4 ms·

> If they’ve found a way to hack one iPhone,” says Edward Snowden, “they’ve found a way to hack all iPhones.” I thought the way this works is that NSO Group de

> If they’ve found a way to hack one iPhone,” says Edward Snowden, “they’ve found a way to hack all iPhones.” I thought the way this works is that NSO Group determines there's a vulnerability in ios or android that lets them insert Pegasus, but soon after it gets deployed to spy on 1 person by a NSO Group client, Apple and Google eventually detects it and patches the vulnerability. I don't think it scales to 'all iphones'. There is a recent Frontline episode where NSO Group denies any knowledge of how Pegasus gets deployed once they sell the exploit system to a client, but that seems false to me since it is my understanding NSO Group runs a large amount of infrastructure to collect data from infected phones and to report data to the client, a multi tenant system. I can't find a source for Snowden saying this either.

tedunangst 4y ago
"Any" would be more apt than "all", although they may be able to do a coordinated blast targeting every phone at once. Not very stealthy though.
dayre 4y ago
Agreed, basically all phones having exploits that NSO has discovered and have yet to be patched by the owner of the phone are vulnerable. I think Apple's lawsuit against NSO is still in the courts, they mention a specific exploit that has since been patched. https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-group-to-curb-the-abuse-of-state-sponsored-spyware/ https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-gro...
gtvwill 4y ago
Oh such innocence. Apples probably backdoored permanently and so is android. Churrs aus gov law that means they can force you the employee to implement a backdoor and your not even allowed to tell your boss. Remember if the products sold in aus or has any form of business HQ here it has to be assumed it is not free from gov eyes. Also thanks to 5 eyes knowledge sharing your gov in US and my gov here don't need warrants to spy on their own citizens. They just have your data pass through a foreign but 5 eyes hosted service in one of their partner nations and pass data back via intel sharing agreements. The only safe assumption is all your devices are compromised or can easily be.
crystaln 4y ago
Also, if a phone is in an attacker’s custody, it will no longer be updated, and they can wait for an exploit to no longer be day one when it will be cheaper.
hsbauauvhabzb 4y ago
I wormable vulnerability would do well, my iPhone seems to want to patch only a few days after release.
wkat4242 4y ago
It will scale to all iPhones sure. That's not the reason why it's not widespread. The problem is keeping it under the radar. If NSO starts blasting their exploits to the general population it'll be a matter of days before some smart security researcher figures it out and gets it patched. Because even if the exploit itself is hard to detect, you still have the C&C and exfiltration to deal with which is detectable in many ways. You can block doing it via WiFi but some researchers even run their own cell hotspot. I think this is why they make it so expensive, so it remains really rare. It protects their business. This is a very common problem in cryptography. Once you're discovered your target will simply change their tools. The allies had to let a lot of people die in less important convoys lest the Germans would get suspicious about Enigma being cracked. And always had to fake a 'chance' encounter with a spotter plane or something.

tedunangst 4y ago

"Any" would be more apt than "all", although they may be able to do a coordinated blast targeting every phone at once. Not very stealthy though.

dayre 4y ago

Agreed, basically all phones having exploits that NSO has discovered and have yet to be patched by the owner of the phone are vulnerable. I think Apple's lawsuit against NSO is still in the courts, they mention a specific exploit that has since been patched. https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-group-to-curb-the-abuse-of-state-sponsored-spyware/ https://www.apple.com/ca/newsroom/2021/11/apple-sues-nso-gro...

gtvwill 4y ago

Oh such innocence. Apples probably backdoored permanently and so is android. Churrs aus gov law that means they can force you the employee to implement a backdoor and your not even allowed to tell your boss. Remember if the products sold in aus or has any form of business HQ here it has to be assumed it is not free from gov eyes. Also thanks to 5 eyes knowledge sharing your gov in US and my gov here don't need warrants to spy on their own citizens. They just have your data pass through a foreign but 5 eyes hosted service in one of their partner nations and pass data back via intel sharing agreements. The only safe assumption is all your devices are compromised or can easily be.

crystaln 4y ago

Also, if a phone is in an attacker’s custody, it will no longer be updated, and they can wait for an exploit to no longer be day one when it will be cheaper.

hsbauauvhabzb 4y ago

I wormable vulnerability would do well, my iPhone seems to want to patch only a few days after release.

wkat4242 4y ago

It will scale to all iPhones sure. That's not the reason why it's not widespread. The problem is keeping it under the radar. If NSO starts blasting their exploits to the general population it'll be a matter of days before some smart security researcher figures it out and gets it patched. Because even if the exploit itself is hard to detect, you still have the C&C and exfiltration to deal with which is detectable in many ways. You can block doing it via WiFi but some researchers even run their own cell hotspot. I think this is why they make it so expensive, so it remains really rare. It protects their business. This is a very common problem in cryptography. Once you're discovered your target will simply change their tools. The allies had to let a lot of people die in less important convoys lest the Germans would get suspicious about Enigma being cracked. And always had to fake a 'chance' encounter with a spotter plane or something.