11 ms·

What are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patched?

What are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patched? Does Apple know or have a clue how bad this problem could be? Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead? It’s not clear in the article if the author had to take any action to get this program installed. If that’s not required, what should anyone who even vaguely suspects state sponsored spying do? Sounds like it’s safer to just not use a phone or try and circle through a series of them you buy second hand or something.

georgelyon 3y ago
I didn’t find any mention of Lockdown Mode in the article, which is advertised as something a user in this position could use to decrease their attack surface. I find it surprising journalists covering high-risk stories don’t just all have this on by default. A lot of these no-user-interaction exploits are via vulnerabilities in decoders for images and such that run when a message is received, unless the phone has Lockdown Mode enabled (LM also disables other types of functionality). Has anyone seen evidence of a phone with Lockdown Mode enabled being compromised (not saying it’s impossible, just curious)?
- fh9302 3y ago
  So far there has not been a confirmed Pegasus infection with lockdown mode enabled. It's certainly possible but will require more sophisticated exploits, thus increasing the price per infection.
  - HenryBemis 3y ago
    I will assume that unless the cost per infection is a staggering number, if a "baddie" wants to "get in" they wouldn't be phazed by $50k or $100k. I assume that the value of the intel collected (contacts, eavesdropping, etc.) would be far more valuable as it would reveal whistleblowers, opposition tactics, contacts, candidates to fall off windows/balconies, candidates to be chopped up, etc.
    - H8crilA 3y ago
      0-click 0-day costs more like $2M (from other comments and links in this thread).
      - saagarjha 3y ago
        That’s how much an exploit sells for. That isn’t the cost an infection.
insanitybit 3y ago
> What are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patched? I feel it's the safe money, certainly. One exploit dev in a given year can churn out multiple weaponized 0 days, surely they have more than one dev working on such things, so you're talking about a stockpile of likely dozens of vulns. Some might collide with public vulns so they lose a few, but you knock one down and I have to assume they have others staged. > Apple is rich enough to increase their bounties large enough to attract them to right side instead? That's a good question. I think at NSO's price point the answer is probably "no", but I don't know. At best Apple could be competitive, but bug bounty work is far riskier - you might spend a long time without getting a payout, either due to some bad luck, collisions with already reported vulns, or a vendor just being a dick (pretty sure Apple have been dicks). > what should anyone who even vaguely suspects state sponsored spying do? Probably have more than one phone, for starters. Use authenticated protocols, not SMS/MMS. It's insane that anyone can just send data to your phone unprompted. I'd probably disable cell service altogether unless I'm actively making an outbound call to a known contact.
- wayfinder 3y ago
  The only way Apple could make them report the vulnerability is if the bounty was not far from the amount of profit that NSO is making with their software.
  - devmor 3y ago
    The comment is not suggesting that Apple make the vulnerability attractive to report for the NSO as an organization, but presumably attractive to report for whatever hackers the NSO may purchase vulnerabilities from - or individuals employed by the NSO. In such a case, Apple "only" needs to make the bounty high enough to significantly exceed the sale price of the vuln, or the salary of aforementioned employees.
    - wayfinder 3y ago
      Yeah you're right. For some reason I was thinking only NSO had these zero-days, which is not possible.
stef25 3y ago
> Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead? TL;DR, Apple probably doesn't care enough You're in a very exclusive club if you're targeted by NSO (ie. very few people are victims) and most of the general public probably doesn't understand or care enough to get their pitch forks out. Personally if I was anywhere near being a possible NSO target I'd dump all my devices or at least have them fully airgapped, the only way you'll win that fight.
- devmor 3y ago
  >Personally if I was anywhere near being a possible NSO target I'd dump all my devices or at least have them fully airgapped, the only way you'll win that fight. You still wouldn't win that fight without applying those rules to everyone you come in contact with. And even then, the absence of such data could create a pattern enough to identify parts of your life if they have enough data from people that are not around you. Escaping surveillance from bad actors is essentially no longer a winnable fight. you can only do your best to mitigate it.
- zozbot234 3y ago
  > You're in a very exclusive club if you're targeted by NSO (ie. very few people are victims) That's a dangerous assumption. We only know about the victims who are clueful enough about OPSEC to even be informed about the issue, let alone find out about an attack.
  - saagarjha 3y ago
    We do know it’s somewhat expensive to target people.
  - numpad0 3y ago
    It's hard to make yourself a target to highly qualified subgroups of intelligence people, for reasons rightful or not. Simply committing or conspiring for crimes with e.g. extremist terrorist groups won't do that(not recommending to do so, obviously).
Veserv 3y ago
They probably have around 3-10 other zero-click zero days on hand. And if NSO somehow burns all of their in-house production, the vulnerability brokers I know have a couple tens ready for usage in their inventory for a few million dollars each. This is not even private knowledge; the brokers run legal US incorporated businesses that sell to governments, businesses, and the vendors who make the insecure products such as Microsoft and Apple. Apple knows for a fact that they are delivering products with tens to hundreds of known critical security defects. Apple does not buy out the zero-days for two reasons: First, you can not buy your way to security. Second, the benefits do not outweigh the costs. For the first point, it is impossible to buy your way to serious security. Apple currently pays a $1M bounty for a zero-click RCE with persistence [1] and $2M to do the same to Lockdown Mode, around the cost of a single Tomahawk cruise missile. They set this price because it takes around 1-3 engineer-years to find such a security defect, so the bounty is approximately the cost of labor. If they paid $10M, around the cost of a single M1 Abrams tank, they would get a absolute flood of new reports since suddenly the ROI is 10x and the number of security defects detectable at the $10M level is vastly more than at the $1M level. However, to deter countries, you need to get to at least the $100M level, the cost of a single