7 ms·

Pegasus: A Spy in Your Pocket Threatens the End of Privacy

69 points by galaxyLogic 4y ago

johnea 4y ago
Pegasus might make handy click bait, but NSO Group doesn't get a tiny fraction of the data that Goggle Corp gathers. But, since pretty much everyone in the US is allowing goggle to continue it's massive violation of the 4th amendment, it's not really news worthy.
- vuln 4y ago
  Users typically agree to send their data to Google. With NSO and Pegasus the purchaser agrees, but the intended victim (the one being exploited) never agreed to send their data to whomever purchased Pegasus from NSO or the NSO. So it doesn't really matter if NSO has less data than Google. It matters _HOW_ the NSO Group/ customer got the data which 99.9% is against the wishes of the victim.
- czx4f4bd 4y ago
  Google isn't a branch of the US government, so the 4th amendment doesn't apply. If you want adtech surveillance to be regulated, lobby for GDPR-style regulation in the US.
  - cheeseomlit 4y ago
    If the US Gov has access to the data Google collects without issuing a warrant, which they do according to the Snowden leaks, then the distinction is meaningless as far as the intent of the 4th amendment goes
    - orthecreedence 4y ago
      Yes, the separation of state and industry has long been eroded in the US. Yet people are still under the illusion that democracy exists.
    - czx4f4bd 4y ago
      The US government obtained that data by illegally tapping into Google's data centers, which means the government was still the entity violating the 4th amendment. If you want to criticize Google's data collection, fine, but doing it in terms of the 4th amendment is just nonsensical. If you want to criticize companies for collecting data that could subsequently be illegally collected by the government, then every single company that collects any PII/private information could be criticized on the same basis.
      - cheeseomlit 4y ago
        It's not like they hacked into Google's servers without their knowledge or consent, they were given access to the data. Obviously those who knew about it at Google were under gag orders, but one would hope that somebody involved would have the balls to leak the government's blatantly unconstitutional and illegal demands to the press regardless. Those gag orders wouldn't have held up in court if anybody at one of the PRISM companies had the conscience to go rogue. Every company involved in PRISM can be rightfully accused of colluding with the government to violate the basic 4th amendment rights of millions of people, knowingly and willingly.
        roywiggins 4y ago
        I didn't get the impression that MUSCULAR (intercepting Google's inter-datacenter links, distinct from PRISM) involved Google's cooperation.
        EMM_386 4y ago
        > It's not like they hacked into Google's servers without their knowledge or consent, they were given access to the data. This is not true. The NSA hacked Google without their consent. The relevant slide from the Snowden leak is here: https://i.imgur.com/7IHE6sG.png https://i.imgur.com/7IHE6sG.png > Snowden leaks: Google 'outraged' at alleged NSA hacking https://www.bbc.com/news/world-us-canada-24751821 https://www.bbc.com/news/world-us-canada-24751821
    - webdoodle 4y ago
      There's a word for that: FASCISM, and both parties enabled it: -Bush Jr. set up the surveillance system using a classified executive order -Obama gave access to it to 16 Law Enforcement agencies (via EO) and didn't renew the Smith-Mundt Act to legalize psychological warfare on U.S. Citizens -Trump could have shut it down by the same Executive Order system , but instead did nothing but whine and remove a single Top Security clearance from Brennan. He also ordered the DHS to create lists of journalists and media influencers to target for surveillance. -Biden weaponized social media against us to silence us and ostracize us from society.
      - drooopy 4y ago
        -Biden weaponized social media against us to silence us and ostracize us from society. Huh?
        webdoodle 4y ago
        I take it, you've missed the Twitter Files completely?
- diabeticApe 4y ago
  This is a silly comparison. Were basically comparing the use of data to conduct political repression to the use of data to recommend content relevant to your own interests.
etc-hosts 4y ago
