20 ms·

UK Government Officials Infected with Pegasus

691 points by yablak 4y ago

Someone1234 4y ago
I'm surprised this isn't a major diplomatic incident between the UK and Israel too, since the Israeli intelligence company was supposedly "closely monitoring how their customers were using the software" or akin to that. Like, yeah, blame the UAE mostly for this but let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. Western countries need to do better.
- ganoushoreilly 4y ago
  3rd and 4th party collection are a hell of a drug
- curiousgal 4y ago
  Why would that be surprising? I haven't heard about Yemen being outraged at France for selling weapons to the UAE for example. Western countries can't do better, it's how the world has and always will operate.
  - 12907835202 4y ago
    I've not heard about France but Yemen has definitely been outraged at Britain for selling weapons to Saudi Arabia...
    - haker9 4y ago
- eganist 4y ago
  Ironically, the fact that it's not playing out as a major dust-up in public will probably only further contribute to conspiratorial thinking in re: the Israeli gov't.
  - usrn 4y ago
    - inter_netuser 4y ago
      Numbers?
      - recuter 4y ago
        This is one of those Pepsi things, probably a bot..
      - girvo 4y ago
        Brand new account posting anti-Semitic conspiracy theory crap. I’d just flag it and move on
  - l33tbro 4y ago
    Israel seems to have a relative degree of immunity when it comes to subverting UK pol. Anyone ever see the investigative journalist piece of the Zionist group trying to subvert the UK Labour Party? They had a journalist go undercover for 6 months recording all kinds of things they weren't meant to: https://youtube.com/watch?v=ceCOhdgRBoc https://youtube.com/watch?v=ceCOhdgRBoc There was only minor fallout from this incident, and I imagine it will be the same here.
    - outoftheabyss 4y ago
      I watched the first 15 minutes of this and what shocked me is how unrevealing it was. If someone recorded me over the course of weeks or months, I would almost certainly say something that would land me in hot water in some sense. This piece of 'investigative journalism' I actually found embarrassing, all this editing to big it up as some major conspiracy when to me, in that 15 mins at least, was at worst run of the mill lobbying. Considering how unsavoury a character Corbyn was, I actually found the subjects incredibly restrained, perhaps part of the JD however.
- BitwiseFool 4y ago
  >"I'm surprised this isn't a major diplomatic incident between the UK and Israel too." I think Realpolitik is the reason why and that's all I'm going to say about that.
  - recuter 4y ago
    The realpolitik of it is that Johnson some weeks ago went to the Saudis hat in hand asking for oil after they've stopped responding to phone calls from POTUS. Last year: The Saudi crown prince, Mohammed bin Salman, warned Boris Johnson in a text message that UK-Saudi Arabian relations would be damaged if the British government failed to intervene to “correct” the Premier League’s “wrong” decision not to allow a £300m takeover of Newcastle United last year. The takeover of the club was of course completed shortly afterwards. As were the weapons sales. As for the NSO, it is rather likely that the UK government itself is a client. In fact taking all of that into account it isn't unlikely that the UK government is more than just a customer and was already aware of being "hacked". But that's all I'm going to say about that.
    - forum_ghost 4y ago
      odds are UK and UAE mutually hacked each other.
    - manquer 4y ago
      Some context/background to the deal the sale has been stalled for more than a year at that point , the league had decided arbitrarily to put a fitness check and delay(not reject) the deal. Roman, usmanov (minority holder ) and Abu Dhabi sovereign fund are current owners of major clubs before Saudi Arabia . The stalling and later approval has nothing to do with concerns of sportswashing (PL has sold out any morality they had long before then). The block and later approval was mostly because Qatar was pissed . Qatar owns PSG , hosting 2022 World Cup and most importantly owns lucrative PL broadcast rights in Middle East. beIN with Saudi government informal support has been streaming matches illegally. Complicating this Qatar for last 4/5 years has been pretty much isolated in Middle East and kicked out of many forums in unrelated diplomatic fights. In the end Saudi paid 1Billion pounds to Qatar to settle that dispute before Newcastle could be bought. Sovereign/government influence peddling and involving in sports clubs is nothing new. Real Madrid has benefited a lot over the years , west ham got a brand new stadium for nothing , even in the U.S. favorable policies , tax breaks are used heavily to attract sports teams at city /state level all the time. Democracy or dictators sports are cheap trick to improve ratings , it has been used at least since gladiators in Rome as a tool. My intention is not defend Saudi actions just that it is not surprising governments were involved. Disclaimer : I am a Newcastle fan
- baybal2 4y ago
- slickrick216 4y ago
  The UK sells weapons. Should they be blamed for anyone who is affected by them? Regardless of your own opinion they would argue no. So they can’t be hypocritical. UAE on the other hand is a decrepit money laundering people smuggling cesspit and should face the full brunt of Iran/Russia style sanctions.
  - axlee 4y ago
    I can guarantee you that if the UK was supplying weapons to a country that was using them against its own allies, there would be an incident, and at the very least they would stop supplying them. There is no hypcrisy - yet.
    - baybal2 4y ago
  - stefan_ 4y ago
    These trojans do not run without central C&C, already proven in the past to be run by NSO. Selling a weapon is not travelling into a war zone and firing it off on behalf of who hired you; that's what a mercenary does, under punishment of death.
  - Proudmuslim 4y ago
    The UK is where the world's dictators and corrupt politicians hide their money. Does that mean you think that the UK should "face the full brunt of Iran/Russia style sanctions"? Take your double standards elsewhere.
    - slickrick216 4y ago
      I agree. Not double standards.
- postingposts 4y ago
  - runnerup 4y ago
    > I really don’t feel that anyone is prepared to have a serious discussion regarding Israel, and I believe that’s mainly because… …Israel’s intelligence finds or creates blackmail on more than enough key politicians and their staff in the western countries.
    - postingposts 4y ago
      “Israel’s intelligence” is like a gang member calling themselves “lil NSA” or some shit. It’s the NSA and globalist interests within the US who don’t like the idea that nations are nations and they don’t control the Earth. It’s very insulting to people with compensate for a lack of personality or wit with egotism to be told you can’t just “do whatever” when you have a billion dollars. Again, I think no one is ready for a serious conversation about this. We don’t consider our rich mentally ill, and therefore there can be little else to be said or done.
      - recuter 4y ago
        Sounds like they are a very powerful force not only controlling your mentally ill rich but also living rent free in your head.
        postingposts 4y ago
        Could you explain what this comment means? It doesn’t make sense. ESL?
    - ben_w 4y ago
      I expect basically every intelligence agency to do that to everyone else. On the other hand, Johnson and many of his staff clearly can’t be blackmailed because he and many of them are totally shameless.
  - 4y ago
- jimbob45 4y ago
  >since the Israeli intelligence company was supposedly "closely monitoring how their customers were using the software" If the Israelis were going to veto a country's use of the software, it's reasonable to assume that the country was intelligent enough not to tell them what they were doing with it.
  - alasdair_ 4y ago
    The important thing to realize is that NSO doesn’t just hand over their attack tools completely. If they did, they would just get copied and they wouldn’t be able to charge for them. NSO maintains control and is semi-actively involved in the exploitation (NSO servers are used and they control this access). This is very different from selling someone a knife that is later used in a murder. There is a very good Darknet Diaries breakdown of what the NSO group can and cannot do - https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/ - and despite their claims otherwise, the evidence strongly points to them being complicit in attacks rather than just being a vendor.
- throwaway829 4y ago
  Expecting any honest reporting on Israel is naive. That hasn't happened for 70+ years.
  - deleted 4y ago
    [deleted]
- qiskit 4y ago
  > I'm surprised this isn't a major diplomatic incident between the UK and Israel too Are you really surprised? I'd be surprised if the UK and its media made a fuss about it. Certainly we won't be making a fuss about it here in the US that's for sure. I'd imagine russia and china wishes they had 1/10th the influence that israel has in the US/UK. Say what you want about israel, but for such a tiny country, it punches far above its weight.