F-16. At the few million dollar level there are already tens to hundreds of known security defects, so at the $100M level there are almost certainly thousands to tens of thousands of vulnerabilities. So, to buy their way to protection against state-funded attackers would cost them trillions to tens of trillions of dollars, if it is even possible at all. Note that literally nobody has ever gotten past the few million dollar range using this strategy, or frankly using any strategy when attempting to retrofit a system not designed for security like iOS or Windows. For the second point, what does Apple gain by buying the zero-days? People keep buying iPhones no matter how many thousands of security defects get reported. All they have to do is make up new bullshit like Lockdown mode and everybody feels warm and fuzzy inside. The company, that has never once made a product within a factor of 100x of what is needed to protect against state-funded attackers, just makes up a marketing spiel about how they are "totally going to do it this time for sure, pay no attention to our record exclusively consisting of hundreds of failures" and everybody eats it up. We know they do not believe their own marketing fluff because they set the bounty for lockdown mode at $2M, only double the $1M for regular iOS, which is still only 1/5 of a single tank. Do you think a single state-funded attackers will be dissuaded by the price of a fractional tank? It costs more money to start a new McDonalds store. All the companies like Apple, Microsoft, Amazon, Google, Cisco, Crowdstrike, etc. need to do is lie and for some reason everybody keeps believing them for the thousandth time and their sales are protected. Commercial IT systems are completely and utterly insecure against attacks by moderately funded attackers. If you have operations worth more than $1M or are at the risk of targeted attacks, you are completely, 100%, vulnerable no matter what or how many of these systems you use. If that is not acceptable, then you must not use standard commercial IT systems with connectivity. That is, unfortunately, the only solution that currently works. It is up to you if you think the tradeoff is worth it. [1] https://security.apple.com/bounty/categories/ https://security.apple.com/bounty/categories/
shmatt 3y ago
This comment pretty much dissects/explains NSO in the best terms ive seen in HN before. "Pegasus" is not one hacking entity like most articles make it out to be. Its 1) A bunch of services that download data, given root access to a phone 2) a bank of 0-days, we don't know how deep. For all we know, there are times when "Pegasus" doesn't work for hours, days, weeks, until the 0-day is rotated. We do know from some leaks that they have a mix of non-click and click exploits, and also support all different kinds of phone OS. Their hacking abilities are definitely overstated, for all we know, for smooth continuous customer support, they could be buying 100% of their 0-days, and not finding any themselves. A 0-click 0-day for iPhones is worth about $2,000,000[1], a company with contracts like NSO can afford a lot of those. IMO the media portraying them as super-hackers is pure hype. Its a bunch of crooked business people who figured out how to extract money out of countries [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...
- sugarpile 3y ago
  An extension to the link [1] above is: the price NSO pays for android zero click is higher than the price they pay foriPhone zero click exploits. This implies they do indeed a catalog of iOS exploits stashed.
  - civilitty 3y ago
    It doesn't really imply anything because iPhone's global market share is less than 30% with customers concentrated in North America and China, both danger zones for NSO operations. Android exploits might also take far longer to patch across all vendors and users might take longer to update compared to iOS. It's fairly probable that iPhone exploits are just less valuable to a shady intel operation that sells mostly to small authoritarian regimes.
    - henry2023 3y ago
      Your comment is not considering that these governments are more likely to target politicians and journalists which are more likely to use iPhone regardless of where they are located. I don’t know if the implication that iPhone is less secure holds but it’s likely.
aaron695 3y ago
[dead]
rjvs 3y ago
> what should anyone who even vaguely suspects state sponsored spying do? They should keep their phone in Lockdown mode [1]. It's less useful as a computer in that case but the restrictions reduce the attack surface. 1. https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650
chaosbolt 3y ago
>What are the odds... Almost zero, if China with 1.5 billion people, unlimited money and lots of motivation couldn't hack into iOS then there is no way Israel can do it Multiple times... Just think about it... It would be a lot easier to just believe Apple gave backdoor access to the Israeli intelligence, it would explain why Europe is at their throat recently after Israel sold Pegasus to Morocco who used it to spy on French journalists and politicians which led to Morocco recognizing Israel and the US recognizing the western sahara and putting an embassy there, now those waters (between the canary islands and morocco) aren't the EU's but are shared with Morocco aka the US, and it all happened after discovering that mineral rich mountain (mount Tropic) that has lots of minerals used in battery manufactoring. That's just my tinfoily theory for the day... I don't believe all of it but I don't disregard that possibility...
rootsudo 3y ago
"Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead?" You assume it's just money and not poltical idealogy or "because I can, when I can."
ranndino 3y ago
In the email I got from them she says she didn't have to take any action for this crap to be installed on her iPhone.
mptest 3y ago
>Sounds like it’s safer to just not use a phone or try and circle through a series of them you buy second hand or something. the book Pegasus by laurent richard chronicles the challenges the journalists who brought us the pegasus leaked list with 50k + targets had to go through. Anyone who has grown cynical to journalism over time will be humbled by the death and terror that journalists endure to challenge regimes like SA or morocco. Pegasus was on jamal Kashoggi and his mistress(? iirc) phones.
- jona-f 3y ago
  Can you please put a little bit more effort in your writing. The broken punctuation and capitalization make it rather hard to parse.
MagicMoonlight 3y ago
As soon as you use it, people will find it. So they might have tons of fun toys available but only for very wealthy clients.
ghostpepper 3y ago
One problem I've heard about Apple offering similar bounties is that it creates a conflict of interest for their employees.
nymalt 3y ago
> Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead? Apple is a commercial organisation with a sole purpose of generating profit. And the bounties are at their equilibrium points already (or at least supposed to be). Apple is rich enough sure, but they will only spend money if this makes Apple even richer.

