13 ms·

The secret Uganda deal that has brought NSO to the brink of collapse

238 points by dwynings 5y ago

fennecfoxen 5y ago
https://archive.md/At4rC https://archive.md/At4rC > In February 2019, an Israeli woman sat across from the son of Uganda’s president, and made an audacious pitch — would he want to secretly hack any phone in the world? [ ... ] for NSO, the Israeli company that created Pegasus, this dalliance into east Africa would prove to be the moment it crossed a red line, infuriating US diplomats and triggering a chain of events that would see it blacklisted by the commerce department, pursued by Apple, and driven to the verge of defaulting on its loans, according to interviews with US and Israeli officials, industry insiders and NSO employees. Looks like Uganda tried to hack 11 US diplomats, which ended up giving away the game, and getting everyone upset — and for but a pittance in revenue.
pm90 5y ago
This is an interesting industry. > “We always knew this thing had an expiration date,” he told the friend, complaining that some clients had asked to shift their contracts to lesser-known rivals, according to a person familiar with the conversation. I guess if you have this perspective, you want to maximize revenues and IPO before your product gets misused and invites US sanctions. I wonder what the reaction would be if this was a US company and not an Israeli one. Apple would still sue them, of course. But they couldn't be sanctioned by USG, right?
- yardie 5y ago
  > I wonder what the reaction would be if this was a US company and not an Israeli one. For hacking into a US official's phone without a warrant? They would go to jail.
  - trhway 5y ago
    This is why that mutual practice that say British spy on US companies/people, and US in exchange spies on British companies/people, and both thus don't violate their own laws. My understanding is that various US private, political and government forces have been using Israeli private physical and cyber security/intelligence services like NSO against US targets in particular for that reason. For example: https://en.wikipedia.org/wiki/Black_Cube#Iran_Nuclear_Deal_and_President_Donald_Trump_(2017-) https://en.wikipedia.org/wiki/Black_Cube#Iran_Nuclear_Deal_a... "In 2017 aides to U.S. President Donald Trump had contracted with Black Cube in order to undermine the Iran Nuclear Deal by discrediting two of former Obama administration officials such as Colin Kahl and Ben Rhodes."
- fennecfoxen 5y ago
  > I guess if you have this perspective, you want to maximize revenues and IPO Why would you IPO this business? Disclosures associated with the IPO might accelerate the expiration date, you don't need the capital, and IPOs cost real money, which you could instead move into your own pockets. What does it bring — besides lowkey defrauding investors, who don't know what they're getting theirselves into, so they can be left with a worthless business at the end of the game?
- cjfd 5y ago
  What would happen if it was a US company? Probably they would be forbidden from selling anything outside of the US. Remember what the US did with crypto exports for decades? Next, if you tried to investigate anything that it was doing, you would be persecuted relentlessly by the US government. Note what happened to Julian Assange. It really is not like the US government is a nice organization or anything.
  - KKKKkkkk1 5y ago
    > What would happen if it was a US company? Probably they would be forbidden from selling anything outside of the US. That's just false. The NSA bought the Swiss company Crypto AG and has been selling backdoored crypto devices all over the world for decades before being found out.
    - deleted 5y ago
      [deleted]
    - lazyasciiart 5y ago
      That doesn't seem like a similar enough story to contradict anything here.
- HillRat 5y ago
  A US company wouldn't be selling a CCL-restricted product to a foreign state without going through USG review -- or at least, they'd get to do that once, before DOJ comes in with the search warrants.
- jessaustin 5y ago
  ...maximize revenues and IPO... According to TFA their real trouble comes from the massive loans they took in order to take the firm private. If CEO really said the above, he seems really squirrelly.
- Sporktacular 5y ago
  Would depend on the US government of the day. Hacking Team and Finfisher weren't US based, they attracted lots of shit from their governments and the EU where they were based. The reaction so far doesn't seem to be negative just because they are Israeli.
yardie 5y ago
Which is odd because NSO made many assurances to the US govt they were in control of the tech and that US nationals were not to be included. Looks like they weren't in as much control as they stated they were.
- FabHK 5y ago
  Maybe NSO didn't allow it to be used on US numbers. How are they supposed to know the nationality of the user of a phone? > NSO has always told its customers that US phone numbers are off-limits. In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.
  - perlgeek 5y ago
    > How are they supposed to know the nationality of the user of a phone? That's why you do recon before targeting somebody. Do you suppose they just sprayed the malware onto random phones? I get the impression that Pegasus is meant to be used in a very targeted way, at people you have identified before, and have some reason to spy on. If you do that way, what are you chances of wanting to target somebody else, and accidentally getting 11 US embassy employees? NSO promised oversight, they can't just weasel they way out by saying "there's no way would could have implemented effective oversight".