  - coliveira 4y ago
    I don't know about Russia, but China doesn't let people from other nationalities to occupy positions of power especially in foreign policy, in which they're completely right. This is the main weakness of the USA and UK. They will let foreign born people to raise to power and dictate self servicing policies, many times in detriment to their own population. For example, take Henry Kissinger: a german born person, he spent his whole life influencing American policy to accommodate his views concerning Europe and the rest of the world. It is not a surprise that the Western world is in this situation.
    - petre 4y ago
      The UK is quite xenophobic as it is. No need for extra laws to prohibit foreigners to ascend to positions of power. Your peers will take care of that. I'm quite surprised that an UK born citizen of Pakistani heritage is currently the mayor of London. Maybe Labour is less xenophobic that the others.
      - petesergeant 4y ago
        > I'm quite surprised that an UK born citizen of Pakistani heritage is currently the mayor of London The only surprise here is that he's Labour, not Tory. Half of the current Great Offices of State are held by brown people under the Tories, who also had the first Jewish PM, the first (and second, and only) female PMs, and then there's Saj who's been Chancellor and Home Secretary, and I reckon is about as likely as Sunak to be the next PM. They appointed the first female, gay head of the Met Police, and the leader of the party in Scotland was also a gay woman for 8 very recent years. Some of these people are clearly the worst of British politics (hello Priti Patel!), but the Tories have an excellent record of putting people who aren't straight, white, Christian men into positions of power.
- ajsnigrutin 4y ago
  Politics... If russia did that, they would be treated a lot differently than israel or eg. USA.
  - KKKKkkkk1 4y ago
    > If russia did that, they would be treated a lot differently than israel or eg. USA. Russia poisoned multiple British nationals with chemical and radioactive weapons on British soil and got away with it scot-free. https://www.bbc.com/news/uk-51722301 https://www.bbc.com/news/uk-51722301
    - Synaesthesia 4y ago
      There are definitely some holes in the allegations. https://www.craigmurray.org.uk/archives/2021/04/pure-ten-points-i-just-cant-believe-about-the-official-skripal-narrative/ https://www.craigmurray.org.uk/archives/2021/04/pure-ten-poi...
      - bigDinosaur 4y ago
        Is there any particular reason this link is actually worth reading? Is 'Crag Murray' a former high-level politician/intelligence officer with useful information? Do they have a track record of finding genuine and severe issues with government narratives?
        mrmikardo 4y ago
        Craig is a former ambassador to Uzbekistan, who served in the Foreign Office for many years. He's since dedicated a lot of his time to following and reporting on the Assange case in the UK. He doesn't hide his opinions, some of which are quite strongly worded, but I don't think that makes him less worthwhile as an observer. I'd say he is less of a fact-finder/whistleblower and more of an analyser/commenter. I personally find his articles insightful and nuanced.
        4y ago
- Jenk 4y ago
  The current home secretary, Priti Patel, was forced to resign from her previous (lesser) role as Minister for International Development for secretly (and thus illegally) meeting with Israeli diplomats. https://www.bbc.co.uk/news/uk-politics-41923007 https://www.bbc.co.uk/news/uk-politics-41923007 It is completely unsurprising that there is little care shown by our government.
  - deleted 4y ago
    [deleted]
  - KarlKemp 4y ago
    Doesn't the fact that she had to resign point to the opposite conclusion, namely that these governments are distinct entities with sometimes conflicting interests?
    - strbean 4y ago
      She is now Home Secretary of the UK. She got fired upwards.
      - killingtime74 4y ago
        I too hope I will be fired some day (upwards)
      - BoxOfRain 4y ago
        The current Cabinet is suffering from a serious lack of talent in my opinion; several political purges related to Brexit has meant the only real qualifying characteristic for some of the highest offices in the land is being a yes-man for Johnson.
        oscargrouch 4y ago
        Now that you are saying this.. take a look everywhere, it's all like this.. every country turned into the worst versions of themselves, but even the worst of UK its kind of not bad in my opinion, compared to other countries. At least from an outside view, it's the UK now that is showing a good leadership in the current worldwide crises. While the US, France and Germany are completely lost, especially on how to deal with a "strong-man". (Meanwhile nobody remembers Cameron or that guy that was a pure puppet of the US in the forced Iraq war, and they were the posh gentleman everyone was expecting)
- sgjohnson 4y ago
  > let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. There will always be cyberweapon brokers. If not NSO, then someone else. And money talks. Why would there be any oversight? What you need is plausible deniability. I’d prefer if they started selling Pegasus to absolutely anyone at all. Like, online, for $999 a month or something. Maybe then there will be actual efforts to patch the vulnerabilities that are being exploited for it to work.
  - ehsankia 4y ago
    > If not NSO, then someone else. There's a big difference between an underground group doing it in semi-secrecy, vs a state-sponsored company doing it publicly. With said company somehow not being sued into the ground or said country's action not being taken as an act of war in situations like this. > I’d prefer if they started selling Pegasus to absolutely anyone at all The high value of what they offer comes from the scarcity, which result in lower likelihood of it being patched.
    - 0xedd 4y ago
      NSO isn't the equivalent of NSA. While NSA is part of the US government and actively spied on allied countries with no repercussions, NSO is a privately held company employing ex intelligence. With mandatory service at 18 and the private sector paying between 8 to 10 times more, it's common to find these intelligence boys leaving the service asap and working in different private companies. Implying Israel has anything to do with NSO or that the government is behind it, coupled with the amount of attention this gets relative to a company like Italian based Hacking Team (which both the FBI and Russian government made business with) is cause for concern. Is this hacker news or culturally biased vent club? I think the domain cyclonefront is nice for a new forum, don't you? You can be an admin there, grow a short mustache and do quarter jumping-jacks.
      - ehsankia 4y ago
        NSA doesn't sell Hacking as as Service to foreign countries. While NSO isn't part of the government, their work and existence is obviously very much endorsed and allowed by their government.
- deleted 4y ago
  [deleted]
- DSingularity 4y ago
  > Western countries need to do better Yeah, I agree. The western nations which built their lead through brutal colonialism and presently maintain that lead with neo-colonialism structures where brutal governments (Saudi Arabia, Israel, UAE) do the dirty work which they (western countries) ostensibly condemn. How about this: let’s have the western countries leave the world alone. Let’s have the western countries abandon their profit by misery business models (eg western arms industries which profiteer by instigating conflict and supplying aggressors).
  - InCityDreams 4y ago
    And affect my style of living? No thanks, I'll stayas i am and keep my blind eyes turning.
- KarlKemp 4y ago
  There are a few thousand kids (and their parents) in Yemen that became all-too-literal "end customers" for American exports of the non-cultural or Apple variety. It's fundamentally the same, except the impact was not metaphorical.
- markus_zhang 4y ago
  Maybe certain interest group within UK is working with certain interest group in Israel and "borrowed" Pegasus to use against other interest group(s). Actually Yes Minster joked about surveillance put on certain ministers. Can watch for fun. Sitcoms nowadays rarely talk about political issues.
- csmpltn 4y ago
  > "Like, yeah, blame the UAE mostly for this but let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. Western countries need to do better." The UK itself is one of the largest weapon exporters in the world, exporting to many countries in the Middle East with dubious human rights track records. The UK government can't possibly know what happens with every single pistol, bullet, missile or drone they sell (if they could, nobody would be buying): [1] https://commonslibrary.parliament.uk/research-briefings/cbp-8310/ https://commonslibrary.parliament.uk/research-briefings/cbp-... [2] https://en.wikipedia.org/wiki/UK_arms_export https://en.wikipedia.org/wiki/UK_arms_export A private Israeli company is exporting weapons to the same countries the UK does, and when those weapons get used inappropriately, you're then "surprised this isn't a major diplomatic incident between the UK and Israel". By the same account, are you suggesting that there should be a major diplomatic incident between every country in the world and the UK/USA every time they catch terrorists somewhere around the world using either UK/USA built-or-designed firearms? There wouldn't be any diplomatic relationships left then: [3] https://en.wikipedia.org/wiki/List_of_most-produced_firearms https://en.wikipedia.org/wiki/List_of_most-produced_firearms
