7 ms·

Which is odd because NSO made many assurances to the US govt they were in control of the tech and that US nationals were not to be included. Looks like they wer

by yardie 5y ago

Which is odd because NSO made many assurances to the US govt they were in control of the tech and that US nationals were not to be included. Looks like they weren't in as much control as they stated they were.

FabHK 5y ago
Maybe NSO didn't allow it to be used on US numbers. How are they supposed to know the nationality of the user of a phone? > NSO has always told its customers that US phone numbers are off-limits. In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.
- perlgeek 5y ago
  > How are they supposed to know the nationality of the user of a phone? That's why you do recon before targeting somebody. Do you suppose they just sprayed the malware onto random phones? I get the impression that Pegasus is meant to be used in a very targeted way, at people you have identified before, and have some reason to spy on. If you do that way, what are you chances of wanting to target somebody else, and accidentally getting 11 US embassy employees? NSO promised oversight, they can't just weasel they way out by saying "there's no way would could have implemented effective oversight".
pm90 5y ago
Yeah, it looks like they used a pretty basic whitelist: > In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.
hermes8329 5y ago
Is that sarcasm? The Israelis spying on the us is hardly anything new
- yardie 5y ago
  A bit of both. I assume they can spy on the US through 5-eyes, 9-eyes, 27eyes, etc. But to allow Uganda to do it was a bridge too far. If NSO had been in almost any other country there wouldn't be a building left standing. The US regards cyberattacks as an act of war.
  - hulahoof 5y ago
    But Israel isn't a part of any of those agreements, it would be just as likely they spy on the US via a direct partnership with US agencies
  - pc86 5y ago
    If the US really regarded cyberattacks as an act of war, it would be actively shooting missiles and bullets at China right now. The US regards cyberattacks as acts of war when convenient, nothing more.
    - lmm 5y ago
      "Act of war" is a legal and diplomatic nicety that, like essentially all international law, you talk about when it happens to align with your realpolitik. It doesn't mean you immediately launch the nukes whenever someone arrests one of your diplomats.
    - not2b 5y ago
      Nuclear powers can't make full-scale war on each other. If they ever do, the death toll would make WW2 look like a skirmish. So any attacks are at the edges (respond in kind, or proportionately, rather than escalate to a shooting war).
      - pc86 5y ago
        So the US regards cyberattacks as acts of war if it comes from a non-nuclear country, and tomfoolery from a nuclear one? I don't disagree with your point, simply saying that IMO the US doesn't take cyberattacks seriously precisely because it leads down a dark path with China (and probably Russia too if we're being honest).
vsareto 5y ago
Naturally, NSO will be blamed instead of the US govt for thinking that was actually possible. Especially after the shadow brokers leak.
- matthewdgreen 5y ago
  It is actually possible to not sell software that spies on US diplomats. Why, I achieve this goal every single day.
  - trhway 5y ago
    >It is actually possible to not sell software that spies on US diplomats. Why, I achieve this goal every single day. it isn't that easy :) If you work on any major and/or popular software it is most probably used by State Dept (even if it is just an obscure part of some software stack that some State Dept LOB is using implicitly). Theoretically any software may have bugs/holes and thus be a part of such a spying.
shmatt 5y ago
US nationals have never been protected. If you make an international phone call the government can track it[1]. If its internal they can't without a warrant NSO built in a complete block of +1 phone numbers. But those US diplomats were not using +1. Which itself is a security issue that i'm sure is already being discussed at the state department [1]https://www.usatoday.com/story/news/2015/04/07/dea-bulk-telephone-surveillance-operation/70808616/ https://www.usatoday.com/story/news/2015/04/07/dea-bulk-tele...
- wins32767 5y ago
  Seems silly to call it a security issue when the bulk of the day to day activities for many state department employees is working closely with local nationals. Do you really want to make your average Ugandan caterer make an international call to the US in order to coordinate food delivery for an embassy event?
  - kingcharles 5y ago
    And the fact that you're not likely to answer a call from an international number because it'll probably look more like spam. Also, for them to have a +1 number outside the USA means they have to be on a USA network and then roaming onto a local network. This presents dozens of problems, such as often not being able to get the best connection, not being able to get data connections, not being able to get any local support, and it costing a small fortune. All the embassy employees I have ever known have gone full native with all of their technology etc.
  - hervature 5y ago
    Having a "caterer and friends" local dumbphone and an international phone for actual business doesn't seem unreasonable.
    - ufmace 5y ago
      Presumably, linked to what the sibling said, any actual business probably ought to go over high-security data connections anyways if it's going to go over any mobile network at all. No telling who's tapping into telecom systems in third-world countries, and normal phone calls probably go in the clear no matter what the registered phone number or roaming agreement is for the device.
Terry_Roll 5y ago
I think NSO are scapegoats, because how hard is it for a country to setup up a honeypot device to analyse NSO'a attack vectors and then copy it for their own use whilst being able to blame it on NSO? I say this because I've had stuff done to my phones in the past, one strange incident with a "hacked" phone was selecting an AirBnB, which I believe directed me to a few of their "safe" houses. Other examples, include batteries going flat over night when asleep despite phone being switched off, not charging but was fully charged before it was switched off. The phone signal is weak when that took place so it would have burned through the battery amplifying the signal, but listening in to people sleeping can elucidate what might be on their mind!
- azinman2 5y ago
  > but listening in to people sleeping can elucidate what might be on their mind! Once you go conspiracy there’s no end to what seems possible…
  - Terry_Roll 5y ago
    Its not conspiracy, if you consume a few grams of lecithin before bed, your dreams will be based on what you saw just before bed. So if you can use a phone to make sounds or says things to someone in their sleep at pertinent moments, you could start having a conversation with them in their sleep or just trigger them to see what they say! You should try it, its fascinating!
    - azinman2 5y ago
      I’ve recorded my sleep many a time. What I say is entirely random and garbage. To suggest someone hacked your phone to listen to your dreams requires extraordinary proof, and would also be far less effective than listening to your day while you’re actually awake. And even then, you need quite a high bar of proof. This is only been documented to occur for high value targets, so unless you’re one of them, I’d be far less concerned.
      - 5y ago