- pm90 5y ago
  Yeah, it looks like they used a pretty basic whitelist: > In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.
- hermes8329 5y ago
  Is that sarcasm? The Israelis spying on the us is hardly anything new
  - yardie 5y ago
    A bit of both. I assume they can spy on the US through 5-eyes, 9-eyes, 27eyes, etc. But to allow Uganda to do it was a bridge too far. If NSO had been in almost any other country there wouldn't be a building left standing. The US regards cyberattacks as an act of war.
profstasiak 5y ago
Right now we have mini crisis in Poland connected with this US/NSO war. One prosecutor, who is fighting for indepenend judiciary and against her political boss, head prosecutor Minister of Justice, smaller party Coalition member, got notification her iPhone has been hacked multiple time by Pegasus. She angried the rulling coalition, after she wanted to investigate illegal vote by mail election, that didnt take place at the end but cost Poland 23 mil USD. The other person that was hacked more than ten times, is famous attorney, previous politician. He was an attorney of opositionfuhrer Donald Tusk, former PM. He was representing multiple high level clients that were suing the government, including one that was scammed by the head of rulling party Law and Justice. Hacking took place in times of campaign before elections. Poland is such a crazy country right now. If you can write an email to ur congressman to fight for biggest US investment in Poland, TVN tv station that sheds light on this corrupt government. They are trying to make the owner (Discovery) sell TVN, worth one billion USD
- mzs 5y ago
  Could you please name: > One prosecutor, who is fighting for > The other person that was hacked more than ten times, is famous attorney edit: https://news.ycombinator.com/item?id=29648072 https://news.ycombinator.com/item?id=29648072
  - qnsi 5y ago
    as mentioned by a sibling. You can read about it here https://www.politico.eu/article/polish-spyware-scandal-stokes-up-tensions-with-eu/ https://www.politico.eu/article/polish-spyware-scandal-stoke...
  - artek 5y ago
    Roman Giertych is the attorney and Ewa Wrzosek is the prosecutor whose smartphones were hacked.
- pzo 5y ago
  There is such a polarization right now in Poland between society that let's maybe don't put politics here. I don't like both the opposition and the ruling party but I try to at least read both sides of the story. You are definitely presenting very biased point of view here
motohagiography 5y ago
I commented previously that the Uganda case was the first truly legitimate application of NSO's tech and the first one that wasn't actually a scandal, as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders. It seems this particular NSO case is being used as bargaining leverage to discredit Israel's position in the Iran nuclear talks. NSO is subject to being a pawn on that board, it's plausible they get sacrificed and this is the story around it. It's a very weird place to be even lightly defending this company based on abstract principles, but they weren't taken out by some of the really egregious things they've done, and this seems fait accompli and we're just waiting for the narrative to complete. I suppose everything within a degree of the world they operate in is smoke and mirrors, but accepting the sanctimony around it at face value makes me feel like a rube.
- kingcharles 5y ago
  You're absolutely right, and I don't think anyone else has made that point. The problem was the spies they tried to fuck with were American spies and American wasn't going to stand for that. As you say, NSO are now just a toy, and if they are destroyed thanks to this, no-one is going to give a fuck.
  - jprd 5y ago
    I cannot see a world in which use of NSO tech is legitimate. Get a court order to tap the phone line, etc. How can usage of a Mossad / IDF tool be considered legitimate? Just because the ruling party in a state decides so, doesn't mean this has any bearing on human rights or _legitimacy_. China is eradicating Uyghur culture and running for-profit concentration camps. These are legitimate uses of their Governmental powers. Does that make them ethical? Of course not. Technology like this is dystopian and anti-humanity. There is no way that this technology is profitable, exported and somehow used for "legitimate" purposes. The entire enterprise is predicated on making vulnerable people more vulnerable. The end result is more Khashoggi awfulness, how could it NOT be?
    - jimkleiber 5y ago
bestouff 5y ago
So hacking phones for the US governement is ok, but hacking phones for Uganda is not ?
- rmah 5y ago
  Yes, according to the US gov. I imagine that according to the Ugandan gov, it's ok to hack phones of foreign govs but not of the Ugandan gov. In fact, I strongly suspect that for any nation X, it's ok to hack non-X gov phones but not X gov phones. I don't understand why this surprises anyone.
- BrazzVuvuzela 5y ago
  You're only feigning surprise.. right?
  - bestouff 5y ago
    Of course I do. I should have added "/s" ...
- hn_throwaway_69 5y ago