  - CamelRocketFish 4y ago
    The difference is NSO control the Pegasus servers. They know who is using their tools and who is being targeted. This isn’t the same as untraced weapons.
    - csmpltn 4y ago
      I'm not challenging your assertion, I'm genuinely looking for backing evidence here. Do you have evidence that NSO knows who is being targeted by the tools they sell?
      - CamelRocketFish 4y ago
        Of course, the most digestible form of it is on this podcast: https://open.spotify.com/episode/38RuwrVwAHNXgHLDOANtmj https://open.spotify.com/episode/38RuwrVwAHNXgHLDOANtmj Sources are then linked on their site.
- raxxorraxor 4y ago
  Because western countries use the same services to spy on their citizens. Even if they feigned outrage, the potential blowback could topple some people. Besides, governments also tend not to want to be scrutinized on moral ground for trading war assets of any kind. Why should I be enraged if government officials were put under surveillance? They made abundantly clear that they are in favor of increased monitoring. Their secret surveillance programs were laid open. So how do you propose they should do better?
  - pooper 4y ago
    My outrage against dragnet was never about me, personally. I know I am way too unimportant to surveil. It has always been about the next thought leader, who could come from any background, from being nipped in the bud. I'm sure "they" would have loved being able to contain MLK Jr before he even had a chance to have any following » Why should I be enraged if government officials were put under surveillance? I am not worried about the officials themselves but the people who talk to them. Once again, the next thought leader, who could be but will never be because of the surveillance and subsequent actions.
    - raxxorraxor 4y ago
      They even tried it back in the day and with the modern surveillance we probably would not have heard from him at all. Just the right bribe to deflect the issues and it will never become a large issue in the first place. It doesn't even have to be malicious, there are people working in these agencies that are trained to follow orders. They believe intrinsically that what they do is necessary for security. No appeal will ever work, just a tight corset of regulation or protections by law that have actual teeth with heavy sanctions against misconduct. Today some agencies just blatantly disregard the most fundamental laws. If you scrap those you don't even need terrorists anymore, you did it all to yourself.
      - ClumsyPilot 4y ago
        'They believe intrinsically that what they do is necessary for security.' That's thr rub isn't it - if you startva security agency thst does terrible things, it will hire people that can somehow justify and rationalise those terrible things Very few people in KGB or whatever thought that they did anything wrong
- dreen 4y ago
  The whole thing is barely in the news
- simonh 4y ago
  There's nothing to be gained by wringing our hands and kicking up a public fuss, crying to the press about it. That's not how grownups do business. We all know everyone spies on everyone else, it's a given. I'm sure GCHQ spies on Israel and UAE. For all we know the security services already knew about this and were feeding false info to manipulate the UAE. Heck, the Israelis might have even tipped us off, I'm sure they value their relationship to us much more than with the UAE. I'd give it at least 50/50 Munk School trying to 'help' us just trashed a perfectly good MI6 counterintelligence op. That's the sort of way these things work.
  - ignoramous 4y ago
    Not saying you are wrong, but the kind of leaps in assumptions you make remind me of https://en.wikipedia.org/wiki/Cognitive_dissonance https://en.wikipedia.org/wiki/Cognitive_dissonance
    - simonh 4y ago
      I'm not making any assumptions, I'm saying we just don't know. Those like the poster I'm responding to suggesting this mean this or that for international relations, and we should be responding this way or that way are making assumptions. I'm pointing out those assumptions are unsupported and somewhat naive.
- FerretFred 4y ago
  > surprised this isn't a major diplomatic incident It all depends who the (UK) Government is "friends" with. Let's not forget the infamous Russian Novichok poisoning cases in Salisbury - those naughty Russians! The Saudis execute 81 citizens in a day, and Boris visits the day after to beg for oil and gas - those naughty Saudis! I'm not surprised it isn't a major diplomatic incident!
mrtksn 4y ago
I'm curious about the threat modelling of those high level officials. With all these hacking going on, if feels like it's not been a consideration. Pegasus claims iOS and Android hacking capabilities, one would expect more specialised communications being used at that level. Car companies provide specialised vehicles for governmental use, I would have expected to see specialised iOS or Android devices at least. Nothing completely out of this world but with special software configurations and features to detect and prevent attacks.
- dboreham 4y ago
  Perhaps they hacked honeypot devices and were thus fed disinformation. UKG has mounted such operations (some with high level of sophistication) since 1945 at least.
- xanthrax 4y ago
  I'm pretty sure its just accepted it is government by WhatsApp groups.
  - dillondoyle 4y ago
    ;) always a scandal. When Dems do it.. Politicians of both parties routinely use apps like wickr and signal. often illegally not following records keeping laws. I know obama had a special blackberry made so he could use email on mobile. I'd be surprised if the federal government hasn't created a mobile version of SIPRNet yet? I work in politics (low level compared to these elected s). most of the committees use signal + email 2fa or similar now. But that does nothing against sate sponsored hackers with 0 days. Maybe rotating burner phones and chat platforms would work better, but probably not worth it for the vast majority unless doing something sketchy.
- pomian 4y ago
  Time to revamp the black berry.
  - mardifoufs 4y ago
    The RCMP had access to all the encryption keys for the blackberry messaging back end :). They could basically access any message that was sent through RIM servers, and used that access pretty often (sometimes at the request of foreign governments).
nonrandomstring 4y ago
And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? We have a problem in democratic nations. I've written about it here [1]. Bruce Schneier has also addressed it in his own way. Our lack of any framework for civic cybersecurity is a disgrace. People in future ages will look back on our time as a wild-west. A solution can only come from a ground-up awareness through education. [1] http://www.icicte.org/assets/icicte2019_5.4_farnell.pdf http://www.icicte.org/assets/icicte2019_5.4_farnell.pdf
- jll29 4y ago
  > And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable.
  - wyldfire 4y ago
    Could these agencies enumerate some phone models / sw versions that are vulnerable to Pegasus and just blast email the govt folks "if you got one of these it's vulnerable, upgrade to new hardware or software { list of phones without known vulnerabilities here }"?
    - e12e 4y ago
      Well, what if the lists got leaked, and the secret services no longer can spy on the electorate with these tools? /s
  - nonrandomstring 4y ago
    > Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable. I hear you, but I would contest that they're not at liberty to ignore them. If pizza delivery drivers consent to obligations to carry issued and configured devices while on duty by what exceptionalism is Downing Street excused? Secondly, I'd say that they may make themselves unprotectable, but that is not where their duty of care ends. Boris Johnson is not only responsible for his own security, but that of a nation. Insofar as the spooks are responsible for Boris (god help them) their pants are round their ankles again.
tomatowurst 4y ago
The question is then what phone exists that is immune from this? A flip phone? A Nokia 1011? I might be completely misinformed but seems like SIM card and the underlying OS is vector. What happens if I use a cell phone from late 90s and early 2000s? What is there to hack with those flip phones? JavaME over the wire? What if the cell phone dates even further? Legitimately curious what options is there. Could If you are someone of interest then it seems like having a smartphone is an automatic liability. What then solution is possible since sending and reading a simple text message is enough to escalate privilege?
- usrn 4y ago
  I would be shocked if people couldn't find an RCE in an early 2000s flip phone. I had a friend who had hers since 2010 and MMS crashed it all the time.
