6 ms·

Paragon Graphite is a Pegasus spyware clone used in the US

173 points by pabs3 3y ago

photochemsyn 3y ago
The fact that the DEA is apparently the top purchaser of this spyware tech is unsurprising, although their justification is fairly ludicrous: > "The DEA did not directly comment, but it has been claimed that the agency bought Graphite for use by law enforcement partners in Mexico to fight drug cartels. A DEA spokesperson said only that it uses 'every lawful investigative tool available to pursue the foreign-based cartels and individuals operating around the world responsible for the drug poisoning deaths of 107,735 Americans last year.'" Meanwhile, courts just shielded the Sackler opiate cartel members from civil liability for their massive US-wide opiate marketing scheme (they were already shielded from criminal prosecution): "Sackler family wins immunity from opioid lawsuits, May 31 2023" https://www.bbc.com/news/world-us-canada-65764307 https://www.bbc.com/news/world-us-canada-65764307 Considering the widespread propensity of humans to indulge in the use of various consciousness-altering substances, what you end up with is highly selective prosecution and many instances of the Lavrentiy Beria (Stalin's deputy) quote: "Show me the man and I'll show you the crime."
nceqs3 3y ago
Is this really an article? It's just pointing to the FT piece.
- mzs 3y ago
  This should be the link: https://www.ft.com/content/11cb394d-a13e-4826-b580-823b9367fedb https://www.ft.com/content/11cb394d-a13e-4826-b580-823b9367f...
jruohonen 3y ago
Surprise, surprise.
- theGeatZhopa 3y ago
  I can read some sarcasm out of it. But, I aint surprised, too. Wash my hands, but don't make them wet! As long it is used to target criminals, ok. But it won't.
  - jruohonen 3y ago
    Some sarcasm, of course, but, nevertheless, President Biden and his alliances are still on the right track; it is just that banning a single company will hardly make any difference.
  - underdeserver 3y ago
    Genuinely curious, how do you (and everyone on HN) suggest enforcing that? On the one hand, yes, I'm afraid for my freedom and that of my friends, but on the other hand, drug cartels are really, really bad.
    - rightbyte 3y ago
      If something leads to a mental reasoning of "OK, but then again not really", just don't do it?
      - underdeserver 3y ago
        "Don't do it" is easy to say, but you are the government / law enforcement and drug cartels are murdering your citizens, so maybe that's just not good enough?
        jruohonen 3y ago
        It is indeed a very thorny issue. I am not sure any longer what they (governments) are trying, but they've at least tried company bans, export controls, and specific laws, but none of them really work as some countries will still abuse their powers beyond what can be considered legal/legitimate (such as the drug cartel case here).
        3y ago
singingwolfboy 3y ago
https://web.archive.org/web/20230531064401/https://www.gamingdeputy.com/paragon-graphite-is-a-pegasus-spyware-clone-used-in-the-us/ https://web.archive.org/web/20230531064401/https://www.gamin...
rkagerer 3y ago
How viable is it to create an operating system that is sufficiently bug-free and hardened enough to withstand even the most daunting of government adversaries?
- coldpie 3y ago
  It is literally impossible with today's software engineering tools. If you want real computer security, we need to rebuild the industry from the ground up with correctness and proofs from step 1. That looks like formal analysis tools and then engineering tools built upon them. This research area has largely stagnated since the 80s & early 90s since no one actually cares about correctness because it is expensive. Without correctness guarantees, you cannot have computer security, full stop. All we have are band-aids on top of the gaping wounds upon which our entire industry was built. So step one of your new OS engineering process is to build a whole new software engineering paradigm, and all of the engineering tools to go with it, from the ground up, based only on research from like a dozen people that mostly ended around 1990.
- cromka 3y ago
  Qubes OS
  - astrange 3y ago
    Not good enough, your hardware has to be secure too or they can leave an implant in any of various firmwares.
    - cromka 3y ago
      They asked about Operating System, not hardware. And hardware with open source firmware is available.
      - astrange 3y ago
        > And hardware with open source firmware is available. And how do you know you're running it?
EuropeOverlords 3y ago
[dead]
sourcelang 3y ago
People will post their tired moral objections(as I used to), but in a world where public information is already heavily monitored, censored and controlled, and where people are already arrested for posting song lyrics or making their dog do comedy sketches, why not just completely let the cat out of the bag and stop pretending we have any sort of reasonable control over our own private lives, thoughts or opinions outside of government, intelligence agencies and public-perception altering mega-corporations? I’m quite serious here. There’s almost no point in fighting at this point. I would personally like to see law enforcement and intelligence agencies double down on their use of these kinds of tools, but, you know, to catch drug traffickers, terrorists, illegal arms dealers, money launderers, actual criminals who want to harm people, or is that too much to ask? If Trucker John is going to be arrested for posting something vaguely racist under a Twitter video where 5 guys are brutally murdering someone, why not also catch the actual criminals in the video? I’m dead serious here. Let’s just accelerate. Make the internet and internet-connected devices defacto public property and allow full access to law enforcement. I’d rather have all this be regulated with oversight, than the alternative.
