19 ms·
Meduza co-founder's phone infected with Pegasus
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- phero_cnstrcts 3y agoIs there anything that prevents Pegasus from spreading by itself or must it be installed via a targeted attack? And is there a way of scanning for it to see if a phone is infected?
- dron57 3y agoSeems that the NSO business model is based on ultra exclusivity and a very small number of business clients. Technically, Pegasus could probably retransmit itself to infect another device, but it doesn't fit their business model so I doubt NSO would do this regularly.
- SEJeff 3y agoNation states (like KSA) will likely pay very large sums of money to use this against their perceived enemies abroad. A small and exclusive clientele is how a company like this stays out of the lime light.
- marchukov 3y agoFrom what I was able to read previously, it has no ability to spread by itself and has to be installed by a targeted attack. There is also a tool from Amnesty International that can detect it (or was able to): https://github.com/mvt-project/mvt https://github.com/mvt-project/mvt It is a race though, so past info may no longer be valid. However, I doubt it will ever be able to spread by itself, since it uses very expensive zero days to infect and they will be quickly fixed after detection.
- egonschiele 3y agoYou also need to jailbreak your phone to use MVT.
- KomoD 3y agoNo you don't need to, you can
- ThePowerOfFuet 3y agoiMazing includes the functionality of MVT, no jailbreak required.
- PeterisP 3y agoThere is nothing technical that prevents Pegasus from spreading by itself, some of the reportedly involved vulnerabilities could be "wormable", however, there are practical reasons that prevent that - for malware like Pegasus, the operator has an interest to avoid uncontrolled spread, since it relies on certain undiscovered and unpatched vulnerabilities staying undiscovered and unpatched, and uncontrolled spread makes it much more likely to be discovered, analyzed and "killing the goose that lays golden eggs". So at least for now we'd expect all Pegasus installations to be a result of targeted attacks. On the other hand, if the tool leaks and becomes readily available to multiple actors, then the incentives change and one of them might decide to make a worm that infects everyone in the world who's not patched.
- ChrisMarshallNY 3y ago[flagged]
- deleted 3y ago[deleted]
- ChrisMarshallNY 3y agoHeh. I see that someone flagged my comment. I suspect that it was not because it was hurtful or destructive, but because I chose to use the national currency of Israel as the denomination (instead of dollars, which would actually be disrespectful), and someone that skipped Social Studies, thought it was being "anti-semitic." Sort of like the paediatrician in UK, that was attacked, because some idiot thought the sign outside her office meant she was a paedophile.
- m348e912 3y agoSince the type of exploit pegasus has been using has been recently seen in the wild and Apple has had to release more than one security update to address this attack vector it leads me to believe that not just targetted individuals should enable "lock down mode" on their apple devices. Although apple doesn't recommend it, it could be useful if there is a major malware outbreak across the iPhone ecosystem.
- fullspectrumdev 3y agoThere is no self propagation code built into Pegasus. It would be relatively trivial to write such - simply have it send the exploit via iMessage to all of a targets contacts, rinse and repeat. This would be counterproductive though - the whole selling point of Pegasus is targeted surveillance, and such exploits are very costly - uncontrolled spreading would make it detected much faster, burning a valuable resource. If such exploits were cheap, it’s plausible you could justify writing a variant that automatically attacks a targets entire address book to mine their social graph, but then you have the problem of analysing a shitload of probably worthless data…
- ramraj07 3y agoIf some hacker gets a clearly infectious Pegasus link they should make it spread through messages to everyone. Bricking everyone’s iPhone will probably make all the governments and Apple sit up and do some real damage to these actors.
- Veserv 3y agoMany of the Pegasus attacks are zero-click, so no link is needed. All they need to do is send you a message and you are compromised. They presumably also configure their command and control to only persist if it is one of the designated targets and wipe all traces if it is not, so even forwarding the attack payload would probably not do anything. You would need to determine you have been compromised and then reverse engineer the exploit so you could replace the command payload with a irreversible bricking operation to do what you suggest. At that point you might as well spend the $5M-$10M to develop the entire attack yourself. If you are a competitor to Apple spending $10M to completely destroy the $2.7T Apple is literal pocket change; too small to even show up on your financials.
- astrange 3y ago> If you are a competitor to Apple spending $10M to completely destroy the $2.7T Apple is literal pocket change; too small to even show up on your financials. You're comparing two near completely unrelated numbers here. That's not what enterprise value means; it doesn't mean much of anything really.
