8 ms·

I find it interesting that most comments here are blaming the victim (Apple’s iMessage and by transitivity its users) rather than the aggressor (NSO and its use

I find it interesting that most comments here are blaming the victim (Apple’s iMessage and by transitivity its users) rather than the aggressor (NSO and its users). How come NSO isn’t yet designated as a (cyber-)terrorist group worth hunting down and extinguishing?

Zetice 3y ago
Because “hunting down and extinguishing” is a wild overreaction?
deleted 3y ago
[deleted]
vimax 3y ago
Apple makes security claims in a world where these types of attacks are known about and expected. They are responsible for fulfilling their own claims. If an air bag fails, you fault the manufacturer. They don’t escape responsibility by saying it’s the other drivers fault. I’ll also add that Apple is not the victim here, the targeted end users are.
- agnosticmantis 3y ago
  This is a false comparison. Being hacked by NSO isn’t an accident. There’s an agent involved here with clear intent to harm and significant monetary motives. If in a car accident we knew one party intentionally caused the crash (and were paid for it handsomely), we’d hold them responsible, regardless what claims car companies make regarding safety.
  - hugh-avherald 3y ago
    It doesn't make sense to talk about IT safety if you exclude intentional hacking. To take your example, we do hold car companies responsible for harm from collisions with other vehicles, regardless of which driver was at fault.
  - vimax 3y ago
    That doesn’t matter. If your air bag fails to deploy after a crash, the manufacture is responsible for the product defect. It doesn’t matter if the crash was an accident or someone intentionally and specifically crashing into you, the manufacturer is responsible for a defective air bag. The manufacturer is not responsible for the crash, only the defective product. The other driver is not less responsible for a death or injury resulting from the crash. Responsibility for the crash and its consequence's rest on the driver at fault. Responsibility for a defective air bag rests on the manufacturer. They are two separate issues and not zero-sum. If someone clips your airbag wires before the crash, that is not a product defect and the manufacturer is not liable, but that is not what happened here. There was no prior access or modification to the device or software. Apple claims to have a secure phone yet has a critical zero click vulnerability similar to an earlier vulnerability they previously fixed. Pointing a finger at NSO could one day lead to some government’s action aimed at influencing another government’s actions toward a private organization. NSO doesn’t care if they’re unpopular online. Highlighting Apple’s responsibility in this is how we incentivize better security in consumer products. I don’t think companies should be responsible for every exploit all the time. Nobody is pointing fingers at ViaSat for being hacked by the Russians. There have been repeated iMeassage exploits that could be prevented with easy to implement defaults or simple opt-in settings (do not implicitly trust unknown numbers) which have been asked for after each exploit and ignored.
    - mythhabit 3y ago
      I think the main distinction is that Apple claims to have a secure phone, but not an unhackable phone. A secure vault is hard to get into, but not impossible. Should they have done something about this? I believe so, but they are not marketing themselves as secure against state actors. They have release lockdown mode, which may or may not have prevented this particular exploit. It's important to keep the demographic of iPhone users in mind. The average user do not want to be inconvenienced for security measures irrelevant to them. And if a competitor (Android) is providing a better experience, then Apple, from a business point of view, have no choice but to make the most secure system they can, while still providing the same UX. All that said, I do believe that they should implement zero trust on first contact, as a default, with the option to enable explicit trust for every attachment. I just do not believe that this will be any major impact on these actors capabilities.
internetter 3y ago
While NSO is, of course, not a good group, I think the larger problem is how prevent these exploits are. If NSO didn't find them, someone else would. I don't consider NSO to be the big problem here.
- agnosticmantis 3y ago
  Is this the standard we apply to other cyber-criminals? Or any crime for that matter? Do we ask how vulnerable the victims were? And how we should make them less vulnerable and give a free pass to the aggressors?
  - internetter 3y ago
    I'm not saying anything about the vulnerability of the victims of these attacks. I'm saying it's absurd how the trillion dollar corporation fails to protect them. NSO should be stopped, sure. But don't kid yourself — someone will take their place immediately for as long as these vulnerabilities continue to exist.
tiahura 3y ago
When Russian or NK linked groups engage in cyberterrorism, there are plenty of calls to hold those countries accountable for giving the groups cover. Why is NSO treated differently?
RetpolineDrama 3y ago
>How come NSO isn’t yet designated as a (cyber-)terrorist group worth hunting down and extinguishing? Answering this would violate HN guidelines/moderation policy.
callalex 3y ago
It is a huge stretch to take a political concept that applies to vulnerable individual humans (victim blaming) and apply that to a dominant, highly profitable corporation. Despite the big lies you have been told by American politicians, corporations are not people in any sense at all.
xwolfi 3y ago
Well in security, any open door is as much a problem as the guy opening the door. Nobody's blaming anyone, we're all programmers and we all made mistakes.
azernik 3y ago
Because it's an arms supplier to states, who use them on domestic targets. Selling tear gas rounds to tinpot dictatorships generally doesn't get you treated as a terrorist group either, just economic sanctions (which were already placed on the company by the US DoC, IIRC).