- hutzlibu 3y ago
  " I’d rather have all this be regulated with oversight, than the alternative." Yeah well, that raises the old question: who guards the guards? As far as I am aware, police and politicians themself, react quite allergic to more transparency (surveillance) for them. So the only way I would be remotely ok with more surveillance and regulation, is if would apply to everyone and especially to the regulators. Otherwise a clear no from me, I simply do not trust the authorities. And there are still lots of ways to communicate besides regulated spaces. But sure if, you want to be heard by the mainstream, you are going into regulated territory.
  - adamhp 3y ago
    I really really wish people would keep reading 1984.
    - sourcelang 3y ago
dogma1138 3y ago
Why is this surprising? This is what happens when you ban a specific brand of software or a supplier rather than the activity that their tools are used for. Clearly there was and is still demand form TLAs for this kind of software and services so people who want to get paid will just rebrand or produce an alternative.
- roywiggins 3y ago
  Who said it was surprising?
  - colpabar 3y ago
    It's a very common comment made here. If someone is already familiar with the topic of an article, it means that apparently the article is useless, because its content should already be obvious to everyone.
    - throw10920 3y ago
      It's emotionally manipulative, that's what it is. I downvote most content that feigns surprise or uses other manipulative phrases like "should be ashamed", and I suggest others do, too - it'll be better for the health of HN.
londons_explore 3y ago
Is this the same Paragon that made Paragon Partition Manager back in the 90's?
- Erlangen 3y ago
  I could only find this. So it's definitely a different company. > Paragon Solutions doesn’t have a website. There’s very little information at all about them online, even if the Tel Aviv-based smartphone surveillance startup’s employees are all over LinkedIn, more than 50 of them. That’s not a bad headcount for a company that’s still in stealth mode. [1] https://www.forbes.com/sites/thomasbrewster/2021/07/29/paragon-is-an-nso-competitor-and-an-american-funded-israeli-surveillance-startup-that-hacks-encrypted-apps-like-whatsapp-and-signal/ https://www.forbes.com/sites/thomasbrewster/2021/07/29/parag...
ReptileMan 3y ago
I mean what is big deal- the government has a right to lawful intercept. Fix FISA and warrant ruberstamping instead of pearl clutching about the tool used to achieve it.
- 2OEH8eoCRo0 3y ago
  > warrant rubberstamping Is this an assumption? We don't have much information into this process so it surprises me that we jump to the conclusion that they're a rubber stamp. Is there any supporting evidence for this assertion?
  - ReptileMan 3y ago
    Snowden files was quite detailed on how the NSA programs targeted at US were barely having any kind of judicial scrutiny and FISA was rubberstamping. I don't see any reason to believe that the situation has improved or that in the other branches of sigint employing agencies it is better.
    - 2OEH8eoCRo0 3y ago
      > Snowden files was quite detailed Where was this detailed? We would need to know how many requests the FISA courts receive and how many they reject and we would also need to know these numbers for the in-the-open legal system. Even still- if investigators are good at their job they aren't going to give the judge flimsy requests that will get rejected. I know for example that police often err on the side of caution and request warrants where a warrant might not be required because it's better than being wrong and tainting the entire case.
      - autoexec 3y ago
        > We would need to know how many requests the FISA courts receive and how many they reject We aren't entirely without numbers "1,856. That's the number of applications presented to the court by the government last year. And it's also the number that the court approved: 100 percent success." (https://www.npr.org/2013/06/13/191226106/fisa-court-appears-to-be-rubberstamp-for-government-requests https://www.npr.org/2013/06/13/191226106/fisa-court-appears-...)
shelfchair 3y ago
This site seems to scrape from 9to5mac. Original post from 9to5mac: https://9to5mac.com/2023/05/30/paragon-graphite/ https://9to5mac.com/2023/05/30/paragon-graphite/
- underdeserver 3y ago
  Wow, what a blatant copy. @dang should the link be updated?
thisGuyFlicks 3y ago
> In particular, simply receiving a particular iMessage – without opening it or interacting with it in any way – can allow an iPhone to be compromised, with personal data exposed. So does this mean it is wise to turn off iMessage so that all messages come through as text message?
deleted 3y ago
[deleted]