  - b33f 4y ago
    If you're talking about flip phones and trying to protect against an eavesdropper of a phone call or SMS, then there's no point. The network that these phones used is full of holes already https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...
  - hsbauauvhabzb 4y ago
    Attack surface reduction is the important part. I’m not in disagreement with what you said, but if you took a modern iPhone and removed all capabilities other than sending and receiving phone calls, it would be much more secure than one which supports mms, email, browsing, etc.
    - kmeisthax 4y ago
      Are you sure having a phone in your phone is a good idea? Phone calls are a significant source of attacks now, even if none of those attacks exploit a vulnerability in the phone software. As far as I'm concerned, the only point in having a dial-able phone number is to ensure I'm still eligible for car warranty scams and 2FA code harvesting attacks.
etiam 4y ago
As appalling as this intrusion is, I can't help but feel there is some measure of propriety that it should be done to a nation taking advantage of its impressive technological legacy to eavesdrop on most transatlantic communications, and scheming and hacking to subvert the communication infrastructure of friendly countries. Not that "what goes around comes around" is going to fix anything in this regard...
yaa_minu 4y ago
This is a bit of a tangent but I think reports like these strengthen the argument against electronic voting. There's basically no way of building a secure electronic voting system that can beat the security and auditability properties of old school pen and paper voting.
- slim 4y ago
  these hacks can influence politicians after they've been voted in. If anything direct rigging of a vote is more transparent : people can notice if the vote goes against common sense.
- Spellman 4y ago
  Generally a lot of voting security experts advocate for paper ballots with electronic counting. It is very robust, efficient, has great fallback, and lots of systems available to keep secure.
  - Lukineus 4y ago
    The issue is verification - how do you verify the elctronic count was accurate? And if you're going to manually count it to verify the electronic count, then why have the electronic count in the first place?
    - germinalphrase 4y ago
      Because the results can be statistically verified with sampling rather than a full manual recount?
    - uoaei 4y ago
      A small, statistically representative sample of the paper ballots are counted by hand and compared against the electronic count. If discrepancy arises, a more thorough audit is performed.
      - bogomipz 4y ago
KMag 4y ago
Obviously this news is a bit embarrassing for both the UAE and the UK, but if the UK's response isn't to press the UAE for a reciprocal no-hacking treaty, then presumably the UK is trying to keep its options open. Unless I'm mistaken, the UK isn't surprised that it doesn't have any treaties with the UAE prohibiting this sort of thing... live by the hack, die by the hack.
- nickdothutton 4y ago
  UK has been through a period of getting very cosy with the Qataris, which began during the Cameron era and has since (I believe) cooled a bit.
drexlspivey 4y ago
Can’t phone vendors have people pose as a client to NSO to get access to the latest RCE and patch it?
- jonpalmisc 4y ago
  There are others who would know more about this than I do, but a few reasons come to mind: 1. NSO almost certainly has more than one exploit chain at a time. While this would burn one of their exploits, it wouldn’t put them out of business or eliminate the ability for them to get RCE on phones in general. 2. Vendors already have bug bounty programs with established award ceilings. These exploits are almost always far more valuable than the vendor is willing to pay via their bug bounty program. Why would the vendor pay more in this instance? 3. Given (1), how long would this go on for? NSO—who is aware of how many exploit chains they have—likely wouldn’t sell all of their exploits to a single buyer and risk them all getting burned. TL;DR: It wouldn’t be practical.
  - hsbauauvhabzb 4y ago
    Vendors may be more incentivised to intentionally kill the Pegasus business model, which would have immeasurable PR value if executed well.
    - alfalfasprout 4y ago
      Then another one pops up. Fact is, the market is there. It's not too dissimilar how after the silk road was taken down 10 others came up in its place. Markets for exploits are unfortunately here to stay.
      - hsbauauvhabzb 4y ago
        The models are different. Silk Road has millions of sellers and millions of buyers; Pegasus has a very small set of both, who would be more difficult to connect with. It probably won’t kill it, but will create a harder to leverage profit model
- 4y ago
stakkur 4y ago
So malware has finally crossed the electronic-human barrier. Wow.
dekhn 4y ago
History has shown that those willing to exploit the existing technologies weaknesses profit in wartime. Israel and the US are two great examples
sgjohnson 4y ago
I don’t feel sorry for them. They are hard at work building a surveillance state and (attempting to) ban end-to-end encryption. I actually see this as a good thing. Getting a taste of their own medicine.
deleted 4y ago
[deleted]
smashah 4y ago
UAE hacks UK give officials using Israeli cyberterrorism software and there are no consequences? I'm sure Abraham would be proud to have had his name attached to essentially a weapons contract masquerading as a peace deal between two evil governments.
gm3dmo 4y ago
Was it the phone provided and secured by the government or the off the books phone they have WhatsApp groups on? If it’s the first then security services have a problem. If it’s the second then those individuals have a problem.
- mcintyre1994 4y ago
  They do government business through those secret WhatsApp phones too. AFAIK the only government business we know about are the Covid contracts, but it could be anything. We know they have no kind of archival and have claimed phones are lost/replaced when they're required to provide messages, eg: https://www.theguardian.com/politics/2021/aug/04/covid-contracts-minister-lord-bethell-replaced-phone-before-it-could-be-searched https://www.theguardian.com/politics/2021/aug/04/covid-contr...
dirtylowprofile 4y ago
I wonder what about the third world countries with weak cyber policies.
karolsputo 4y ago
For anyone interested in the topic of Pegasus and NSO, there is a great New Yorker piece about them from yesterday. https://www.newyorker.com/magazine/2022/04/25/how-democracies-spy-on-their-citizens https://www.newyorker.com/magazine/2022/04/25/how-democracie...
LatteLazy 4y ago
Im a brit, Im not tech expert but I work adjacent to tech. I feel some what smug over this: * If you have nothing to hide, you have nothing to fear is official policy * We aggressively use "tools" like this both domestically and abroad, both for military/intel and for law enforcement with basically no oversight * Our government are basically technic-illiterate. And proud of that in many cases. So this is a train wreck of their own making. The only thing making me sad is that it will have zero effect.
Steele69 4y ago
[dead]
throwaway67743 4y ago
There is a point being totally missed in this thread and that is the UK government basically ignore all security common sense and do absolutely incomprehensible things like discuss national security over WhatsApp and Zoom, as a British citizen, in my eyes this absolutely amounts to treason as they're knowingly potentially giving away state secrets, anyone else would be instantly jailed. UK government and any departments discussing sensitive matters (or everyone, really) should not be using a) off the shelf phones, and b) should not be using public communications networks full stop, nevermind foreign communication platforms.
- A4ET8a8uTh0 4y ago
  I used to think that is an issue with old non-technical generation and therefore it is argument for new blood. But.. new blood is about as careless about sharing all sorts of information online as old blood. I don't know if there is a solution to this. I am starting to wonder if it is one of those 'best not to think about it' things.
  - deleted 4y ago
    [deleted]
  - tomxor 4y ago
    It's the same problem as the lack of widespread technical comprehension in the general public. New blood politicians may know more about tech, phones and services from a _user_ perspective, but most of them are still politicians, not engineers - and just like the vast majority of the general public, will mostly not appreciate the implications of any details bellow the surface of modern technology. What we think of as common sense are based on principles in this domain that is invisible to most people. There is no simple solution to this. For government specifically, perhaps a new specialised division that dictates policy for technology use throughout the government (I say new because I would not be surprised if some antiquated and dysfunctional version of this already exists).
    - throwaway67743 4y ago
danielktdoranie 4y ago
The patch for Pegasus has been out since September 2021.
wly_cdgr 4y ago
No wonder Boris can't stop horsing around
Proven 4y ago