> If they’ve found a way to hack one iPhone,” says Edward Snowden, “they’ve found a way to hack all iPhones.” I thought the way this works is that NSO Group determines there's a vulnerability in ios or android that lets them insert Pegasus, but soon after it gets deployed to spy on 1 person by a NSO Group client, Apple and Google eventually detects it and patches the vulnerability. I don't think it scales to 'all iphones'. There is a recent Frontline episode where NSO Group denies any knowledge of how Pegasus gets deployed once they sell the exploit system to a client, but that seems false to me since it is my understanding NSO Group runs a large amount of infrastructure to collect data from infected phones and to report data to the client, a multi tenant system. I can't find a source for Snowden saying this either.
- tedunangst 4y ago
  "Any" would be more apt than "all", although they may be able to do a coordinated blast targeting every phone at once. Not very stealthy though.
- dayre 4y ago
  Agreed, basically all phones having exploits that NSO has discovered and have yet to be patched by the owner of the phone are vulnerable. I think Apple's lawsuit against NSO is still in the courts, they mention a specific exploit that has since been patched. https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-group-to-curb-the-abuse-of-state-sponsored-spyware/ https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-gro...
- gtvwill 4y ago
  Oh such innocence. Apples probably backdoored permanently and so is android. Churrs aus gov law that means they can force you the employee to implement a backdoor and your not even allowed to tell your boss. Remember if the products sold in aus or has any form of business HQ here it has to be assumed it is not free from gov eyes. Also thanks to 5 eyes knowledge sharing your gov in US and my gov here don't need warrants to spy on their own citizens. They just have your data pass through a foreign but 5 eyes hosted service in one of their partner nations and pass data back via intel sharing agreements. The only safe assumption is all your devices are compromised or can easily be.
moltude 4y ago
Interview with the authors on the Lawfare podcast https://www.lawfareblog.com/lawfare-podcast-how-spy-your-pocket-threatens-end-privacy-dignity-and-democracy https://www.lawfareblog.com/lawfare-podcast-how-spy-your-poc...
keyme 4y ago
The smartphone: A Spy in Your Pocket Threatens the End of Privacy Pegasus was just a way of some governments to get their hands on a small part of the action GOOG & FB are swimming in.
- galaxyLogic 4y ago
  The difference is users of Pegasus don't know they are users of Pegasus.
- diabeticApe 4y ago
  Also governments use thier access to target people for political repression or death not to recommend you a local restaurant or laundry detergent. Not even close to the same thing.
DerekBickerton 4y ago
I'm probably reading this HN thread from a Pegasus-infected iPhone right now, and I have no way of knowing! The only commercial solution to detect Pegasus I know of is iMazing's Pegasus detection tool[0] which borrows techniques from Amnesty International's Mobile Verification Toolkit (MVT)[1] to detect Pegasus. Not sure how reliable it is though. Anyway with something like Pegasus, all the forensic artifacts would be random and heavily mutated for each infected device, so it's not as easy as running a tool to detect its presence. Pegasus is known for doing anti-forensics under the hood. [0] https://imazing.com/blog/detecting-pegasus-spyware-with-imazing https://imazing.com/blog/detecting-pegasus-spyware-with-imaz... [1] https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...
- raxxorraxor 4y ago
  It should be noted again that detecting this form of malware would be considerably easier on a system like an open Desktop PC and there would be many ways to Rome.
raybb 4y ago
PBS Frontline released a documentary about Pegasus earlier this month and it's pretty good, though a bit slow. https://www.pbs.org/wgbh/frontline/documentary/global-spyware-scandal-exposing-pegasus/ https://www.pbs.org/wgbh/frontline/documentary/global-spywar...
zeitgeistcowboy 4y ago
It was cool to see the listing of this book at The Tattered Cover Bookstore website. This is an old school bookstore and well worth a visit. It looks like there are eight locations around Colorado. I grew up going to the one in Colorado Springs on Tejon street in the 90s. It goes to show that used bookstores offer a great service for very modern topics like digital privacy.