by yardie 5y ago

FabHK 5y ago

Maybe NSO didn't allow it to be used on US numbers. How are they supposed to know the nationality of the user of a phone? > NSO has always told its customers that US phone numbers are off-limits. In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.

perlgeek 5y ago
> How are they supposed to know the nationality of the user of a phone? That's why you do recon before targeting somebody. Do you suppose they just sprayed the malware onto random phones? I get the impression that Pegasus is meant to be used in a very targeted way, at people you have identified before, and have some reason to spy on. If you do that way, what are you chances of wanting to target somebody else, and accidentally getting 11 US embassy employees? NSO promised oversight, they can't just weasel they way out by saying "there's no way would could have implemented effective oversight".

pm90 5y ago

Yeah, it looks like they used a pretty basic whitelist: > In this case, all 11 targets were using Ugandan numbers, but had Apple logins using their state department emails, according to the two US officials.

hermes8329 5y ago

Is that sarcasm? The Israelis spying on the us is hardly anything new

yardie 5y ago
A bit of both. I assume they can spy on the US through 5-eyes, 9-eyes, 27eyes, etc. But to allow Uganda to do it was a bridge too far. If NSO had been in almost any other country there wouldn't be a building left standing. The US regards cyberattacks as an act of war.
- hulahoof 5y ago
  But Israel isn't a part of any of those agreements, it would be just as likely they spy on the US via a direct partnership with US agencies
- pc86 5y ago
  If the US really regarded cyberattacks as an act of war, it would be actively shooting missiles and bullets at China right now. The US regards cyberattacks as acts of war when convenient, nothing more.
  - lmm 5y ago
    "Act of war" is a legal and diplomatic nicety that, like essentially all international law, you talk about when it happens to align with your realpolitik. It doesn't mean you immediately launch the nukes whenever someone arrests one of your diplomats.
  - not2b 5y ago
    Nuclear powers can't make full-scale war on each other. If they ever do, the death toll would make WW2 look like a skirmish. So any attacks are at the edges (respond in kind, or proportionately, rather than escalate to a shooting war).
    - pc86 5y ago
      So the US regards cyberattacks as acts of war if it comes from a non-nuclear country, and tomfoolery from a nuclear one? I don't disagree with your point, simply saying that IMO the US doesn't take cyberattacks seriously precisely because it leads down a dark path with China (and probably Russia too if we're being honest).

