5 ms·

Why do companies like Google and Microsoft not get more aggressive with these semi-criminal-orgs? Couldn't they massively raise the cost of being in this busine

• Cyberdog 4y ago
  > - Sue them, aggressively. On what grounds? > - Looks for exploits in their own systems and publish their code, making it worthless. Are you saying Google should publish exploits of Variston's systems? There's kind of a "two wrongs" problem there; such information would likely require illegal hacking ("accessing a computer system without permission") to discover. > - Publish lists of their owners and employees I'm sure they do as much as they can in that regard, but I'm sure such companies do much to hide their ownership and employees, and at any rate it could be seen as encouraging illegal harassment of said employees. > ban them from Google/Microsoft services. To the extent possible I'm sure they do this, but Google can't really stop someone from using Chrome, or always reliably detect when someone representing a malicious company is using their services.
  • deleted 4y ago
    [deleted]
  • kbenson 4y ago
    >> - Sue them, aggressively. > On what grounds? Love it or (more likely) hate it, the DMCA has anti-circumvention provisions in it, and breaking out of a sandbox sounds like it matches that. > Are you saying Google should publish exploits of Variston's systems? There's kind of a "two wrongs" problem there; such information would likely require illegal hacking ("accessing a computer system without permission") to discover. I don't think there's actually any problems here, as long as the "publish" portion is adhered to. Making sure they don't break the law in finding those exploits would be the hard part though, as you note.
    • tptacek 4y ago
      The DMCA anti-circumvention provisions apply only to technology that protects content covered by the DMCA; it doesn't criminalize arbitrary sandbox breaks.
  • shakna 4y ago
    > >- Sue them, aggressively. > On what grounds? A breach of the Terms and Services that all publishers are required to abide by, to have a relationship with Google and/or Apple. They have a list of security provisions and list of things you can and cannot do.
    • PeterisP 4y ago
      Nothing in the article implies that Variston has any relationship with Google and/or Apple or wants one. T&C is not the law - it may be a condition of Variston being able to publish apps on Google Play and Apple Store, but Variston definitely has (and should have) the right to refuse that T&C and not publish any apps, you can't unilaterally impose contracts on others.
• djcannabiz 4y ago
  I think they are sueing (some of) them. There was a new yorker article (https://www.newyorker.com/magazine/2022/04/25/how-democracies-spy-on-their-citizens https://www.newyorker.com/magazine/2022/04/25/how-democracie...) on how apple and other tech firms are sueing NSO and some other actors under the grounds they are violating the Icloud EULA by using imessage to hack people.
  • badRNG 4y ago
    It seems really hard to find grounds to sue these spyware vendors that don't equally apply to security researchers doing the kind of work that makes spyware less viable overall.
    • nradov 4y ago
      That is not a realistic concern with most major vendors. Apple, for example, has clear guidelines on what security researchers are allowed to do. Anyone who follows those guidelines won't be sued. https://security.apple.com/terms-and-conditions/ https://security.apple.com/terms-and-conditions/
    • not2b 4y ago
      But they don't have to do that. They can choose to sue spyware vendors and not sue security researchers who have technically violated the same provision.
      • dmix 4y ago
        Precedent?
      • saagarjha 4y ago
        It’s pretty easy to brand security researchers as malicious if you don’t like them.
        • nordsieck 4y ago
          > It’s pretty easy to brand security researchers as malicious if you don’t like them. OK. But it's in Apple's interest to work with them. Because the alternative is that the 0-day exploits get sold to companies or countries that aren't Apple. No such synergistic relationship exists between Apple and spyware vendors.
• throwaway22325 4y ago
  .
  • saagarjha 4y ago
    I have never heard of threat actors effectively targeting individual engineers who work on things that are contrary to their (malicious) interests.
    • csande17 4y ago
      Does this count? https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/new-campaign-targe... > We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with.