Zetice 3y ago

Because “hunting down and extinguishing” is a wild overreaction?

deleted 3y ago

[deleted]

vimax 3y ago

Apple makes security claims in a world where these types of attacks are known about and expected. They are responsible for fulfilling their own claims. If an air bag fails, you fault the manufacturer. They don’t escape responsibility by saying it’s the other drivers fault. I’ll also add that Apple is not the victim here, the targeted end users are.

agnosticmantis 3y ago
This is a false comparison. Being hacked by NSO isn’t an accident. There’s an agent involved here with clear intent to harm and significant monetary motives. If in a car accident we knew one party intentionally caused the crash (and were paid for it handsomely), we’d hold them responsible, regardless what claims car companies make regarding safety.
- hugh-avherald 3y ago
  It doesn't make sense to talk about IT safety if you exclude intentional hacking. To take your example, we do hold car companies responsible for harm from collisions with other vehicles, regardless of which driver was at fault.
- vimax 3y ago
  That doesn’t matter. If your air bag fails to deploy after a crash, the manufacture is responsible for the product defect. It doesn’t matter if the crash was an accident or someone intentionally and specifically crashing into you, the manufacturer is responsible for a defective air bag. The manufacturer is not responsible for the crash, only the defective product. The other driver is not less responsible for a death or injury resulting from the crash. Responsibility for the crash and its consequence's rest on the driver at fault. Responsibility for a defective air bag rests on the manufacturer. They are two separate issues and not zero-sum. If someone clips your airbag wires before the crash, that is not a product defect and the manufacturer is not liable, but that is not what happened here. There was no prior access or modification to the device or software. Apple claims to have a secure phone yet has a critical zero click vulnerability similar to an earlier vulnerability they previously fixed. Pointing a finger at NSO could one day lead to some government’s action aimed at influencing another government’s actions toward a private organization. NSO doesn’t care if they’re unpopular online. Highlighting Apple’s responsibility in this is how we incentivize better security in consumer products. I don’t think companies should be responsible for every exploit all the time. Nobody is pointing fingers at ViaSat for being hacked by the Russians. There have been repeated iMeassage exploits that could be prevented with easy to implement defaults or simple opt-in settings (do not implicitly trust unknown numbers) which have been asked for after each exploit and ignored.
  - mythhabit 3y ago
    I think the main distinction is that Apple claims to have a secure phone, but not an unhackable phone. A secure vault is hard to get into, but not impossible. Should they have done something about this? I believe so, but they are not marketing themselves as secure against state actors. They have release lockdown mode, which may or may not have prevented this particular exploit. It's important to keep the demographic of iPhone users in mind. The average user do not want to be inconvenienced for security measures irrelevant to them. And if a competitor (Android) is providing a better experience, then Apple, from a business point of view, have no choice but to make the most secure system they can, while still providing the same UX. All that said, I do believe that they should implement zero trust on first contact, as a default, with the option to enable explicit trust for every attachment. I just do not believe that this will be any major impact on these actors capabilities.

internetter 3y ago

While NSO is, of course, not a good group, I think the larger problem is how prevent these exploits are. If NSO didn't find them, someone else would. I don't consider NSO to be the big problem here.

agnosticmantis 3y ago
Is this the standard we apply to other cyber-criminals? Or any crime for that matter? Do we ask how vulnerable the victims were? And how we should make them less vulnerable and give a free pass to the aggressors?
- internetter 3y ago
  I'm not saying anything about the vulnerability of the victims of these attacks. I'm saying it's absurd how the trillion dollar corporation fails to protect them. NSO should be stopped, sure. But don't kid yourself — someone will take their place immediately for as long as these vulnerabilities continue to exist.

tiahura 3y ago

When Russian or NK linked groups engage in cyberterrorism, there are plenty of calls to hold those countries accountable for giving the groups cover. Why is NSO treated differently?

RetpolineDrama 3y ago

>How come NSO isn’t yet designated as a (cyber-)terrorist group worth hunting down and extinguishing? Answering this would violate HN guidelines/moderation policy.

callalex 3y ago

It is a huge stretch to take a political concept that applies to vulnerable individual humans (victim blaming) and apply that to a dominant, highly profitable corporation. Despite the big lies you have been told by American politicians, corporations are not people in any sense at all.

xwolfi 3y ago

Well in security, any open door is as much a problem as the guy opening the door. Nobody's blaming anyone, we're all programmers and we all made mistakes.

azernik 3y ago

Because it's an arms supplier to states, who use them on domestic targets. Selling tear gas rounds to tinpot dictatorships generally doesn't get you treated as a terrorist group either, just economic sanctions (which were already placed on the company by the US DoC, IIRC).