  You can't really equate the rules that should apply to full democracies with those that should apply to partial democracies or totalitarian regimes. There's no evidence the US has used NSO like tools to spy on the opposition (post Watergate, anyway). Partial democracies or totalitarian regimes shouldn't be given these tools under any circumstances since they can't be trusted to only use them to investigate legitimate crimes. They will present some bona fide use scenario, then use the tools for other undisclosed purposes. If NSO Group had an ounce of ethics, it wouldn't provide the software, but would request a dossier/brief which outlines, with evidence, the basis on which intrusion into the target device is sought. It would then have an agent carry out exploitation. Political "crimes" should be refused service.
  - kgonza 5y ago
    The USA is a big supporter of Saudi Arabia and the UAE, which have waged a destructive war in Yemen. Ergo, the USA and it's leaders are largely responsible for what has happened in Yemen. Yet I am sure that you would argue that Uganda is authoritarian but the USA is a "mature democracy". Lol.
optimalsolver 5y ago
Were the US officials that Uganda was spying on diplomats, or "diplomats"?
- kingcharles 5y ago
  LOL, all diplomats are "diplomats" when push comes to shove.
  - TMWNN 5y ago
    Yes, but you are correct in another way. If the US diplomats Uganda used the NSO technology to spy on are intelligence agents, they still possess diplomatic immunity. They are in Uganda with cover (as opposed to non-cover; that is, they are in country without being a public US goernment employee).
- seoaeu 5y ago
  Quite likely, answering that question was one of the top reasons why Uganda did this in the first place!
- stefan_ 5y ago
  Surely if they were "diplomats" we shouldn't need Apple to send them a mail to know their phones are compromised (by such an obvious trojan, even)?
1cvmask 5y ago
There is a unclear reference to Intel in the article. Was Intel working with NSO? "In recent weeks, for instance, Intel asked all its employees to cease any ongoing business relationships with NSO, one person familiar with the matter said. Intel said in a statement that it “complies with all applicable US laws, including US export control regulations”."
- lazyasciiart 5y ago
  They would have at least a sales account.
- cookie_monsta 5y ago
  I thought the paragraph preceding that one gave the context: > The blacklisting, which came in November, means that NSO cannot buy any equipment, service, or intellectual property from US-based companies without approval, crippling a company whose terminals ran on servers from Dell and Intel, routers from Cisco, and whose desktop computers run on Windows operating systems, according to a spec sheet from a sale to Ghana, in West Africa
fouc 5y ago
>when Google reverse-engineered the hack used against American diplomats in Uganda, they found an elegant, tiny piece of code that adapted software from 1990s Xerox machines to fit a so-called Turing machine — essentially a complete computer — into a single GIF file. LOL at describing PDFs as "adapted software from 1990s Xerox machines" https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- oasisbob 5y ago
  Having spent some time with OCR and scanning recently, I'd have to agree. A lot of news articles are describing JBIG2 as something archaic, when it seems to be as relevant and commonplace as ever. (see MRC, for a modern application)
  - ciabattabread 5y ago
    The article was originally written for Financial Times, whose audience will have a general knowledge of computing. Also, what the heck is MRC?
    - klodolph 5y ago
      Mixed raster content, I assume. Basically, you scan a paper document. It contains a mixture of line art, text, and photographs—“mixed” types of content. You can segment it and use different codecs to encode these different segments, and then combine the results in a PDF.
    - oasisbob 5y ago
      News articles, plural. Eg, here is another story by way of Ars: > Essentially, 1990's algorithms used in photocopying and scanning compression are still lurking in modern communication software, with all of the flaws and baggage that come with them. https://arstechnica.com/information-technology/2021/12/google-warns-that-nso-hacking-is-on-par-with-elite-nation-state-spies/ https://arstechnica.com/information-technology/2021/12/googl... Given than JBIG2 wasn't standardized until 2000, and that the Apple vulnerability was in their implementation (vs the standard) I just don't understand this characterization.
dylan604 5y ago
>Looks like Uganda tried to hack 11 US diplomats, which ended up giving away the game, and getting everyone upset — and for but a pittance in revenue. Isn't this why most spy agencies are very afraid to use their most prized assets in fear of revealing the assets?
cycomanic 5y ago
The difference in response from the US to hacking of their diplomat phones compared to the response in Germany to the US listening on calls from Merkel and others is really telling. It makes you question how independent European countries really are from the US.
guytv 5y ago
Advanced technology was once held mainly in the hands of governments. In recent years, corps and mega-corps are getting far more advanced technology than the government has. For governments, this means loss of power. So governments around the world use whatever means they have to prevent such technologies to prolifirate. US govm't tried to stop the export of strong encryption. The it shutdown Facebooks crypto-currency - to prevent FB to have its own global-dollar. That's why the US just waited for the right time to end the party where dollars could buy you cyber abilities only reserved to the NSA and CIA. It's not about civil rights, it's ont about money laundring, its just about the US trying to keep ahead of everyone else.