- tamimio 3y agoAFAIK, phone numbers are the entry point, it’s the easiest and quickest way to target someone with it, else, it will be more involved to isolate the target, so don’t activate any number on your phone in addition to the lockdown mode, plus the usual security precautions should be in theory enough to protect you, ultimately, don’t use a “smart” phone.
- euniceee3 3y agoPhone numbers are not targets. Baseband is the big fear vector due to it being a black box, but in reality the apps themselves are being targeted where your phone number is the primary key.
- j0hnyl 3y agoThat would burn the exploits. These are highly targeted.
- vonnik 3y agoDaily reader of Meduza here. They publish consistent and high quality coverage both about headline events in the war as well as odd ramifications of it in Russia and Ukraine. And it doesn’t have the annoying US-centrism of Ukraine coverage that you get elsewhere.
- justsomehnguy 3y ago> and high quality Nope. There were enough articles with outright lies to never believe anything from them until proven by numerous other, independent sources.
- mc32 3y agoCNN and Fox also publish proven lies or reframe things. Do we not believe anything they say as well?
- hkpack 3y agoOf course. Why you would read any source which was caught lying?
- edgyquant 3y agoI assume this is a joke? These are two news companies famous for people not believing anything they say.
- berdario 3y agoI believe they are famous for not being believed by the other side's partisans. I.e. US republicans most often won't believe CNN and US democrats most often won't believe Fox. The point here is, there are plenty of topics on which CNN and Fox coverage is very very similar: off the top of my head events in Israel and Taiwan And on those topics, plenty of people just "trust the consensus" (or what appears to be the consensus, in western media) https://www.peoplesworld.org/article/out-of-bounds-how-media-monopolies-keep-radical-ideas-off-the-agenda/ https://www.peoplesworld.org/article/out-of-bounds-how-media...
- baybal2 3y ago[flagged]
- simpleuser27 3y agoWhen I read comments like this I always wonder what the purpose is - what exactly do you want a reader to come away with? Companies did bad things until they decided it was no longer to their advantage, and stopped? And if this is the case, what does it have to do with the article, or the blame owed to the actual, literal bad actor (Putin's Russia)?
- notarget137 3y agoWell, again as I stated previously - it is hypocritical and these companies and states should be held accountable. If someone feeds the soil for the next dictator to grow and then all of a sudden there is a political crisis involving said dictator aren't you directly responsible for such crisis?
- deleted 3y ago[deleted]
- mcpackieh 3y ago> these companies and states should be held accountable. Hold the companies accountable... okay sure. I'll write some letters to my elected officials and federal prosecutors about holding Apple and Google accountable. Just one thing... which laws were they breaking? Or do you propose consumer boycotts of both Google and Apple? If your plan is for everybody to give up their smartphones, your plan is DOA. Hold the states accountable... What does it mean to hold a sovereign state accountable? Are you going to bend the US Government itself over your knee and spank it? I don't think so. What exactly do you mean by holding the state itself accountable?
- hindsightbias 3y agoAs long as you hold everyone who voted for Gerhard Schröder too. Not like these policies came out of a vacuum.
- egonschiele 3y agoI read that if Pegasus is on your phone, even a factory reset will not get rid of it. Could someone explain why?
- negus 3y agoHaven't read about Pegasus, but what you describe is the behavior of bootkits. Factory reset does not imply that you erase 100% of your permanent storage: some part of it should contain the system programs to restore the system. If these system programs or the clean OS image are modified, then factory reset won't help
- scintill76 3y agoI don’t know about the original claim either way, but I would be even more impressed and scared if it survived an iTunes restore (basically a PC reflashes the iPhone’s OS image with an image downloaded from Apple.)
- negus 3y agoIf the malware controls the bootloader nothing will help: it can imitate any kind of restore, modifying the OS image on the fly
- heywhatupboys 3y agoeverything is signed. should not be even remotely possible
- miohtama 3y agoNSO Group: We only work with legitimate governments for lawful purposes. Israel: NSO does not pose a problem, because they work only for lawful purposes.
- stef25 3y agoIt's even better - "journalists getting killed is horrible but it's due to a lack of regulations. Someone has to do the dirty work" - NSO.
- deleted 3y ago[deleted]
- GoblinSlayer 3y agoAFAIK the wording is "vetted customers".
