starting with +1. Take that to mean whatever you'd like.
  - bicepjai 5y ago
    You should listen to darknet diaries podcast about NSO group activities
- Cyph0n 5y ago
  I understand that, but they have repeatedly denied that this is the case, which is simply absurd.
- Thorrez 5y ago
  My thought was that the customer runs the server provided by NSO. I though the web form is running off of a webserver in a building owned by the customer.
  - simonh 5y ago
    I used to work for an ISV in the finance industry. Most of our customers ran our stuff on their own servers in their own data centres, but we had direct logon to the application user account to manage the application config, do software upgrades, investigate issues, etc. A few of our customers preferred to support the software entirely themselves, we had no access and ran training courses for their support teams. I wouldn't be surprised if NSO offer a similar range of options depending on the client's budget and technical capabilities.
- matheusmoreira 5y ago
  ... Is this real? There's no way to resist this?

by Cyph0n 5y ago

I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean nothing.

mike_d 5y ago

Well since they do the exploitation on behalf of customers, yes? NSO is very popular with governments that don't have robust domestic intelligence because all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.

spiderice 5y ago
> all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone. You have a source for this? I genuinely want to know if they make it that simple
- mike_d 5y ago
  Publicly? No. Should all come out in the Apple lawsuit though. Edit: Rereading the NSO statement they said they blocked exploitation of numbers starting with +1. Take that to mean whatever you'd like.
- bicepjai 5y ago
  You should listen to darknet diaries podcast about NSO group activities
Cyph0n 5y ago
I understand that, but they have repeatedly denied that this is the case, which is simply absurd.
Thorrez 5y ago
My thought was that the customer runs the server provided by NSO. I though the web form is running off of a webserver in a building owned by the customer.
- simonh 5y ago
  I used to work for an ISV in the finance industry. Most of our customers ran our stuff on their own servers in their own data centres, but we had direct logon to the application user account to manage the application config, do software upgrades, investigate issues, etc. A few of our customers preferred to support the software entirely themselves, we had no access and ran training courses for their support teams. I wouldn't be surprised if NSO offer a similar range of options depending on the client's budget and technical capabilities.
matheusmoreira 5y ago
... Is this real? There's no way to resist this?