petesergeant 5y ago
> brought in between $10 million and $20 million, a fraction of the $243 million I mean I guess 7.5% is technically “a fraction”, but I’m used to this phrasing meaning “a really tiny fraction”
- perlgeek 5y ago
  I thought the same, but then maybe the 10mio to 20mio was also distributed over several years, making it less than the 7.5% of their revenue.
vmception 5y ago
> “We always knew this thing had an expiration date,” he told the friend after $200mm in revenue, I love the cavalier nature of that. it humanizes the operation more than anything I've read and NSO group is even at risk of defaulting on some loans, that it must have taken out for no reason aside from having extra totally fuckable capital to default on. honestly, hope I run into this guy in Monaco and have a drink. just won't exchange contact information
selimthegrim 5y ago
This wasn’t what Herzl meant by the Uganda option I take it
eunos 5y ago
If you are excommunicated (sort of) by the US, who you could cling next? Only Russia and China at this point.
Sporktacular 5y ago
“We always knew this thing had an expiration date,” (Hulio) told the friend" This was clearly the plan all along. Such companies live and die by their low profiles. Was probably not the founders' first such company nor will it be their last. Next step will be to close up, take the contacts, clients, capital, the lessons learned and the cream of the staff to whatever mercenary, unethical piece of crap they make next. This is why killing the industry as a whole is so important. It'll mean going after the owners, suppliers and employees/contractors with naming/shaming, coordinated sanctions, criminal charges, designated persons lists etc. until their reputations are trash. No bank would fund it, no parters would supply it and no one with any talent would ever contemplate such a catastrophic career move in future.
- FpUser 5y ago
  >"It'll mean going after the owners, suppliers and employees/contractors with naming/shaming, coordinated sanctions, criminal charges, designated persons lists etc. until their reputations are trash." What a brave approach. Especially in regards to employees. This would close down every other major US company.
  - programmarchy 5y ago
    They knew what they were doing. And I don’t see why major US companies deserve much sympathy if they’re as bad as you say.
  - asdfasgasdgasdg 5y ago
    "every other major us company" how do you figure? Are most major us companies selling exploits at all, let alone to rogue states?
- post_from_work 5y ago
  "This is why killing the industry as a whole is so important. It'll mean going after the owners, suppliers and employees/contractors with naming/shaming, coordinated sanctions, criminal charges, designated persons lists etc. until their reputations are trash. No bank would fund it, no parters would supply it and no one with any talent would ever contemplate such a catastrophic career move in future." And no government of any geopolitical significance would ever support such actions. These kinds of people, and their skills/tools, are FAR too useful.
ggm 5y ago
If you replace your handset, keep your SIM, how does NSO recapture you? I don't understand how rich powerful technocrats get stung so often: surely the path out is to swap device and move on? I should be clear I do believe they are being recaptured. I just don't understand how. In the pre digital world, most phone steals were inside jobs: somebody leaked info leading to a voicemail hack or a stingray type cell listen in. Post digital, i suspect a lot of things are still inside jobs, but on phone compromise feels like a problem moving platform solves.
- MicCheck 5y ago
  NSO used a zero-click exploit. Swapping the device for another vulnerable iPhone wouldn't put up much of a hurdle. They'd just a message with the exploit an reinfect the phone in under 30 seconds. Changing the phone and SIM would only work until the new phone number became known. For high-value public targets (with lot of contacts) it porobably won't take long until the new number leaks again.
fortran77 5y ago
You would think Apple, the company that makes the platform which enables all this, would be held accountable too. But people turn a blind eye to their false claims of a secure platform.
- danny_codes 5y ago
  If I leave my bike locked up outside my office and come back to find it's been stolen with a handheld circular saw, I don't see how that's my fault. I implemented a reasonable level of security, but there's not much I can do against a circular saw. iOS is massive. Operating systems are massive, from an attack-surface perspective. NSO is hiring out of the Israeli intelligence pool: these are among the best security engineers in the world. They don't always find exploits (IIRC there are some versions of iOS they don't have hacks for at a given time), but the game is in their favor, simply because the OS is, well, the size of an OS.
  - fortran77 5y ago
    Apple advertises it as "secure by design." See: https://www.apple.com/business/docs/site/AAW_Platform_Security.pdf https://www.apple.com/business/docs/site/AAW_Platform_Securi...
AtlasBarfed 5y ago
What chance do our voting machines have against this level of state sponsored weaponry?