- deleted 3y ago[deleted]
- ramraj07 3y agoWhat are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patched? Does Apple know or have a clue how bad this problem could be? Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead? It’s not clear in the article if the author had to take any action to get this program installed. If that’s not required, what should anyone who even vaguely suspects state sponsored spying do? Sounds like it’s safer to just not use a phone or try and circle through a series of them you buy second hand or something.
- georgelyon 3y agoI didn’t find any mention of Lockdown Mode in the article, which is advertised as something a user in this position could use to decrease their attack surface. I find it surprising journalists covering high-risk stories don’t just all have this on by default. A lot of these no-user-interaction exploits are via vulnerabilities in decoders for images and such that run when a message is received, unless the phone has Lockdown Mode enabled (LM also disables other types of functionality). Has anyone seen evidence of a phone with Lockdown Mode enabled being compromised (not saying it’s impossible, just curious)?
- fh9302 3y agoSo far there has not been a confirmed Pegasus infection with lockdown mode enabled. It's certainly possible but will require more sophisticated exploits, thus increasing the price per infection.
- HenryBemis 3y agoI will assume that unless the cost per infection is a staggering number, if a "baddie" wants to "get in" they wouldn't be phazed by $50k or $100k. I assume that the value of the intel collected (contacts, eavesdropping, etc.) would be far more valuable as it would reveal whistleblowers, opposition tactics, contacts, candidates to fall off windows/balconies, candidates to be chopped up, etc.
- iandanforth 3y agoNSO getting blacklisted is one of the great victories over the "Israel can do no wrong" mindset so common in Washington.
- deleted 3y ago[deleted]
- levleontiev 3y agoAlso interesting that a new “bad guy” from the Caucasus might be the actual attacker.
- deleted 3y ago[deleted]
- game_the0ry 3y agoLet's assume I am a savvy career criminal (I am not...promise). What would I want to use for counter-surveillance? I would probably go: - For desktop - Tails OS booted from USB + TOR for browser - For mobile - GrapheneOS on latest pixel device
- deleted 3y ago[deleted]
- zozbot234 3y agoThis will provide decent privacy for most people against casual mass-surveilance. But you should not assume that it's anything like sufficient protection against these kinds of state-sponsored attacks.
- game_the0ry 3y agoAssume nothing electronic/digital is safe? That's my take-away.
- Cyphase 3y agoNothing non-electronic/non-digital is safe either. They just have different tradeoffs.
- someplaceguy 3y agoStrictly speaking, even being alive is not safe.
- Un1corn 3y agoThis is absolutely not enough against targeted attacks. It will be harder to detect you but once they do, Firefox (which Tor is based on) is a lot more vulnerable than Chrome. Same for Android, the locked bootloader and such can be helpful in this situation.
- ReptileMan 3y ago
- tevon 3y agoDo we know if the phone was in lockdown mode? Anyone know how effective lockdown mode is in preventing most of these zero-days?
- fh9302 3y agoThe phone was not in lockdown mode as it would have prevented the attack. https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer... > We believe, and Apple’s Security Engineering and Architecture team has confirmed to us, that Lockdown Mode blocks this particular attack. https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/ https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-ret... > For a brief period, targets that had enabled iOS 16’s Lockdown Mode feature received real-time warnings when PWNYOURHOME exploitation was attempted against their devices. Although NSO Group may have later devised a workaround for this real-time warning, we have not seen PWNYOURHOME successfully used against any devices on which Lockdown Mode is enabled.
- pvg 3y agoThese are about different incidents though, right? Is there some other confirmation lockdown mode would have been effective in this case as well?
- fh9302 3y agoIt's the same vulnerability as in the article, PWNYOURHOME would have been avoided with lockdown mode. > Researchers believe Timchenko’s hackers used the so-called “PWNYOURHOME” vulnerability
- pvg 3y agoAh I see, thanks! Managed to miss it while ⌘-F'ing through the article for 'Citizen Lab'.
- rnk 3y agoApple should use financial means to destroy these companies. Working at these companies should be a black mark on the records of the employees. I won't hire someone who worked at one of these companies. I know probably my own government tries to hack into people's phones, I don't want that either; my govt should not be selling their capabilities to other governments. If we make working at these companies something terrible on someone's jobs record, we might prevent people from going there. Companies that do these kinds of things are a menace to society, because those tools get used for evil purposes (not just spying on terrorists). Plenty of other governments benefit from using these spy tools themselves, but we all know they fall into the hands of despotic governments like Saudi Arabia and they are used to harass and attempt to control journalists, people advocating against their governments. What I'd like to see is Apple uses their enormous influence and financial power to sue these companies and drive them out of business. They should financially attack the companies doing this and make it known they will work to destroy them.
