19 ms·
Finnish diplomats’ phones infected with NSO Group Pegasus spyware
- kzrdude 5y agoI think it would be good hygiene to completely reset phones every year or half-year. Now, if it were common practice, I guess the exploits would get around that too (or they already do?)
- core-utility 5y agoI'm curious how many of the known exploits today would persist past a "restore from backup" via iCloud. To be truly successful, would you need to take no history from your pre-reset phone forward?
- tiku 5y agoHow does it get installed? I'm imagining some spy stealing the phone and installing it.
- dncornholio 5y agoCould be everything from clicking a malicious link, receiving a malicious message or a 0 click we don't know about yet.
- doikor 5y agoDepends on version of phone but usually either receiving some message (there has been some zero-click iMessage exploits) or clicking a link on one. for example https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/ https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...
- Tuna-Fish 5y agoNo, they use zero-day exploits in common media formats. The spy sends you a message containing an image or pdf, your device parses it, is exploited, and then removes the message, before there ever is a notification about it. You will never know that it ever happened. For example, see FORCEDENTRY, which is one of theirs, and the technical deep dive of it is about the most amazing piece of technical writing released last year: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1 https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- heavenlyblue 5y agoI can't believe that all text messages aren't stored somewhere on the NSA (or equiv.) server (so it should be easy to quickly find the zero-day after a single attack). They probably just aren't motivated enough to expose the zero-days associated with it.
- alufers 5y agoHow would you know how a message contains an exploit before you know such an exploit even exists? Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.
- dogma1138 5y agoiPhones still can send and receive an SMS, it’s also not particularly difficult to send an crafted iMessage, a lot of these exploits also chain multiple exploits so an RCE in a 3rd party messaging app with a sandbox/privesc on the local device. And even without that if you get an RCE within the context of a messaging app you might be able to get most of what you need since you probably would be able to read / write arbitrary memory within the context of that process and interact with which ever APIs the app has permissions for which for messaging almost always includes microphone and camera and often location too. The only thing you don’t get from running an exploit within the context of a single app is usually persistence but if your exploit can survive the app being suspended then as most people rarely reboot their phones you can get pretty long lived sessions too.
- solarkraft 5y agoWhy would the NSA be motivated to find these vulnerabilities? They already have access to Pegasus :-) ... you don't think they're interested in closing them, do you?
- nisegami 5y agoIsn't the NSO on an entity list now? That should mean that the NSA no longer has access to Pegasus.
- polack 5y agoContrary to popular belief, iPhones and Android phones have really poor security and new exploits are discovered all the time. So a properly formatted text message is all that's required these days. It's like in the dotcom days when 90% of the web was open to SQL injection.
- dandanua 5y agoMeanwhile, they take 30% cut from developers and force everyone to buy a new phone every year. Microsoft monopolization of Windows is a child play in comparison to this phone racket.
- sgjohnson 5y agoNobody is forcing anyone to buy a new phone every year. iPhone 5S, released more than 8 years ago, is still getting updates.
- christophilus 5y agoMy iPhone 7 is a handmedown that I got 3 years ago. I see no reason to upgrade until it A) dies or B) stops receiving security updates, at which point I’ll probably just get another handmedown from someone who likes new things more than I do.
- sgjohnson 5y agoIt’s not at all like in the dotcom days. Unlike SQL injections, these aren’t low skill attacks that can be mounted by skiddies.
- polack 5y agoYou are right in that these attacks takes more skills or a little bit of money, so in that regard it's not the same. But in multiple ways I think it's the same; like that it's obvious that security is still not a priority when building the software and that you as a user have to assume that the platforms are compromised.
- miohtama 5y agoC buffer or stack overflows are the most common exploit vector.
- londons_explore 5y agoI propose that any article like this don't refer to it as "NSO spyware", but instead refer to it as "Israeli spyware". The reality is that while NSO Group is a private company, it has deep links to the Israeli government and generally doesn't allow it's services to be used against the interests of the Israeli state. Hiding behind a corporate name to maintain Israel's reputation in international media isn't really okay.
- iqanq 5y ago
- squarefoot 5y agoPainting critics of the Israeli Government as anti semite is among the most used smearing tactics to damage their credibility. Therefore, by the same reasoning, you could be accused of acting as a shill for the Mossad.
- lgvln 5y agoVery interesting proposition. Israel, directly or indirectly, has a very significant influence in the US and I doubt this will ever happen. Edit: Typed “never“ instead of “ever”
- hericium 5y ago
- caaqil 5y agoRecent thread: https://news.ycombinator.com/item?id=30118276 https://news.ycombinator.com/item?id=30118276 (9 comments)
- supernova87a 5y agoAlthough I'm certainly no celebrity / important likely target of hackers, I'm interested in this just because recently I've gotten paranoid about my financial accounts (after a company I used to work for finally went public and I was fortunate to cash out an amount of $). When hackers use such exploits, do they then basically have something like remote control over your phone, and can start exfiltrating data / manipulating apps while you're not paying attention? Or what do they do with it then? Are you able to tell, by seeing your phone slow down or start to have unexplained screen behaviors? Suppose that I'm logged into my Google apps on my phone, does that mean they have access to all my gmail, google docs, etc. as well? Do these kinds of exploits also exist/get used to target people on their laptops and desktop machines as well? Or is that a little less likely, since your phone is specifically identified with you and people can easily go after your known phone number? I wonder if there is some resource where people can read about how to detect and avoid such exploits and protect against them?