238 points by dwynings 5y ago

https://archive.md/At4rC https://archive.md/At4rC > In February 2019, an Israeli woman sat across from the son of Uganda’s president, and made an audacious pitch — would he want to secretly hack any phone in the world? [ ... ] for NSO, the Israeli company that created Pegasus, this dalliance into east Africa would prove to be the moment it crossed a red line, infuriating US diplomats and triggering a chain of events that would see it blacklisted by the commerce department, pursued by Apple, and driven to the verge of defaulting on its loans, according to interviews with US and Israeli officials, industry insiders and NSO employees. Looks like Uganda tried to hack 11 US diplomats, which ended up giving away the game, and getting everyone upset — and for but a pittance in revenue.

pm90 5y ago

This is an interesting industry. > “We always knew this thing had an expiration date,” he told the friend, complaining that some clients had asked to shift their contracts to lesser-known rivals, according to a person familiar with the conversation. I guess if you have this perspective, you want to maximize revenues and IPO before your product gets misused and invites US sanctions. I wonder what the reaction would be if this was a US company and not an Israeli one. Apple would still sue them, of course. But they couldn't be sanctioned by USG, right?

yardie 5y ago
> I wonder what the reaction would be if this was a US company and not an Israeli one. For hacking into a US official's phone without a warrant? They would go to jail.
- trhway 5y ago
  This is why that mutual practice that say British spy on US companies/people, and US in exchange spies on British companies/people, and both thus don't violate their own laws. My understanding is that various US private, political and government forces have been using Israeli private physical and cyber security/intelligence services like NSO against US targets in particular for that reason. For example: https://en.wikipedia.org/wiki/Black_Cube#Iran_Nuclear_Deal_and_President_Donald_Trump_(2017-) https://en.wikipedia.org/wiki/Black_Cube#Iran_Nuclear_Deal_a... "In 2017 aides to U.S. President Donald Trump had contracted with Black Cube in order to undermine the Iran Nuclear Deal by discrediting two of former Obama administration officials such as Colin Kahl and Ben Rhodes."
fennecfoxen 5y ago
> I guess if you have this perspective, you want to maximize revenues and IPO Why would you IPO this business? Disclosures associated with the IPO might accelerate the expiration date, you don't need the capital, and IPOs cost real money, which you could instead move into your own pockets. What does it bring — besides lowkey defrauding investors, who don't know what they're getting theirselves into, so they can be left with a worthless business at the end of the game?
cjfd 5y ago
What would happen if it was a US company? Probably they would be forbidden from selling anything outside of the US. Remember what the US did with crypto exports for decades? Next, if you tried to investigate anything that it was doing, you would be persecuted relentlessly by the US government. Note what happened to Julian Assange. It really is not like the US government is a nice organization or anything.
- KKKKkkkk1 5y ago
  > What would happen if it was a US company? Probably they would be forbidden from selling anything outside of the US. That's just false. The NSA bought the Swiss company Crypto AG and has been selling backdoored crypto devices all over the world for decades before being found out.
  - deleted 5y ago
    [deleted]
  - lazyasciiart 5y ago
    That doesn't seem like a similar enough story to contradict anything here.
HillRat 5y ago
A US company wouldn't be selling a CCL-restricted product to a foreign state without going through USG review -- or at least, they'd get to do that once, before DOJ comes in with the search warrants.
jessaustin 5y ago
...maximize revenues and IPO... According to TFA their real trouble comes from the massive loans they took in order to take the firm private. If CEO really said the above, he seems really squirrelly.
Sporktacular 5y ago
Would depend on the US government of the day. Hacking Team and Finfisher weren't US based, they attracted lots of shit from their governments and the EU where they were based. The reaction so far doesn't seem to be negative just because they are Israeli.

yardie 5y ago

Which is odd because NSO made many assurances to the US govt they were in control of the tech and that US nationals were not to be included. Looks like they weren't in as much control as they stated they were.