691 points by yablak 4y ago

I'm surprised this isn't a major diplomatic incident between the UK and Israel too, since the Israeli intelligence company was supposedly "closely monitoring how their customers were using the software" or akin to that. Like, yeah, blame the UAE mostly for this but let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. Western countries need to do better.

ganoushoreilly 4y ago
3rd and 4th party collection are a hell of a drug
curiousgal 4y ago
Why would that be surprising? I haven't heard about Yemen being outraged at France for selling weapons to the UAE for example. Western countries can't do better, it's how the world has and always will operate.
- 12907835202 4y ago
  I've not heard about France but Yemen has definitely been outraged at Britain for selling weapons to Saudi Arabia...
  - haker9 4y ago
eganist 4y ago
Ironically, the fact that it's not playing out as a major dust-up in public will probably only further contribute to conspiratorial thinking in re: the Israeli gov't.
- usrn 4y ago
  - inter_netuser 4y ago
    Numbers?
    - recuter 4y ago
      This is one of those Pepsi things, probably a bot..
    - girvo 4y ago
      Brand new account posting anti-Semitic conspiracy theory crap. I’d just flag it and move on
- l33tbro 4y ago
  Israel seems to have a relative degree of immunity when it comes to subverting UK pol. Anyone ever see the investigative journalist piece of the Zionist group trying to subvert the UK Labour Party? They had a journalist go undercover for 6 months recording all kinds of things they weren't meant to: https://youtube.com/watch?v=ceCOhdgRBoc https://youtube.com/watch?v=ceCOhdgRBoc There was only minor fallout from this incident, and I imagine it will be the same here.
  - outoftheabyss 4y ago
    I watched the first 15 minutes of this and what shocked me is how unrevealing it was. If someone recorded me over the course of weeks or months, I would almost certainly say something that would land me in hot water in some sense. This piece of 'investigative journalism' I actually found embarrassing, all this editing to big it up as some major conspiracy when to me, in that 15 mins at least, was at worst run of the mill lobbying. Considering how unsavoury a character Corbyn was, I actually found the subjects incredibly restrained, perhaps part of the JD however.
BitwiseFool 4y ago
>"I'm surprised this isn't a major diplomatic incident between the UK and Israel too." I think Realpolitik is the reason why and that's all I'm going to say about that.
- recuter 4y ago
  The realpolitik of it is that Johnson some weeks ago went to the Saudis hat in hand asking for oil after they've stopped responding to phone calls from POTUS. Last year: The Saudi crown prince, Mohammed bin Salman, warned Boris Johnson in a text message that UK-Saudi Arabian relations would be damaged if the British government failed to intervene to “correct” the Premier League’s “wrong” decision not to allow a £300m takeover of Newcastle United last year. The takeover of the club was of course completed shortly afterwards. As were the weapons sales. As for the NSO, it is rather likely that the UK government itself is a client. In fact taking all of that into account it isn't unlikely that the UK government is more than just a customer and was already aware of being "hacked". But that's all I'm going to say about that.
  - forum_ghost 4y ago
    odds are UK and UAE mutually hacked each other.
  - manquer 4y ago
    Some context/background to the deal the sale has been stalled for more than a year at that point , the league had decided arbitrarily to put a fitness check and delay(not reject) the deal. Roman, usmanov (minority holder ) and Abu Dhabi sovereign fund are current owners of major clubs before Saudi Arabia . The stalling and later approval has nothing to do with concerns of sportswashing (PL has sold out any morality they had long before then). The block and later approval was mostly because Qatar was pissed . Qatar owns PSG , hosting 2022 World Cup and most importantly owns lucrative PL broadcast rights in Middle East. beIN with Saudi government informal support has been streaming matches illegally. Complicating this Qatar for last 4/5 years has been pretty much isolated in Middle East and kicked out of many forums in unrelated diplomatic fights. In the end Saudi paid 1Billion pounds to Qatar to settle that dispute before Newcastle could be bought. Sovereign/government influence peddling and involving in sports clubs is nothing new. Real Madrid has benefited a lot over the years , west ham got a brand new stadium for nothing , even in the U.S. favorable policies , tax breaks are used heavily to attract sports teams at city /state level all the time. Democracy or dictators sports are cheap trick to improve ratings , it has been used at least since gladiators in Rome as a tool. My intention is not defend Saudi actions just that it is not surprising governments were involved. Disclaimer : I am a Newcastle fan
baybal2 4y ago
slickrick216 4y ago
The UK sells weapons. Should they be blamed for anyone who is affected by them? Regardless of your own opinion they would argue no. So they can’t be hypocritical. UAE on the other hand is a decrepit money laundering people smuggling cesspit and should face the full brunt of Iran/Russia style sanctions.
- axlee 4y ago
  I can guarantee you that if the UK was supplying weapons to a country that was using them against its own allies, there would be an incident, and at the very least they would stop supplying them. There is no hypcrisy - yet.
  - baybal2 4y ago
- stefan_ 4y ago
  These trojans do not run without central C&C, already proven in the past to be run by NSO. Selling a weapon is not travelling into a war zone and firing it off on behalf of who hired you; that's what a mercenary does, under punishment of death.
- Proudmuslim 4y ago
  The UK is where the world's dictators and corrupt politicians hide their money. Does that mean you think that the UK should "face the full brunt of Iran/Russia style sanctions"? Take your double standards elsewhere.
  - slickrick216 4y ago
    I agree. Not double standards.
postingposts 4y ago
- runnerup 4y ago
  > I really don’t feel that anyone is prepared to have a serious discussion regarding Israel, and I believe that’s mainly because… …Israel’s intelligence finds or creates blackmail on more than enough key politicians and their staff in the western countries.
  - postingposts 4y ago
    “Israel’s intelligence” is like a gang member calling themselves “lil NSA” or some shit. It’s the NSA and globalist interests within the US who don’t like the idea that nations are nations and they don’t control the Earth. It’s very insulting to people with compensate for a lack of personality or wit with egotism to be told you can’t just “do whatever” when you have a billion dollars. Again, I think no one is ready for a serious conversation about this. We don’t consider our rich mentally ill, and therefore there can be little else to be said or done.
    - recuter 4y ago
      Sounds like they are a very powerful force not only controlling your mentally ill rich but also living rent free in your head.
      - postingposts 4y ago
        Could you explain what this comment means? It doesn’t make sense. ESL?
  - ben_w 4y ago
    I expect basically every intelligence agency to do that to everyone else. On the other hand, Johnson and many of his staff clearly can’t be blackmailed because he and many of them are totally shameless.
- 4y ago
jimbob45 4y ago
>since the Israeli intelligence company was supposedly "closely monitoring how their customers were using the software" If the Israelis were going to veto a country's use of the software, it's reasonable to assume that the country was intelligent enough not to tell them what they were doing with it.
- alasdair_ 4y ago
  The important thing to realize is that NSO doesn’t just hand over their attack tools completely. If they did, they would just get copied and they wouldn’t be able to charge for them. NSO maintains control and is semi-actively involved in the exploitation (NSO servers are used and they control this access). This is very different from selling someone a knife that is later used in a murder. There is a very good Darknet Diaries breakdown of what the NSO group can and cannot do - https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/ - and despite their claims otherwise, the evidence strongly points to them being complicit in attacks rather than just being a vendor.
throwaway829 4y ago
Expecting any honest reporting on Israel is naive. That hasn't happened for 70+ years.
- deleted 4y ago
  [deleted]
qiskit 4y ago
> I'm surprised this isn't a major diplomatic incident between the UK and Israel too Are you really surprised? I'd be surprised if the UK and its media made a fuss about it. Certainly we won't be making a fuss about it here in the US that's for sure. I'd imagine russia and china wishes they had 1/10th the influence that israel has in the US/UK. Say what you want about israel, but for such a tiny country, it punches far above its weight.
- coliveira 4y ago
  I don't know about Russia, but China doesn't let people from other nationalities to occupy positions of power especially in foreign policy, in which they're completely right. This is the main weakness of the USA and UK. They will let foreign born people to raise to power and dictate self servicing policies, many times in detriment to their own population. For example, take Henry Kissinger: a german born person, he spent his whole life influencing American policy to accommodate his views concerning Europe and the rest of the world. It is not a surprise that the Western world is in this situation.
  - petre 4y ago
    The UK is quite xenophobic as it is. No need for extra laws to prohibit foreigners to ascend to positions of power. Your peers will take care of that. I'm quite surprised that an UK born citizen of Pakistani heritage is currently the mayor of London. Maybe Labour is less xenophobic that the others.
    - petesergeant 4y ago
      > I'm quite surprised that an UK born citizen of Pakistani heritage is currently the mayor of London The only surprise here is that he's Labour, not Tory. Half of the current Great Offices of State are held by brown people under the Tories, who also had the first Jewish PM, the first (and second, and only) female PMs, and then there's Saj who's been Chancellor and Home Secretary, and I reckon is about as likely as Sunak to be the next PM. They appointed the first female, gay head of the Met Police, and the leader of the party in Scotland was also a gay woman for 8 very recent years. Some of these people are clearly the worst of British politics (hello Priti Patel!), but the Tories have an excellent record of putting people who aren't straight, white, Christian men into positions of power.
ajsnigrutin 4y ago
Politics... If russia did that, they would be treated a lot differently than israel or eg. USA.
- KKKKkkkk1 4y ago
  > If russia did that, they would be treated a lot differently than israel or eg. USA. Russia poisoned multiple British nationals with chemical and radioactive weapons on British soil and got away with it scot-free. https://www.bbc.com/news/uk-51722301 https://www.bbc.com/news/uk-51722301
  - Synaesthesia 4y ago
    There are definitely some holes in the allegations. https://www.craigmurray.org.uk/archives/2021/04/pure-ten-points-i-just-cant-believe-about-the-official-skripal-narrative/ https://www.craigmurray.org.uk/archives/2021/04/pure-ten-poi...
    - bigDinosaur 4y ago