69 points by galaxyLogic 4y ago

Pegasus might make handy click bait, but NSO Group doesn't get a tiny fraction of the data that Goggle Corp gathers. But, since pretty much everyone in the US is allowing goggle to continue it's massive violation of the 4th amendment, it's not really news worthy.

vuln 4y ago
Users typically agree to send their data to Google. With NSO and Pegasus the purchaser agrees, but the intended victim (the one being exploited) never agreed to send their data to whomever purchased Pegasus from NSO or the NSO. So it doesn't really matter if NSO has less data than Google. It matters _HOW_ the NSO Group/ customer got the data which 99.9% is against the wishes of the victim.
czx4f4bd 4y ago
Google isn't a branch of the US government, so the 4th amendment doesn't apply. If you want adtech surveillance to be regulated, lobby for GDPR-style regulation in the US.
- cheeseomlit 4y ago
  If the US Gov has access to the data Google collects without issuing a warrant, which they do according to the Snowden leaks, then the distinction is meaningless as far as the intent of the 4th amendment goes
  - orthecreedence 4y ago
    Yes, the separation of state and industry has long been eroded in the US. Yet people are still under the illusion that democracy exists.
  - czx4f4bd 4y ago
    The US government obtained that data by illegally tapping into Google's data centers, which means the government was still the entity violating the 4th amendment. If you want to criticize Google's data collection, fine, but doing it in terms of the 4th amendment is just nonsensical. If you want to criticize companies for collecting data that could subsequently be illegally collected by the government, then every single company that collects any PII/private information could be criticized on the same basis.
    - cheeseomlit 4y ago
      It's not like they hacked into Google's servers without their knowledge or consent, they were given access to the data. Obviously those who knew about it at Google were under gag orders, but one would hope that somebody involved would have the balls to leak the government's blatantly unconstitutional and illegal demands to the press regardless. Those gag orders wouldn't have held up in court if anybody at one of the PRISM companies had the conscience to go rogue. Every company involved in PRISM can be rightfully accused of colluding with the government to violate the basic 4th amendment rights of millions of people, knowingly and willingly.
      - roywiggins 4y ago
        I didn't get the impression that MUSCULAR (intercepting Google's inter-datacenter links, distinct from PRISM) involved Google's cooperation.
      - EMM_386 4y ago
        > It's not like they hacked into Google's servers without their knowledge or consent, they were given access to the data. This is not true. The NSA hacked Google without their consent. The relevant slide from the Snowden leak is here: https://i.imgur.com/7IHE6sG.png https://i.imgur.com/7IHE6sG.png > Snowden leaks: Google 'outraged' at alleged NSA hacking https://www.bbc.com/news/world-us-canada-24751821 https://www.bbc.com/news/world-us-canada-24751821
  - webdoodle 4y ago
    There's a word for that: FASCISM, and both parties enabled it: -Bush Jr. set up the surveillance system using a classified executive order -Obama gave access to it to 16 Law Enforcement agencies (via EO) and didn't renew the Smith-Mundt Act to legalize psychological warfare on U.S. Citizens -Trump could have shut it down by the same Executive Order system , but instead did nothing but whine and remove a single Top Security clearance from Brennan. He also ordered the DHS to create lists of journalists and media influencers to target for surveillance. -Biden weaponized social media against us to silence us and ostracize us from society.
    - drooopy 4y ago
      -Biden weaponized social media against us to silence us and ostracize us from society. Huh?
      - webdoodle 4y ago
        I take it, you've missed the Twitter Files completely?
diabeticApe 4y ago
This is a silly comparison. Were basically comparing the use of data to conduct political repression to the use of data to recommend content relevant to your own interests.