      • saagarjha 4y ago
        In reply to what I posted, yes, although it's not quite what I meant. The people who reach out to you if they think you are good are kind of amusing, especially if you know you're not that good :) But beyond that I haven't seen much. If you live in most countries you're not really concerned that some foreign agent is going to show up at your door and ask for you to stop. Or at least I haven't heard about it nor does anyone really seem to care about it. Perhaps it does happen and gets silently brushed under the rug, but I would think that this kind of thing would leak out…
• jlarocco 4y ago
  • tptacek 4y ago
    This is more or less the opposite of the truth, and what you're doing here is playing a dumb semantic game with the word "spyware".
    • jlarocco 4y ago
      Am I, though? If Chrome sends unknown telemetry back to Google without telling the user up front, how is it not spyware?
      • ironick09 4y ago
        It does if you read the terms etc when installing Chrome before mindlessly clicking next, install, finish.
        • jlarocco 4y ago
          Sure, blame the victims. Are we sure the software using Variston doesn't have a fine print disclaimer?
• gonzo41 4y ago
  Individual Corporation to User sanctions are a good idea. For it to be effective, it's need to not only hit the user, but their extended network. Imagine if you worked for these guys, and then oneday you found out, both apple and google and microsoft banned you, your wife and kids and parents from their networks based on your actions. Say the ban lasted 5 years for relations and lifetime for the person. It'd be an interesting escalation. I think it would work, It's a big part of the digital ecosystem you'd essentially be blacklisting bad actors from. Though there'd be scope creep eventually. So maybe it'd be dead on arrival as a technique to pressure them.
  • severino 4y ago
    > Imagine if you worked for these guys, and then oneday you found out, both apple and google and microsoft banned you, your wife and kids and parents from their networks based on your actions I feel sorry for you if you live in a country like that, but fortunately, in the country this company operates there are laws and regulations preventing that you can be punished or discriminated based on what your parents do or done.
    • runnerup 4y ago
      > there are laws and regulations preventing that you can be punished or discriminated based on what your parents do or done. Preventing the state from doing the punishment, yes. But AFAIK there’s no de jure rule on private entities doing this. It may go against the spirit of our systems and societal norms, but it would not be against the letter. It may, however, spur new legislation to subsequently ban the practice.
      • severino 4y ago
        > Preventing the state from doing the punishment, yes. But AFAIK there’s no de jure rule on private entities doing this. It may go against the spirit of our systems and societal norms, but it would not be against the letter. Here we have schools using all this crap from Microsoft or Google for education. I don't see how a company, with our actual laws, can prevent a kid from studying just because his parents did something.
• hulitu 4y ago
  > Why do companies like Google and Microsoft not get more aggressive with these semi-criminal-orgs? Because they operate in the same manner. If a spyware maker is convicted in US, the gate might be open to convict also Google, Facebook, Microsoft, Apple on the same grounds.
  • Thorrez 4y ago
    They don't operate in the same manner. Google and Microsoft's business model isn't to find 0-days, write exploits for them, and then sell those exploits to attackers. Disclosure: I work at Google.
    • hulitu 4y ago
      > 0-days Title says spyware.
      • Thorrez 4y ago
        Yes, and that specific spyware that it's talking about was exploiting 0-days.
• langsoul-com 4y ago
  Why? What incentives and financial gain do they get from that? Is it really their responsibility to tackle international cyber crime orgs?
  • TeMPOraL 4y ago
    > Why? What incentives and financial gain do they get from that? General goodwill, good publicity, and mid-to-long-term, strengthening the market they operate in and reducing their own expenditures. The question is interesting because they seem to also be the best players for it: they're affected, have the right skill sets, and more than enough spare money to afford it.
• severino 4y ago
  > Publish lists of their owners and employees and/or ban them from Google/Microsoft services How can you ban an individual from using Google or Microsoft services? Will you require id. cards, pictures and the like in order to register your Gmail account? Well, that would be great as it would stop many other people from using those services. Also, what you seem to suggest (a "black list" exposing people working at X) is wrong at so many levels. Should we also expose people from the military, CIA, FBI, etc? Rest assured that those orgs cause so much more harm that companies writing exploits for your browser.