- throw8932894 5y agoSomeone who has access to Pegasus is not going after finances. I had modest amount of ethereum on my PC, was hacked, but I still had control over my wallet. If you have $1M+ it should not be tied to your sim card, GMail account etc... If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups!
- markdown 5y ago> If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups! Using ones phone for banking, internet, and sms is completely normal. Saying that 99.9999999999999999% of the world population that owns smartphones is an idiot isn't helpful. The idiots are the governments of the world that haven't sanctioned Israel for allowing the continued trade of these cyberweapons by their citizens.
- arghwhat 5y ago
- qwerty456127 5y agoWhat about patching the vulnerabilities rather than running around with anger? We can sue the hell out of them and convince the Israeli government to ban them altogether but this is obviously doomed to repeat, somebody will inevitably take the place sooner or later, legally or illegally.
- HatchedLake721 5y agoIt’s already been patched long time ago. No one is running around with anger. This is unprecedented and new information is coming out that shows how influential people, opposition and politicians were targeted worldwide.
- qwerty456127 5y agoGood for us if it's so. I'm just concerned about the bugs existed for long enough for the exploit to be relevant and still haunting some diplomats' phones, despite so many publications. And many people discussing legal and political (doomed to be inefficient IMHO) rather than technical solutions.
- shadowfox 5y agoA lot of these issues will not be solvable technically, though. Given the way systems/software is built currently, vulnerabilities are going to exist and there are very highly paid and motivated people working on figuring out how to exploit them. It also does not help that mobile devices are in use for much longer than they receive security updates etc. I am not saying that these issues can/will be solved by legal and political means (especially given that it is not restricted to a single country), but it seems rather unlikely that these issues can be solved by pure technical means at the current point.
- boomboomsubban 5y agoThis revelation comes from a security investigation that the Finnish government started in autumn 2021. So when the exploit was discovered, they checked to see if they were hit and hopefully too actions to protect themselves if they were.
- octoberfranklin 5y agoWhen are governments going to finally realize that voice calls, text, and maybe plaintext email are enough for work phones? Is playing Candy Crush on your work phone really a mission-critical cyberpriority? All the high-security executive/legislative people (at least in the US) have two phones: the personal phone and the work phone. Whoever made the decision for the work phones to be "smart" needs to be fired. The old dumb Blackberries could easily be resurrected if a government-sized buyer committed to a purchase.
- starwind 5y agoBecause if I'm a high-ranking diplomat or military official, I may need to get plane tickets, book an Uber and hotel, set up a meeting on whatsapp, and read a news article at the drop of a hat
- solarkraft 5y agoIs there some overview about what phones governments use in high-securitiy contexts? It would be interesting to see what they consider secure, since that's probably informed by their own capabilities. Last time I checked Obama was using a BlackBerry.
- andylynch 5y agoI'm sure they want to be able to share pictures, video and use Powerpoint too... there is a published of commercial mobile devices certified for classified use at https://www.nsa.gov/Resources/Commercial-Solutions-for-Classified-Program/Components-List/#End%20User%20Device%20/%20Mobile%20Platfor https://www.nsa.gov/Resources/Commercial-Solutions-for-Class..., (looks like they mostly have Samsung Galaxies) .
- mathverse 5y agoNSO is just the one that sells a fully weaponized product but many companies out there are capable of selling you exploits with similar capabilities. Like Zerodium,Immunity Inc etc etc
- shmatt 5y agoso much this. the discussion around NSO (specifically in Israel this past week) has become so exhausting NSO marketing enjoy the fact they are shown as some super powered company who has been able and always will be able to get full control of every phone on earth. One dramatic news investigation showed exclusive video of NSO branded server racks[1] in an African country. Who cares about the servers? All pegasus needs is an internet connection, you could probably run it from a Chromebook As the NSO 0-day bank has changed over the years, so have their capabilities. The NSO of 3 years ago is not the same as today and is not the same as the 2023 version. These 0-days might be known at 100 other companies with less aggressive marketing arms [1] https://twitter.com/newsisrael13/status/1483887597025992716 https://twitter.com/newsisrael13/status/1483887597025992716
- mathverse 5y agoIsraelis are very good at marketing and creating this superficial,mystical,super power entity capable of anything. There are one person companies people have never heard of capable of doing the very same like NSO.
- complianceowl 5y agoThis is ridiculous. Hacking by these groups needs to Finnish.
- 3pt14159 5y agoThese articles are kinda pointless. Every diplomat knows the score right now. Every state worth talking about is in whatever phone they want to be in. This is why the Russian ambassador memorizes code words in order to communicate with Moscow. People have basically given up trying to keep vital secrets over a phone.