FabHK 5y ago
Maybe NSO didn't allow it to be used on US numbers. How are they supposed to know the nationality of the user of a phone? > NSO has always told its customers that US phone numbers are off-limits. In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.
- perlgeek 5y ago
  > How are they supposed to know the nationality of the user of a phone? That's why you do recon before targeting somebody. Do you suppose they just sprayed the malware onto random phones? I get the impression that Pegasus is meant to be used in a very targeted way, at people you have identified before, and have some reason to spy on. If you do that way, what are you chances of wanting to target somebody else, and accidentally getting 11 US embassy employees? NSO promised oversight, they can't just weasel they way out by saying "there's no way would could have implemented effective oversight".
pm90 5y ago
Yeah, it looks like they used a pretty basic whitelist: > In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.
hermes8329 5y ago
Is that sarcasm? The Israelis spying on the us is hardly anything new
- yardie 5y ago
  A bit of both. I assume they can spy on the US through 5-eyes, 9-eyes, 27eyes, etc. But to allow Uganda to do it was a bridge too far. If NSO had been in almost any other country there wouldn't be a building left standing. The US regards cyberattacks as an act of war.

profstasiak 5y ago

Right now we have mini crisis in Poland connected with this US/NSO war. One prosecutor, who is fighting for indepenend judiciary and against her political boss, head prosecutor Minister of Justice, smaller party Coalition member, got notification her iPhone has been hacked multiple time by Pegasus. She angried the rulling coalition, after she wanted to investigate illegal vote by mail election, that didnt take place at the end but cost Poland 23 mil USD. The other person that was hacked more than ten times, is famous attorney, previous politician. He was an attorney of opositionfuhrer Donald Tusk, former PM. He was representing multiple high level clients that were suing the government, including one that was scammed by the head of rulling party Law and Justice. Hacking took place in times of campaign before elections. Poland is such a crazy country right now. If you can write an email to ur congressman to fight for biggest US investment in Poland, TVN tv station that sheds light on this corrupt government. They are trying to make the owner (Discovery) sell TVN, worth one billion USD

mzs 5y ago
Could you please name: > One prosecutor, who is fighting for > The other person that was hacked more than ten times, is famous attorney edit: https://news.ycombinator.com/item?id=29648072 https://news.ycombinator.com/item?id=29648072
- qnsi 5y ago
  as mentioned by a sibling. You can read about it here https://www.politico.eu/article/polish-spyware-scandal-stokes-up-tensions-with-eu/ https://www.politico.eu/article/polish-spyware-scandal-stoke...
- artek 5y ago
  Roman Giertych is the attorney and Ewa Wrzosek is the prosecutor whose smartphones were hacked.
pzo 5y ago
There is such a polarization right now in Poland between society that let's maybe don't put politics here. I don't like both the opposition and the ruling party but I try to at least read both sides of the story. You are definitely presenting very biased point of view here

motohagiography 5y ago

I commented previously that the Uganda case was the first truly legitimate application of NSO's tech and the first one that wasn't actually a scandal, as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders. It seems this particular NSO case is being used as bargaining leverage to discredit Israel's position in the Iran nuclear talks. NSO is subject to being a pawn on that board, it's plausible they get sacrificed and this is the story around it. It's a very weird place to be even lightly defending this company based on abstract principles, but they weren't taken out by some of the really egregious things they've done, and this seems fait accompli and we're just waiting for the narrative to complete. I suppose everything within a degree of the world they operate in is smoke and mirrors, but accepting the sanctimony around it at face value makes me feel like a rube.

kingcharles 5y ago
You're absolutely right, and I don't think anyone else has made that point. The problem was the spies they tried to fuck with were American spies and American wasn't going to stand for that. As you say, NSO are now just a toy, and if they are destroyed thanks to this, no-one is going to give a fuck.
- jprd 5y ago
  I cannot see a world in which use of NSO tech is legitimate. Get a court order to tap the phone line, etc. How can usage of a Mossad / IDF tool be considered legitimate? Just because the ruling party in a state decides so, doesn't mean this has any bearing on human rights or _legitimacy_. China is eradicating Uyghur culture and running for-profit concentration camps. These are legitimate uses of their Governmental powers. Does that make them ethical? Of course not. Technology like this is dystopian and anti-humanity. There is no way that this technology is profitable, exported and somehow used for "legitimate" purposes. The entire enterprise is predicated on making vulnerable people more vulnerable. The end result is more Khashoggi awfulness, how could it NOT be?
  - jimkleiber 5y ago

bestouff 5y ago

So hacking phones for the US governement is ok, but hacking phones for Uganda is not ?