173 points by pabs3 3y ago

The fact that the DEA is apparently the top purchaser of this spyware tech is unsurprising, although their justification is fairly ludicrous: > "The DEA did not directly comment, but it has been claimed that the agency bought Graphite for use by law enforcement partners in Mexico to fight drug cartels. A DEA spokesperson said only that it uses 'every lawful investigative tool available to pursue the foreign-based cartels and individuals operating around the world responsible for the drug poisoning deaths of 107,735 Americans last year.'" Meanwhile, courts just shielded the Sackler opiate cartel members from civil liability for their massive US-wide opiate marketing scheme (they were already shielded from criminal prosecution): "Sackler family wins immunity from opioid lawsuits, May 31 2023" https://www.bbc.com/news/world-us-canada-65764307 https://www.bbc.com/news/world-us-canada-65764307 Considering the widespread propensity of humans to indulge in the use of various consciousness-altering substances, what you end up with is highly selective prosecution and many instances of the Lavrentiy Beria (Stalin's deputy) quote: "Show me the man and I'll show you the crime."

nceqs3 3y ago

Is this really an article? It's just pointing to the FT piece.

mzs 3y ago
This should be the link: https://www.ft.com/content/11cb394d-a13e-4826-b580-823b9367fedb https://www.ft.com/content/11cb394d-a13e-4826-b580-823b9367f...

jruohonen 3y ago

Surprise, surprise.

theGeatZhopa 3y ago
I can read some sarcasm out of it. But, I aint surprised, too. Wash my hands, but don't make them wet! As long it is used to target criminals, ok. But it won't.
- jruohonen 3y ago
  Some sarcasm, of course, but, nevertheless, President Biden and his alliances are still on the right track; it is just that banning a single company will hardly make any difference.
- underdeserver 3y ago
  Genuinely curious, how do you (and everyone on HN) suggest enforcing that? On the one hand, yes, I'm afraid for my freedom and that of my friends, but on the other hand, drug cartels are really, really bad.
  - rightbyte 3y ago
    If something leads to a mental reasoning of "OK, but then again not really", just don't do it?
    - underdeserver 3y ago
      "Don't do it" is easy to say, but you are the government / law enforcement and drug cartels are murdering your citizens, so maybe that's just not good enough?
      - jruohonen 3y ago
        It is indeed a very thorny issue. I am not sure any longer what they (governments) are trying, but they've at least tried company bans, export controls, and specific laws, but none of them really work as some countries will still abuse their powers beyond what can be considered legal/legitimate (such as the drug cartel case here).
      - 3y ago

singingwolfboy 3y ago

https://web.archive.org/web/20230531064401/https://www.gamingdeputy.com/paragon-graphite-is-a-pegasus-spyware-clone-used-in-the-us/ https://web.archive.org/web/20230531064401/https://www.gamin...

rkagerer 3y ago

How viable is it to create an operating system that is sufficiently bug-free and hardened enough to withstand even the most daunting of government adversaries?

coldpie 3y ago
It is literally impossible with today's software engineering tools. If you want real computer security, we need to rebuild the industry from the ground up with correctness and proofs from step 1. That looks like formal analysis tools and then engineering tools built upon them. This research area has largely stagnated since the 80s & early 90s since no one actually cares about correctness because it is expensive. Without correctness guarantees, you cannot have computer security, full stop. All we have are band-aids on top of the gaping wounds upon which our entire industry was built. So step one of your new OS engineering process is to build a whole new software engineering paradigm, and all of the engineering tools to go with it, from the ground up, based only on research from like a dozen people that mostly ended around 1990.
cromka 3y ago
Qubes OS
- astrange 3y ago
  Not good enough, your hardware has to be secure too or they can leave an implant in any of various firmwares.
  - cromka 3y ago
    They asked about Operating System, not hardware. And hardware with open source firmware is available.
    - astrange 3y ago
      > And hardware with open source firmware is available. And how do you know you're running it?