      Is there any particular reason this link is actually worth reading? Is 'Crag Murray' a former high-level politician/intelligence officer with useful information? Do they have a track record of finding genuine and severe issues with government narratives?
      - mrmikardo 4y ago
        Craig is a former ambassador to Uzbekistan, who served in the Foreign Office for many years. He's since dedicated a lot of his time to following and reporting on the Assange case in the UK. He doesn't hide his opinions, some of which are quite strongly worded, but I don't think that makes him less worthwhile as an observer. I'd say he is less of a fact-finder/whistleblower and more of an analyser/commenter. I personally find his articles insightful and nuanced.
        4y ago
Jenk 4y ago
The current home secretary, Priti Patel, was forced to resign from her previous (lesser) role as Minister for International Development for secretly (and thus illegally) meeting with Israeli diplomats. https://www.bbc.co.uk/news/uk-politics-41923007 https://www.bbc.co.uk/news/uk-politics-41923007 It is completely unsurprising that there is little care shown by our government.
- deleted 4y ago
  [deleted]
- KarlKemp 4y ago
  Doesn't the fact that she had to resign point to the opposite conclusion, namely that these governments are distinct entities with sometimes conflicting interests?
  - strbean 4y ago
    She is now Home Secretary of the UK. She got fired upwards.
    - killingtime74 4y ago
      I too hope I will be fired some day (upwards)
    - BoxOfRain 4y ago
      The current Cabinet is suffering from a serious lack of talent in my opinion; several political purges related to Brexit has meant the only real qualifying characteristic for some of the highest offices in the land is being a yes-man for Johnson.
      - oscargrouch 4y ago
        Now that you are saying this.. take a look everywhere, it's all like this.. every country turned into the worst versions of themselves, but even the worst of UK its kind of not bad in my opinion, compared to other countries. At least from an outside view, it's the UK now that is showing a good leadership in the current worldwide crises. While the US, France and Germany are completely lost, especially on how to deal with a "strong-man". (Meanwhile nobody remembers Cameron or that guy that was a pure puppet of the US in the forced Iraq war, and they were the posh gentleman everyone was expecting)
sgjohnson 4y ago
> let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. There will always be cyberweapon brokers. If not NSO, then someone else. And money talks. Why would there be any oversight? What you need is plausible deniability. I’d prefer if they started selling Pegasus to absolutely anyone at all. Like, online, for $999 a month or something. Maybe then there will be actual efforts to patch the vulnerabilities that are being exploited for it to work.
- ehsankia 4y ago
  > If not NSO, then someone else. There's a big difference between an underground group doing it in semi-secrecy, vs a state-sponsored company doing it publicly. With said company somehow not being sued into the ground or said country's action not being taken as an act of war in situations like this. > I’d prefer if they started selling Pegasus to absolutely anyone at all The high value of what they offer comes from the scarcity, which result in lower likelihood of it being patched.
  - 0xedd 4y ago
    NSO isn't the equivalent of NSA. While NSA is part of the US government and actively spied on allied countries with no repercussions, NSO is a privately held company employing ex intelligence. With mandatory service at 18 and the private sector paying between 8 to 10 times more, it's common to find these intelligence boys leaving the service asap and working in different private companies. Implying Israel has anything to do with NSO or that the government is behind it, coupled with the amount of attention this gets relative to a company like Italian based Hacking Team (which both the FBI and Russian government made business with) is cause for concern. Is this hacker news or culturally biased vent club? I think the domain cyclonefront is nice for a new forum, don't you? You can be an admin there, grow a short mustache and do quarter jumping-jacks.
    - ehsankia 4y ago
      NSA doesn't sell Hacking as as Service to foreign countries. While NSO isn't part of the government, their work and existence is obviously very much endorsed and allowed by their government.
deleted 4y ago
[deleted]
DSingularity 4y ago
> Western countries need to do better Yeah, I agree. The western nations which built their lead through brutal colonialism and presently maintain that lead with neo-colonialism structures where brutal governments (Saudi Arabia, Israel, UAE) do the dirty work which they (western countries) ostensibly condemn. How about this: let’s have the western countries leave the world alone. Let’s have the western countries abandon their profit by misery business models (eg western arms industries which profiteer by instigating conflict and supplying aggressors).
- InCityDreams 4y ago
  And affect my style of living? No thanks, I'll stayas i am and keep my blind eyes turning.
KarlKemp 4y ago
There are a few thousand kids (and their parents) in Yemen that became all-too-literal "end customers" for American exports of the non-cultural or Apple variety. It's fundamentally the same, except the impact was not metaphorical.
markus_zhang 4y ago
Maybe certain interest group within UK is working with certain interest group in Israel and "borrowed" Pegasus to use against other interest group(s). Actually Yes Minster joked about surveillance put on certain ministers. Can watch for fun. Sitcoms nowadays rarely talk about political issues.
csmpltn 4y ago
> "Like, yeah, blame the UAE mostly for this but let's also have a discussion about why this was sold to anyone who would pay with no oversight at all. Western countries need to do better." The UK itself is one of the largest weapon exporters in the world, exporting to many countries in the Middle East with dubious human rights track records. The UK government can't possibly know what happens with every single pistol, bullet, missile or drone they sell (if they could, nobody would be buying): [1] https://commonslibrary.parliament.uk/research-briefings/cbp-8310/ https://commonslibrary.parliament.uk/research-briefings/cbp-... [2] https://en.wikipedia.org/wiki/UK_arms_export https://en.wikipedia.org/wiki/UK_arms_export A private Israeli company is exporting weapons to the same countries the UK does, and when those weapons get used inappropriately, you're then "surprised this isn't a major diplomatic incident between the UK and Israel". By the same account, are you suggesting that there should be a major diplomatic incident between every country in the world and the UK/USA every time they catch terrorists somewhere around the world using either UK/USA built-or-designed firearms? There wouldn't be any diplomatic relationships left then: [3] https://en.wikipedia.org/wiki/List_of_most-produced_firearms https://en.wikipedia.org/wiki/List_of_most-produced_firearms
- CamelRocketFish 4y ago
  The difference is NSO control the Pegasus servers. They know who is using their tools and who is being targeted. This isn’t the same as untraced weapons.
  - csmpltn 4y ago
    I'm not challenging your assertion, I'm genuinely looking for backing evidence here. Do you have evidence that NSO knows who is being targeted by the tools they sell?
    - CamelRocketFish 4y ago
      Of course, the most digestible form of it is on this podcast: https://open.spotify.com/episode/38RuwrVwAHNXgHLDOANtmj https://open.spotify.com/episode/38RuwrVwAHNXgHLDOANtmj Sources are then linked on their site.
raxxorraxor 4y ago
Because western countries use the same services to spy on their citizens. Even if they feigned outrage, the potential blowback could topple some people. Besides, governments also tend not to want to be scrutinized on moral ground for trading war assets of any kind. Why should I be enraged if government officials were put under surveillance? They made abundantly clear that they are in favor of increased monitoring. Their secret surveillance programs were laid open. So how do you propose they should do better?
- pooper 4y ago
  My outrage against dragnet was never about me, personally. I know I am way too unimportant to surveil. It has always been about the next thought leader, who could come from any background, from being nipped in the bud. I'm sure "they" would have loved being able to contain MLK Jr before he even had a chance to have any following » Why should I be enraged if government officials were put under surveillance? I am not worried about the officials themselves but the people who talk to them. Once again, the next thought leader, who could be but will never be because of the surveillance and subsequent actions.
  - raxxorraxor 4y ago
    They even tried it back in the day and with the modern surveillance we probably would not have heard from him at all. Just the right bribe to deflect the issues and it will never become a large issue in the first place. It doesn't even have to be malicious, there are people working in these agencies that are trained to follow orders. They believe intrinsically that what they do is necessary for security. No appeal will ever work, just a tight corset of regulation or protections by law that have actual teeth with heavy sanctions against misconduct. Today some agencies just blatantly disregard the most fundamental laws. If you scrap those you don't even need terrorists anymore, you did it all to yourself.
    - ClumsyPilot 4y ago
      'They believe intrinsically that what they do is necessary for security.' That's thr rub isn't it - if you startva security agency thst does terrible things, it will hire people that can somehow justify and rationalise those terrible things Very few people in KGB or whatever thought that they did anything wrong
dreen 4y ago
The whole thing is barely in the news
simonh 4y ago
There's nothing to be gained by wringing our hands and kicking up a public fuss, crying to the press about it. That's not how grownups do business. We all know everyone spies on everyone else, it's a given. I'm sure GCHQ spies on Israel and UAE. For all we know the security services already knew about this and were feeding false info to manipulate the UAE. Heck, the Israelis might have even tipped us off, I'm sure they value their relationship to us much more than with the UAE. I'd give it at least 50/50 Munk School trying to 'help' us just trashed a perfectly good MI6 counterintelligence op. That's the sort of way these things work.
- ignoramous 4y ago
  Not saying you are wrong, but the kind of leaps in assumptions you make remind me of https://en.wikipedia.org/wiki/Cognitive_dissonance https://en.wikipedia.org/wiki/Cognitive_dissonance
  - simonh 4y ago
    I'm not making any assumptions, I'm saying we just don't know. Those like the poster I'm responding to suggesting this mean this or that for international relations, and we should be responding this way or that way are making assumptions. I'm pointing out those assumptions are unsupported and somewhat naive.
FerretFred 4y ago
> surprised this isn't a major diplomatic incident It all depends who the (UK) Government is "friends" with. Let's not forget the infamous Russian Novichok poisoning cases in Salisbury - those naughty Russians! The Saudis execute 81 citizens in a day, and Boris visits the day after to beg for oil and gas - those naughty Saudis! I'm not surprised it isn't a major diplomatic incident!