rmah 5y ago
Yes, according to the US gov. I imagine that according to the Ugandan gov, it's ok to hack phones of foreign govs but not of the Ugandan gov. In fact, I strongly suspect that for any nation X, it's ok to hack non-X gov phones but not X gov phones. I don't understand why this surprises anyone.
BrazzVuvuzela 5y ago
You're only feigning surprise.. right?
- bestouff 5y ago
  Of course I do. I should have added "/s" ...
hn_throwaway_69 5y ago
You can't really equate the rules that should apply to full democracies with those that should apply to partial democracies or totalitarian regimes. There's no evidence the US has used NSO like tools to spy on the opposition (post Watergate, anyway). Partial democracies or totalitarian regimes shouldn't be given these tools under any circumstances since they can't be trusted to only use them to investigate legitimate crimes. They will present some bona fide use scenario, then use the tools for other undisclosed purposes. If NSO Group had an ounce of ethics, it wouldn't provide the software, but would request a dossier/brief which outlines, with evidence, the basis on which intrusion into the target device is sought. It would then have an agent carry out exploitation. Political "crimes" should be refused service.
- kgonza 5y ago
  The USA is a big supporter of Saudi Arabia and the UAE, which have waged a destructive war in Yemen. Ergo, the USA and it's leaders are largely responsible for what has happened in Yemen. Yet I am sure that you would argue that Uganda is authoritarian but the USA is a "mature democracy". Lol.

optimalsolver 5y ago

Were the US officials that Uganda was spying on diplomats, or "diplomats"?

kingcharles 5y ago
LOL, all diplomats are "diplomats" when push comes to shove.
- TMWNN 5y ago
  Yes, but you are correct in another way. If the US diplomats Uganda used the NSO technology to spy on are intelligence agents, they still possess diplomatic immunity. They are in Uganda with cover (as opposed to non-cover; that is, they are in country without being a public US goernment employee).
seoaeu 5y ago
Quite likely, answering that question was one of the top reasons why Uganda did this in the first place!
stefan_ 5y ago
Surely if they were "diplomats" we shouldn't need Apple to send them a mail to know their phones are compromised (by such an obvious trojan, even)?

1cvmask 5y ago

There is a unclear reference to Intel in the article. Was Intel working with NSO? "In recent weeks, for instance, Intel asked all its employees to cease any ongoing business relationships with NSO, one person familiar with the matter said. Intel said in a statement that it “complies with all applicable US laws, including US export control regulations”."

lazyasciiart 5y ago
They would have at least a sales account.
cookie_monsta 5y ago
I thought the paragraph preceding that one gave the context: > The blacklisting, which came in November, means that NSO cannot buy any equipment, service, or intellectual property from US-based companies without approval, crippling a company whose terminals ran on servers from Dell and Intel, routers from Cisco, and whose desktop computers run on Windows operating systems, according to a spec sheet from a sale to Ghana, in West Africa

fouc 5y ago

>when Google reverse-engineered the hack used against American diplomats in Uganda, they found an elegant, tiny piece of code that adapted software from 1990s Xerox machines to fit a so-called Turing machine — essentially a complete computer — into a single GIF file. LOL at describing PDFs as "adapted software from 1990s Xerox machines" https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

oasisbob 5y ago
Having spent some time with OCR and scanning recently, I'd have to agree. A lot of news articles are describing JBIG2 as something archaic, when it seems to be as relevant and commonplace as ever. (see MRC, for a modern application)
- ciabattabread 5y ago
  The article was originally written for Financial Times, whose audience will have a general knowledge of computing. Also, what the heck is MRC?
  - klodolph 5y ago
    Mixed raster content, I assume. Basically, you scan a paper document. It contains a mixture of line art, text, and photographs—“mixed” types of content. You can segment it and use different codecs to encode these different segments, and then combine the results in a PDF.
  - oasisbob 5y ago
    News articles, plural. Eg, here is another story by way of Ars: > Essentially, 1990's algorithms used in photocopying and scanning compression are still lurking in modern communication software, with all of the flaws and baggage that come with them. https://arstechnica.com/information-technology/2021/12/google-warns-that-nso-hacking-is-on-par-with-elite-nation-state-spies/ https://arstechnica.com/information-technology/2021/12/googl... Given than JBIG2 wasn't standardized until 2000, and that the Apple vulnerability was in their implementation (vs the standard) I just don't understand this characterization.

dylan604 5y ago

>Looks like Uganda tried to hack 11 US diplomats, which ended up giving away the game, and getting everyone upset — and for but a pittance in revenue. Isn't this why most spy agencies are very afraid to use their most prized assets in fear of revealing the assets?

cycomanic 5y ago

The difference in response from the US to hacking of their diplomat phones compared to the response in Germany to the US listening on calls from Merkel and others is really telling. It makes you question how independent European countries really are from the US.

guytv 5y ago

Advanced technology was once held mainly in the hands of governments. In recent years, corps and mega-corps are getting far more advanced technology than the government has. For governments, this means loss of power. So governments around the world use whatever means they have to prevent such technologies to prolifirate. US govm't tried to stop the export of strong encryption. The it shutdown Facebooks crypto-currency - to prevent FB to have its own global-dollar. That's why the US just waited for the right time to end the party where dollars could buy you cyber abilities only reserved to the NSA and CIA. It's not about civil rights, it's ont about money laundring, its just about the US trying to keep ahead of everyone else.