vsareto 5y ago

Naturally, NSO will be blamed instead of the US govt for thinking that was actually possible. Especially after the shadow brokers leak.

matthewdgreen 5y ago
It is actually possible to not sell software that spies on US diplomats. Why, I achieve this goal every single day.
- trhway 5y ago
  >It is actually possible to not sell software that spies on US diplomats. Why, I achieve this goal every single day. it isn't that easy :) If you work on any major and/or popular software it is most probably used by State Dept (even if it is just an obscure part of some software stack that some State Dept LOB is using implicitly). Theoretically any software may have bugs/holes and thus be a part of such a spying.

shmatt 5y ago

US nationals have never been protected. If you make an international phone call the government can track it[1]. If its internal they can't without a warrant NSO built in a complete block of +1 phone numbers. But those US diplomats were not using +1. Which itself is a security issue that i'm sure is already being discussed at the state department [1]https://www.usatoday.com/story/news/2015/04/07/dea-bulk-telephone-surveillance-operation/70808616/ https://www.usatoday.com/story/news/2015/04/07/dea-bulk-tele...

wins32767 5y ago
Seems silly to call it a security issue when the bulk of the day to day activities for many state department employees is working closely with local nationals. Do you really want to make your average Ugandan caterer make an international call to the US in order to coordinate food delivery for an embassy event?
- kingcharles 5y ago
  And the fact that you're not likely to answer a call from an international number because it'll probably look more like spam. Also, for them to have a +1 number outside the USA means they have to be on a USA network and then roaming onto a local network. This presents dozens of problems, such as often not being able to get the best connection, not being able to get data connections, not being able to get any local support, and it costing a small fortune. All the embassy employees I have ever known have gone full native with all of their technology etc.
- hervature 5y ago
  Having a "caterer and friends" local dumbphone and an international phone for actual business doesn't seem unreasonable.
  - ufmace 5y ago
    Presumably, linked to what the sibling said, any actual business probably ought to go over high-security data connections anyways if it's going to go over any mobile network at all. No telling who's tapping into telecom systems in third-world countries, and normal phone calls probably go in the clear no matter what the registered phone number or roaming agreement is for the device.

Terry_Roll 5y ago

I think NSO are scapegoats, because how hard is it for a country to setup up a honeypot device to analyse NSO'a attack vectors and then copy it for their own use whilst being able to blame it on NSO? I say this because I've had stuff done to my phones in the past, one strange incident with a "hacked" phone was selecting an AirBnB, which I believe directed me to a few of their "safe" houses. Other examples, include batteries going flat over night when asleep despite phone being switched off, not charging but was fully charged before it was switched off. The phone signal is weak when that took place so it would have burned through the battery amplifying the signal, but listening in to people sleeping can elucidate what might be on their mind!

azinman2 5y ago
> but listening in to people sleeping can elucidate what might be on their mind! Once you go conspiracy there’s no end to what seems possible…
- Terry_Roll 5y ago
  Its not conspiracy, if you consume a few grams of lecithin before bed, your dreams will be based on what you saw just before bed. So if you can use a phone to make sounds or says things to someone in their sleep at pertinent moments, you could start having a conversation with them in their sleep or just trigger them to see what they say! You should try it, its fascinating!
  - azinman2 5y ago
    I’ve recorded my sleep many a time. What I say is entirely random and garbage. To suggest someone hacked your phone to listen to your dreams requires extraordinary proof, and would also be far less effective than listening to your day while you’re actually awake. And even then, you need quite a high bar of proof. This is only been documented to occur for high value targets, so unless you’re one of them, I’d be far less concerned.
    - 5y ago