EuropeOverlords 3y ago

[dead]

sourcelang 3y ago

People will post their tired moral objections(as I used to), but in a world where public information is already heavily monitored, censored and controlled, and where people are already arrested for posting song lyrics or making their dog do comedy sketches, why not just completely let the cat out of the bag and stop pretending we have any sort of reasonable control over our own private lives, thoughts or opinions outside of government, intelligence agencies and public-perception altering mega-corporations? I’m quite serious here. There’s almost no point in fighting at this point. I would personally like to see law enforcement and intelligence agencies double down on their use of these kinds of tools, but, you know, to catch drug traffickers, terrorists, illegal arms dealers, money launderers, actual criminals who want to harm people, or is that too much to ask? If Trucker John is going to be arrested for posting something vaguely racist under a Twitter video where 5 guys are brutally murdering someone, why not also catch the actual criminals in the video? I’m dead serious here. Let’s just accelerate. Make the internet and internet-connected devices defacto public property and allow full access to law enforcement. I’d rather have all this be regulated with oversight, than the alternative.

hutzlibu 3y ago
" I’d rather have all this be regulated with oversight, than the alternative." Yeah well, that raises the old question: who guards the guards? As far as I am aware, police and politicians themself, react quite allergic to more transparency (surveillance) for them. So the only way I would be remotely ok with more surveillance and regulation, is if would apply to everyone and especially to the regulators. Otherwise a clear no from me, I simply do not trust the authorities. And there are still lots of ways to communicate besides regulated spaces. But sure if, you want to be heard by the mainstream, you are going into regulated territory.
- adamhp 3y ago
  I really really wish people would keep reading 1984.
  - sourcelang 3y ago

dogma1138 3y ago

Why is this surprising? This is what happens when you ban a specific brand of software or a supplier rather than the activity that their tools are used for. Clearly there was and is still demand form TLAs for this kind of software and services so people who want to get paid will just rebrand or produce an alternative.

roywiggins 3y ago
Who said it was surprising?
- colpabar 3y ago
  It's a very common comment made here. If someone is already familiar with the topic of an article, it means that apparently the article is useless, because its content should already be obvious to everyone.
  - throw10920 3y ago
    It's emotionally manipulative, that's what it is. I downvote most content that feigns surprise or uses other manipulative phrases like "should be ashamed", and I suggest others do, too - it'll be better for the health of HN.

londons_explore 3y ago

Is this the same Paragon that made Paragon Partition Manager back in the 90's?

Erlangen 3y ago
I could only find this. So it's definitely a different company. > Paragon Solutions doesn’t have a website. There’s very little information at all about them online, even if the Tel Aviv-based smartphone surveillance startup’s employees are all over LinkedIn, more than 50 of them. That’s not a bad headcount for a company that’s still in stealth mode. [1] https://www.forbes.com/sites/thomasbrewster/2021/07/29/paragon-is-an-nso-competitor-and-an-american-funded-israeli-surveillance-startup-that-hacks-encrypted-apps-like-whatsapp-and-signal/ https://www.forbes.com/sites/thomasbrewster/2021/07/29/parag...

ReptileMan 3y ago

I mean what is big deal- the government has a right to lawful intercept. Fix FISA and warrant ruberstamping instead of pearl clutching about the tool used to achieve it.

2OEH8eoCRo0 3y ago
> warrant rubberstamping Is this an assumption? We don't have much information into this process so it surprises me that we jump to the conclusion that they're a rubber stamp. Is there any supporting evidence for this assertion?
- ReptileMan 3y ago
  Snowden files was quite detailed on how the NSA programs targeted at US were barely having any kind of judicial scrutiny and FISA was rubberstamping. I don't see any reason to believe that the situation has improved or that in the other branches of sigint employing agencies it is better.
  - 2OEH8eoCRo0 3y ago
    > Snowden files was quite detailed Where was this detailed? We would need to know how many requests the FISA courts receive and how many they reject and we would also need to know these numbers for the in-the-open legal system. Even still- if investigators are good at their job they aren't going to give the judge flimsy requests that will get rejected. I know for example that police often err on the side of caution and request warrants where a warrant might not be required because it's better than being wrong and tainting the entire case.
    - autoexec 3y ago
      > We would need to know how many requests the FISA courts receive and how many they reject We aren't entirely without numbers "1,856. That's the number of applications presented to the court by the government last year. And it's also the number that the court approved: 100 percent success." (https://www.npr.org/2013/06/13/191226106/fisa-court-appears-to-be-rubberstamp-for-government-requests https://www.npr.org/2013/06/13/191226106/fisa-court-appears-...)

shelfchair 3y ago

This site seems to scrape from 9to5mac. Original post from 9to5mac: https://9to5mac.com/2023/05/30/paragon-graphite/ https://9to5mac.com/2023/05/30/paragon-graphite/

underdeserver 3y ago
Wow, what a blatant copy. @dang should the link be updated?

thisGuyFlicks 3y ago

> In particular, simply receiving a particular iMessage – without opening it or interacting with it in any way – can allow an iPhone to be compromised, with personal data exposed. So does this mean it is wise to turn off iMessage so that all messages come through as text message?

deleted 3y ago

[deleted]