mrtksn 4y ago

I'm curious about the threat modelling of those high level officials. With all these hacking going on, if feels like it's not been a consideration. Pegasus claims iOS and Android hacking capabilities, one would expect more specialised communications being used at that level. Car companies provide specialised vehicles for governmental use, I would have expected to see specialised iOS or Android devices at least. Nothing completely out of this world but with special software configurations and features to detect and prevent attacks.

dboreham 4y ago
Perhaps they hacked honeypot devices and were thus fed disinformation. UKG has mounted such operations (some with high level of sophistication) since 1945 at least.
xanthrax 4y ago
I'm pretty sure its just accepted it is government by WhatsApp groups.
- dillondoyle 4y ago
  ;) always a scandal. When Dems do it.. Politicians of both parties routinely use apps like wickr and signal. often illegally not following records keeping laws. I know obama had a special blackberry made so he could use email on mobile. I'd be surprised if the federal government hasn't created a mobile version of SIPRNet yet? I work in politics (low level compared to these elected s). most of the committees use signal + email 2fa or similar now. But that does nothing against sate sponsored hackers with 0 days. Maybe rotating burner phones and chat platforms would work better, but probably not worth it for the vast majority unless doing something sketchy.
pomian 4y ago
Time to revamp the black berry.
- mardifoufs 4y ago
  The RCMP had access to all the encryption keys for the blackberry messaging back end :). They could basically access any message that was sent through RIM servers, and used that access pretty often (sometimes at the request of foreign governments).

nonrandomstring 4y ago

And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? We have a problem in democratic nations. I've written about it here [1]. Bruce Schneier has also addressed it in his own way. Our lack of any framework for civic cybersecurity is a disgrace. People in future ages will look back on our time as a wild-west. A solution can only come from a ground-up awareness through education. [1] http://www.icicte.org/assets/icicte2019_5.4_farnell.pdf http://www.icicte.org/assets/icicte2019_5.4_farnell.pdf

jll29 4y ago
> And what were GCHQ, MI6 and NCSC doing to protect our prime-minister at this time? Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable.
- wyldfire 4y ago
  Could these agencies enumerate some phone models / sw versions that are vulnerable to Pegasus and just blast email the govt folks "if you got one of these it's vulnerable, upgrade to new hardware or software { list of phones without known vulnerabilities here }"?
  - e12e 4y ago
    Well, what if the lists got leaked, and the secret services no longer can spy on the electorate with these tools? /s
- nonrandomstring 4y ago
  > Nobody is perfect - but there are people who blatantly ignore ITSEC best practices and are therefore almost unprotectable. I hear you, but I would contest that they're not at liberty to ignore them. If pizza delivery drivers consent to obligations to carry issued and configured devices while on duty by what exceptionalism is Downing Street excused? Secondly, I'd say that they may make themselves unprotectable, but that is not where their duty of care ends. Boris Johnson is not only responsible for his own security, but that of a nation. Insofar as the spooks are responsible for Boris (god help them) their pants are round their ankles again.

tomatowurst 4y ago

The question is then what phone exists that is immune from this? A flip phone? A Nokia 1011? I might be completely misinformed but seems like SIM card and the underlying OS is vector. What happens if I use a cell phone from late 90s and early 2000s? What is there to hack with those flip phones? JavaME over the wire? What if the cell phone dates even further? Legitimately curious what options is there. Could If you are someone of interest then it seems like having a smartphone is an automatic liability. What then solution is possible since sending and reading a simple text message is enough to escalate privilege?

