4 ms·
NSO get way too much credit/dramatization these days. They are mostly 2 things * a shiny UI for customers * a bank of 0-days Those 0-days could be found in h
by shmatt 5y ago
NSO get way too much credit/dramatization these days. They are mostly 2 things
* a shiny UI for customers
* a bank of 0-days
Those 0-days could be found in house, could be brought in from a new employee copying a previous employer, or could simply be purchased.
Most people in the IDF understand when a great security researcher leaves 8200, the company they move to will probably have some of their secrets, theres really no way to stop a 0day from leaking from a researcher like that
This exploit has been closed, but we haven't heard anything about Pegasus not working anymore, so i'm just assuming they moved on to the next exploit. Previously there was a big Whatsapp exploit FB closed that had them hurting. I'm sure they always have multiple backups for when this happens
There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days. NSO is just "in your face" which makes people angry
NSO was caught, and thats why Google is crediting them. But this same exploit could have been heavily used by 8200/NSA/who knows who else
- wolf550e 5y agoThe researcher that leaves the military takes with them general skills in reverse engineering and exploit development, but they cannot use specific 0days they know about from their military service. The specifics of everything done in the military is classified. People told me they couldn't mention in job interviews some of the skills they have because it's a secret. Like, if someone developed this Turing complete architecture on top of jbig2 decompression while they were in the military, it would be considered a secret that cannot be revealed.
- Closi 5y ago> They cannot use specific 0days they know about from their military service Of course they can, it is just illegal and might be classed as treason or similar. Remember we are talking about getting exploits for nation states here rather than just some regular company - hiring spies is part of standard operations for the intelligence community and would be a valid zero-day acquisition strategy (depending on the protection offered for NSO by Israel).
- Jerrrry 5y ago>There is, and has always been, a 7 figure market for high quality 0days. Hell, maybe its 8 figures these days. popular social media account handles go for 4 figures. people have wallets on their phones with 6+ figures in crypto OSINT'ing a billionaires' phone number, leveraging a 0-click, and you are looking at 8+ figure trade, personal, and national secrets.
- sangnoir 5y agoThis has already allegedly happened to Bezos (attacked by Saudi Arabia IIRC, which is an NSO customer). This was likely over his ownership of Washington Post and the reporting on the killing of Kashoggi. Yeah, billionaires and Trillion-dollar company CxOs have to step up their electronic security
- Jerrrry 5y agoBezos willingly gave his personal Watsapp number to a Prince, just to "be in touch", and got hacked as a direct result. The Saudi's wanted leverage, gotten via Bezo's affair, but the US cannot let (national security) leverage escape our borders - and leaked his affair. Shit is just lulz to me.
- dillondoyle 5y agoThose conversations are important for a CEO like Bezos though. Let's not pretend MBS is not mega powerful. I would say those type of relationships for multi nationals is probably a bigger value/part of the ceo work than like micro managing teams. But it's super stupid he had just one phone combining personal, business, more private business. At least from the reporting that's what it sounds like happened. Even the dumb ass Jan 6th coordinators and Meadows used burner phones. IIRC standard practice for political 'execs'/important leg committee staff.
- vsareto 5y agoI think you get credit for having a bank of actual zero days, self-discovered or not Trying to trivialize the threat they pose only helps NSO Plus, "willing to sell to nations with bad human rights records" should be on that list
- deleted 5y ago[deleted]
- flatiron 5y ago“All the us army is is a bunch of tanks and planes”
- deleted 5y ago[deleted]