etc-hosts 4y ago

> If they’ve found a way to hack one iPhone,” says Edward Snowden, “they’ve found a way to hack all iPhones.” I thought the way this works is that NSO Group determines there's a vulnerability in ios or android that lets them insert Pegasus, but soon after it gets deployed to spy on 1 person by a NSO Group client, Apple and Google eventually detects it and patches the vulnerability. I don't think it scales to 'all iphones'. There is a recent Frontline episode where NSO Group denies any knowledge of how Pegasus gets deployed once they sell the exploit system to a client, but that seems false to me since it is my understanding NSO Group runs a large amount of infrastructure to collect data from infected phones and to report data to the client, a multi tenant system. I can't find a source for Snowden saying this either.

tedunangst 4y ago
"Any" would be more apt than "all", although they may be able to do a coordinated blast targeting every phone at once. Not very stealthy though.
dayre 4y ago
Agreed, basically all phones having exploits that NSO has discovered and have yet to be patched by the owner of the phone are vulnerable. I think Apple's lawsuit against NSO is still in the courts, they mention a specific exploit that has since been patched. https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-group-to-curb-the-abuse-of-state-sponsored-spyware/ https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-gro...
gtvwill 4y ago
Oh such innocence. Apples probably backdoored permanently and so is android. Churrs aus gov law that means they can force you the employee to implement a backdoor and your not even allowed to tell your boss. Remember if the products sold in aus or has any form of business HQ here it has to be assumed it is not free from gov eyes. Also thanks to 5 eyes knowledge sharing your gov in US and my gov here don't need warrants to spy on their own citizens. They just have your data pass through a foreign but 5 eyes hosted service in one of their partner nations and pass data back via intel sharing agreements. The only safe assumption is all your devices are compromised or can easily be.

moltude 4y ago

Interview with the authors on the Lawfare podcast https://www.lawfareblog.com/lawfare-podcast-how-spy-your-pocket-threatens-end-privacy-dignity-and-democracy https://www.lawfareblog.com/lawfare-podcast-how-spy-your-poc...

keyme 4y ago

The smartphone: A Spy in Your Pocket Threatens the End of Privacy Pegasus was just a way of some governments to get their hands on a small part of the action GOOG & FB are swimming in.

galaxyLogic 4y ago
The difference is users of Pegasus don't know they are users of Pegasus.
diabeticApe 4y ago
Also governments use thier access to target people for political repression or death not to recommend you a local restaurant or laundry detergent. Not even close to the same thing.

DerekBickerton 4y ago

I'm probably reading this HN thread from a Pegasus-infected iPhone right now, and I have no way of knowing! The only commercial solution to detect Pegasus I know of is iMazing's Pegasus detection tool[0] which borrows techniques from Amnesty International's Mobile Verification Toolkit (MVT)[1] to detect Pegasus. Not sure how reliable it is though. Anyway with something like Pegasus, all the forensic artifacts would be random and heavily mutated for each infected device, so it's not as easy as running a tool to detect its presence. Pegasus is known for doing anti-forensics under the hood. [0] https://imazing.com/blog/detecting-pegasus-spyware-with-imazing https://imazing.com/blog/detecting-pegasus-spyware-with-imaz... [1] https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...

raxxorraxor 4y ago
It should be noted again that detecting this form of malware would be considerably easier on a system like an open Desktop PC and there would be many ways to Rome.

raybb 4y ago

PBS Frontline released a documentary about Pegasus earlier this month and it's pretty good, though a bit slow. https://www.pbs.org/wgbh/frontline/documentary/global-spyware-scandal-exposing-pegasus/ https://www.pbs.org/wgbh/frontline/documentary/global-spywar...

zeitgeistcowboy 4y ago

It was cool to see the listing of this book at The Tattered Cover Bookstore website. This is an old school bookstore and well worth a visit. It looks like there are eight locations around Colorado. I grew up going to the one in Colorado Springs on Tejon street in the 90s. It goes to show that used bookstores offer a great service for very modern topics like digital privacy.