usrn 4y ago
I would be shocked if people couldn't find an RCE in an early 2000s flip phone. I had a friend who had hers since 2010 and MMS crashed it all the time.
- b33f 4y ago
  If you're talking about flip phones and trying to protect against an eavesdropper of a phone call or SMS, then there's no point. The network that these phones used is full of holes already https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...
- hsbauauvhabzb 4y ago
  Attack surface reduction is the important part. I’m not in disagreement with what you said, but if you took a modern iPhone and removed all capabilities other than sending and receiving phone calls, it would be much more secure than one which supports mms, email, browsing, etc.
  - kmeisthax 4y ago
    Are you sure having a phone in your phone is a good idea? Phone calls are a significant source of attacks now, even if none of those attacks exploit a vulnerability in the phone software. As far as I'm concerned, the only point in having a dial-able phone number is to ensure I'm still eligible for car warranty scams and 2FA code harvesting attacks.

etiam 4y ago

As appalling as this intrusion is, I can't help but feel there is some measure of propriety that it should be done to a nation taking advantage of its impressive technological legacy to eavesdrop on most transatlantic communications, and scheming and hacking to subvert the communication infrastructure of friendly countries. Not that "what goes around comes around" is going to fix anything in this regard...

yaa_minu 4y ago

This is a bit of a tangent but I think reports like these strengthen the argument against electronic voting. There's basically no way of building a secure electronic voting system that can beat the security and auditability properties of old school pen and paper voting.

slim 4y ago
these hacks can influence politicians after they've been voted in. If anything direct rigging of a vote is more transparent : people can notice if the vote goes against common sense.
Spellman 4y ago
Generally a lot of voting security experts advocate for paper ballots with electronic counting. It is very robust, efficient, has great fallback, and lots of systems available to keep secure.
- Lukineus 4y ago
  The issue is verification - how do you verify the elctronic count was accurate? And if you're going to manually count it to verify the electronic count, then why have the electronic count in the first place?
  - germinalphrase 4y ago
    Because the results can be statistically verified with sampling rather than a full manual recount?
  - uoaei 4y ago
    A small, statistically representative sample of the paper ballots are counted by hand and compared against the electronic count. If discrepancy arises, a more thorough audit is performed.
    - bogomipz 4y ago

KMag 4y ago

Obviously this news is a bit embarrassing for both the UAE and the UK, but if the UK's response isn't to press the UAE for a reciprocal no-hacking treaty, then presumably the UK is trying to keep its options open. Unless I'm mistaken, the UK isn't surprised that it doesn't have any treaties with the UAE prohibiting this sort of thing... live by the hack, die by the hack.

nickdothutton 4y ago
UK has been through a period of getting very cosy with the Qataris, which began during the Cameron era and has since (I believe) cooled a bit.

drexlspivey 4y ago

Can’t phone vendors have people pose as a client to NSO to get access to the latest RCE and patch it?

jonpalmisc 4y ago
There are others who would know more about this than I do, but a few reasons come to mind: 1. NSO almost certainly has more than one exploit chain at a time. While this would burn one of their exploits, it wouldn’t put them out of business or eliminate the ability for them to get RCE on phones in general. 2. Vendors already have bug bounty programs with established award ceilings. These exploits are almost always far more valuable than the vendor is willing to pay via their bug bounty program. Why would the vendor pay more in this instance? 3. Given (1), how long would this go on for? NSO—who is aware of how many exploit chains they have—likely wouldn’t sell all of their exploits to a single buyer and risk them all getting burned. TL;DR: It wouldn’t be practical.
- hsbauauvhabzb 4y ago
  Vendors may be more incentivised to intentionally kill the Pegasus business model, which would have immeasurable PR value if executed well.
  - alfalfasprout 4y ago
    Then another one pops up. Fact is, the market is there. It's not too dissimilar how after the silk road was taken down 10 others came up in its place. Markets for exploits are unfortunately here to stay.
    - hsbauauvhabzb 4y ago
      The models are different. Silk Road has millions of sellers and millions of buyers; Pegasus has a very small set of both, who would be more difficult to connect with. It probably won’t kill it, but will create a harder to leverage profit model
4y ago

stakkur 4y ago

So malware has finally crossed the electronic-human barrier. Wow.

dekhn 4y ago

History has shown that those willing to exploit the existing technologies weaknesses profit in wartime. Israel and the US are two great examples

sgjohnson 4y ago

I don’t feel sorry for them. They are hard at work building a surveillance state and (attempting to) ban end-to-end encryption. I actually see this as a good thing. Getting a taste of their own medicine.

deleted 4y ago

[deleted]

smashah 4y ago

UAE hacks UK give officials using Israeli cyberterrorism software and there are no consequences? I'm sure Abraham would be proud to have had his name attached to essentially a weapons contract masquerading as a peace deal between two evil governments.

gm3dmo 4y ago

Was it the phone provided and secured by the government or the off the books phone they have WhatsApp groups on? If it’s the first then security services have a problem. If it’s the second then those individuals have a problem.

mcintyre1994 4y ago
They do government business through those secret WhatsApp phones too. AFAIK the only government business we know about are the Covid contracts, but it could be anything. We know they have no kind of archival and have claimed phones are lost/replaced when they're required to provide messages, eg: https://www.theguardian.com/politics/2021/aug/04/covid-contracts-minister-lord-bethell-replaced-phone-before-it-could-be-searched https://www.theguardian.com/politics/2021/aug/04/covid-contr...

dirtylowprofile 4y ago

I wonder what about the third world countries with weak cyber policies.

karolsputo 4y ago

For anyone interested in the topic of Pegasus and NSO, there is a great New Yorker piece about them from yesterday. https://www.newyorker.com/magazine/2022/04/25/how-democracies-spy-on-their-citizens https://www.newyorker.com/magazine/2022/04/25/how-democracie...

LatteLazy 4y ago

Im a brit, Im not tech expert but I work adjacent to tech. I feel some what smug over this: * If you have nothing to hide, you have nothing to fear is official policy * We aggressively use "tools" like this both domestically and abroad, both for military/intel and for law enforcement with basically no oversight * Our government are basically technic-illiterate. And proud of that in many cases. So this is a train wreck of their own making. The only thing making me sad is that it will have zero effect.

Steele69 4y ago

[dead]

throwaway67743 4y ago

There is a point being totally missed in this thread and that is the UK government basically ignore all security common sense and do absolutely incomprehensible things like discuss national security over WhatsApp and Zoom, as a British citizen, in my eyes this absolutely amounts to treason as they're knowingly potentially giving away state secrets, anyone else would be instantly jailed. UK government and any departments discussing sensitive matters (or everyone, really) should not be using a) off the shelf phones, and b) should not be using public communications networks full stop, nevermind foreign communication platforms.

A4ET8a8uTh0 4y ago
I used to think that is an issue with old non-technical generation and therefore it is argument for new blood. But.. new blood is about as careless about sharing all sorts of information online as old blood. I don't know if there is a solution to this. I am starting to wonder if it is one of those 'best not to think about it' things.
- deleted 4y ago
  [deleted]
- tomxor 4y ago
  It's the same problem as the lack of widespread technical comprehension in the general public. New blood politicians may know more about tech, phones and services from a _user_ perspective, but most of them are still politicians, not engineers - and just like the vast majority of the general public, will mostly not appreciate the implications of any details bellow the surface of modern technology. What we think of as common sense are based on principles in this domain that is invisible to most people. There is no simple solution to this. For government specifically, perhaps a new specialised division that dictates policy for technology use throughout the government (I say new because I would not be surprised if some antiquated and dysfunctional version of this already exists).
  - throwaway67743 4y ago

danielktdoranie 4y ago

The patch for Pegasus has been out since September 2021.

wly_cdgr 4y ago

No wonder Boris can't stop horsing around

Proven 4y ago