- zozbot234 3y ago> not just spying on terrorists Ah, but what about spying on "Nazis" and "foreign influence organizations"? What's good for the goose is good for the gander.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- voldacar 3y agoIf I were apple I would seriously consider hiring hitmen or at the very least PIs to surveil everyone who works at these companies
- tonyarkles 3y agoIf I understand correctly, NSO is primarily staffed with retired or current Mossad/Israeli Sigint folks. Have fun!
- wordsarelies 3y agoHaas is still selling parts to Russia for their CNC mills even though they're sanctioned. They do it by selling to a Chinese middleman. NSO Group probably uses an Indian intermediary (my first guess) and does the same thing.
- wewxjfq 3y agoWhat makes you think they care? They don't sell their spyware to anyone who might use it against Russian officials, which tells you a lot.
- leosarev 3y agoNo, they are not selling their software specifically to the Ukraine and Baltic states. They do sell it for UK, for example. UK spies definitely actively working against Russia. By the way, Pegasus doesn't work against US phone numbers.
- deleted 3y ago[deleted]
- Moldoteck 3y agoInteresting what is the zero-day % for ubuntu touch system that can tun on fairphones. Would using it reduce the chances of being hacked?
- jeejay 3y agoHacking of fairfones would be highly unlikely simply because it is not profitable to sell these hacks.
- 1B05H1N 3y agoHow many people died over these 0-days?
- richardanaya 3y agoWas anyone else amused by the mythological significance? In Greek mythos, Pegasus spawned out of the blood of Medusa.
- 0x38B 3y agoI’ll admit I always thought ‘Meduza’ was from the Russian /meduza/, meaning jellyfish, but they did indeed mean the Greek Medusa (1): > Question - why Meduza in particular? That's a slippery, unpleasant creature > Journalists are generally unpleasant and slippery and there are few who love them - such is the job. Also "Medusa" turns its subject to stone with a glance, which is true of journalists, too. But to be completely honest, we ended up with "Meduza" by chance. We thought the paper should be named after the ancient Greek monster that had its head cut off but came alive anyway. We chose "Meduza" and then remembered that it was a hydra, but it was too late. 1: https://meduza.io/cards/zaday-vopros-meduze https://meduza.io/cards/zaday-vopros-meduze, #75
- dotancohen 3y agoThe Russian word for jellyfish comes from the Greek myth. In Russian, Medusa is spelled with a Z instead of an S (Медуза). The jellyfish is called such in Russian because the tentacles are similar to Medusa's snakes.
- yread 3y agoIt's not really uniquely russian way to call jellyfish. It's the same in French or Greek https://ukdataexplorer.com/european-translator/?word=jellyfish https://ukdataexplorer.com/european-translator/?word=jellyfi...
- zanellato19 3y agoThen portuguese is just "alive-water" lol
- logN_2 3y agoDoes the NSO find these zero days themselves or do they buy them from the black market? If more money is thrown at the people finding the vulnerabilities so they responsively disclose would it make NSO’s business model unprofitable? Sounds to me like the best approach to shutdown the NSO group is to make the economics not work out.
- berniedurfee 3y agoAt some point in the near future “phone” will be replaced with “car” in the title and the outcome will be more tragic. What’s a Tesla 0-day worth I wonder?
- TalkalotDragon 3y agomy guess, probably lesser. people carry their phones as an extension of themselves, while cars takes us from point a to b. And most modern cars have a Secure Gateway[1] that are mostly not connected to internet, that only allow limited NW access for the connected systems to rest of the vehicle (Engine, powertrain, brakes...) so the possibility of a remote scaled attack is low IMO. [1] https://blackberry.qnx.com/en/ultimate-guides/software-defined-vehicle/secure-gateway https://blackberry.qnx.com/en/ultimate-guides/software-defin...
- MagicMoonlight 3y agoReprogramming the navigation to take you to the ambush site or sending your route to mossad would be valuable. That’s without even considering the lethal options like disabling breaking, setting lane assist to swerve you into traffic etc
- tech234a 3y agoAlready happened: https://www.youtube.com/watch?v=MK0SrxBC1xs https://www.youtube.com/watch?v=MK0SrxBC1xs
- Roark66 3y agoI wonder how Apple decides who to inform and who not to when they detect malware like pegasus. Good they did inform a person in question. However, what if this person was much lower profile? Let's say a person that lives in a democratic country. Does Apple even know who targeted them? If they do, let's say "if its China or Russia" we inform. Then what if China or Russia does the exact same thing but using a paid agent in a democratic country? This raises so many questions. And finally, if Apple can detect such malware why isn't there an immediate notification from some local app? Like an anti virus for your phone. They must already have something like this, otherwise how would they know?