petesergeant 5y ago

> brought in between $10 million and $20 million, a fraction of the $243 million I mean I guess 7.5% is technically “a fraction”, but I’m used to this phrasing meaning “a really tiny fraction”

perlgeek 5y ago
I thought the same, but then maybe the 10mio to 20mio was also distributed over several years, making it less than the 7.5% of their revenue.

vmception 5y ago

> “We always knew this thing had an expiration date,” he told the friend after $200mm in revenue, I love the cavalier nature of that. it humanizes the operation more than anything I've read and NSO group is even at risk of defaulting on some loans, that it must have taken out for no reason aside from having extra totally fuckable capital to default on. honestly, hope I run into this guy in Monaco and have a drink. just won't exchange contact information

selimthegrim 5y ago

This wasn’t what Herzl meant by the Uganda option I take it

eunos 5y ago

If you are excommunicated (sort of) by the US, who you could cling next? Only Russia and China at this point.

Sporktacular 5y ago

“We always knew this thing had an expiration date,” (Hulio) told the friend" This was clearly the plan all along. Such companies live and die by their low profiles. Was probably not the founders' first such company nor will it be their last. Next step will be to close up, take the contacts, clients, capital, the lessons learned and the cream of the staff to whatever mercenary, unethical piece of crap they make next. This is why killing the industry as a whole is so important. It'll mean going after the owners, suppliers and employees/contractors with naming/shaming, coordinated sanctions, criminal charges, designated persons lists etc. until their reputations are trash. No bank would fund it, no parters would supply it and no one with any talent would ever contemplate such a catastrophic career move in future.

FpUser 5y ago
>"It'll mean going after the owners, suppliers and employees/contractors with naming/shaming, coordinated sanctions, criminal charges, designated persons lists etc. until their reputations are trash." What a brave approach. Especially in regards to employees. This would close down every other major US company.
- programmarchy 5y ago
  They knew what they were doing. And I don’t see why major US companies deserve much sympathy if they’re as bad as you say.
- asdfasgasdgasdg 5y ago
  "every other major us company" how do you figure? Are most major us companies selling exploits at all, let alone to rogue states?
post_from_work 5y ago
"This is why killing the industry as a whole is so important. It'll mean going after the owners, suppliers and employees/contractors with naming/shaming, coordinated sanctions, criminal charges, designated persons lists etc. until their reputations are trash. No bank would fund it, no parters would supply it and no one with any talent would ever contemplate such a catastrophic career move in future." And no government of any geopolitical significance would ever support such actions. These kinds of people, and their skills/tools, are FAR too useful.

ggm 5y ago

If you replace your handset, keep your SIM, how does NSO recapture you? I don't understand how rich powerful technocrats get stung so often: surely the path out is to swap device and move on? I should be clear I do believe they are being recaptured. I just don't understand how. In the pre digital world, most phone steals were inside jobs: somebody leaked info leading to a voicemail hack or a stingray type cell listen in. Post digital, i suspect a lot of things are still inside jobs, but on phone compromise feels like a problem moving platform solves.

MicCheck 5y ago
NSO used a zero-click exploit. Swapping the device for another vulnerable iPhone wouldn't put up much of a hurdle. They'd just a message with the exploit an reinfect the phone in under 30 seconds. Changing the phone and SIM would only work until the new phone number became known. For high-value public targets (with lot of contacts) it porobably won't take long until the new number leaks again.

fortran77 5y ago

You would think Apple, the company that makes the platform which enables all this, would be held accountable too. But people turn a blind eye to their false claims of a secure platform.

danny_codes 5y ago
If I leave my bike locked up outside my office and come back to find it's been stolen with a handheld circular saw, I don't see how that's my fault. I implemented a reasonable level of security, but there's not much I can do against a circular saw. iOS is massive. Operating systems are massive, from an attack-surface perspective. NSO is hiring out of the Israeli intelligence pool: these are among the best security engineers in the world. They don't always find exploits (IIRC there are some versions of iOS they don't have hacks for at a given time), but the game is in their favor, simply because the OS is, well, the size of an OS.
- fortran77 5y ago
  Apple advertises it as "secure by design." See: https://www.apple.com/business/docs/site/AAW_Platform_Security.pdf https://www.apple.com/business/docs/site/AAW_Platform_Securi...

AtlasBarfed 5y ago

What chance do our voting machines have against this level of state sponsored weaponry?