- saagarjha 3y ago(Disclaimer: I have no idea how this actually works.) I would guess that running this on-device would be prohibitive and they probably get told accounts and whatnot that are known to have sent the messages, then go in their server logs and check who they reached out to.
- VagabundoP 3y agoI wonder what practical measures you could take if you believed you were a target of these guys and was a journo/activist maybe: - A different device for each app (Whatsapp, Telegram, Signal, etc) - Use web front ends and keep the phone turned off - not sure if it works for all apps - Regularly ditch devices, sell them second hand and get new/used phones. - Use the devices to setup meetings in more secure environments, never say/text anything into the phone, assume its compromised at all times. And there should be some sanction against NGO, they are scumbags.
- highwaylights 3y agoThis probably isn’t a bad idea for an open-source project. Something akin to Graphene OS where there’s a constant drive to narrow the attack surfaces, but also removing any concessions related to installing apps or Google services entirely. Basically, a phone that has access to encrypted messaging and the camera/mics under very controlled circumstances and that’s about it. The restrictions would also limit the popularity enough that it would likely never be worth the cost of targeting, but also provide greater protection to the few people that really need that protection enough to make those sacrifices.
- gorbypark 3y agoI'd love a phone with a bank of iPhone style mute switches, but each hooked up physically to disable the cellular radio, gps antenna, mic, camera and etc.
- 3y ago
- jackleeb 3y agothere's a DJ named Meduza and they have a song called Pegasus. lol https://www.youtube.com/watch?v=d_1qExe2PWk https://www.youtube.com/watch?v=d_1qExe2PWk
- abhinavk 3y agoIn Greek mythology, Pegasus was the son of Medusa. You will find a lot more references based on this.
- dariosalvi78 3y ago[flagged]
- KKKKkkkk1 3y agoThat is absolutely not the implication. NSO is not the Israeli government and the identity of the attackers in this case is not known.
- dariosalvi78 3y agoPegasus is classified as a weapon and Israel is supposed to vet each contract, this has been discussed extensively here. If Russia is not the buyer in this case, then I am curious to hear suggestions about whom they could be instead.
- heikkilevanto 3y agoI have been wondering if it could be possible to make a honeypot for all the known attacks NSO has been using, and warn the user if any such are detected. I bet some of the attackers try a few exploits before they get in, and might trigger an alert. If many people had such alerts, it would draw attention to the action.
- acqq 3y ago> “I’m absolutely shocked we’re seriously discussing that a European state could have done this,” says Ivan Kolpakov, Meduza’s editor-in-chief. “I’m probably naive" Rather then naive, I think his main problem is that he hasn't investigated before the discussed event what the European states actually do in that context. Then he would be just worried, not shocked. Another possibility is that the "shocked" is the "Casablanca shocked": > Rick: How can you close me up? On what grounds? > Captain Renault: I'm shocked, shocked to find that gambling is going on in here! > [a croupier hands Renault a pile of money] > Croupier: Your winnings, sir. > Captain Renault: Oh, thank you very much.
- deleted 3y ago[deleted]
- 37469920away 3y ago[flagged]
- domatic1 3y agoApple should hire NSO secretly and patch their vulnerabilities.
- sneak 3y ago1. I am 100% sure Apple has already had this idea, and that it's not as clever and original as you think. 2. Tricking Mossad is not easy. I am fairly certain they are better at counterintelligence than Apple, even if Apple is getting coached. 3. Trick Mossad at your own risk.
- sanroot99 3y agoCan't these attacks could be detected with a personal deep packet inspector running at router level, or a simple packet capturer?, another simple solution could be a diy portable router with inbuilt dpi or network analyser
- kramerger 3y agoI don't think they disclose that, but if they did it's probably somewhere in this document https://citizenlab.ca/wp-content/uploads/2020/11/Annotated-Bibliography-Network-Traffic-Management-and-Device-Intrusion-for-Targeted-Monitoring.pdf https://citizenlab.ca/wp-content/uploads/2020/11/Annotated-B...
- Nellyz 3y ago[dead]