georgelyon 3y ago

I didn’t find any mention of Lockdown Mode in the article, which is advertised as something a user in this position could use to decrease their attack surface. I find it surprising journalists covering high-risk stories don’t just all have this on by default. A lot of these no-user-interaction exploits are via vulnerabilities in decoders for images and such that run when a message is received, unless the phone has Lockdown Mode enabled (LM also disables other types of functionality). Has anyone seen evidence of a phone with Lockdown Mode enabled being compromised (not saying it’s impossible, just curious)?

fh9302 3y ago
So far there has not been a confirmed Pegasus infection with lockdown mode enabled. It's certainly possible but will require more sophisticated exploits, thus increasing the price per infection.
- HenryBemis 3y ago
  I will assume that unless the cost per infection is a staggering number, if a "baddie" wants to "get in" they wouldn't be phazed by $50k or $100k. I assume that the value of the intel collected (contacts, eavesdropping, etc.) would be far more valuable as it would reveal whistleblowers, opposition tactics, contacts, candidates to fall off windows/balconies, candidates to be chopped up, etc.
  - H8crilA 3y ago
    0-click 0-day costs more like $2M (from other comments and links in this thread).
    - saagarjha 3y ago
      That’s how much an exploit sells for. That isn’t the cost an infection.

insanitybit 3y ago

> What are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patched? I feel it's the safe money, certainly. One exploit dev in a given year can churn out multiple weaponized 0 days, surely they have more than one dev working on such things, so you're talking about a stockpile of likely dozens of vulns. Some might collide with public vulns so they lose a few, but you knock one down and I have to assume they have others staged. > Apple is rich enough to increase their bounties large enough to attract them to right side instead? That's a good question. I think at NSO's price point the answer is probably "no", but I don't know. At best Apple could be competitive, but bug bounty work is far riskier - you might spend a long time without getting a payout, either due to some bad luck, collisions with already reported vulns, or a vendor just being a dick (pretty sure Apple have been dicks). > what should anyone who even vaguely suspects state sponsored spying do? Probably have more than one phone, for starters. Use authenticated protocols, not SMS/MMS. It's insane that anyone can just send data to your phone unprompted. I'd probably disable cell service altogether unless I'm actively making an outbound call to a known contact.

wayfinder 3y ago
The only way Apple could make them report the vulnerability is if the bounty was not far from the amount of profit that NSO is making with their software.
- devmor 3y ago
  The comment is not suggesting that Apple make the vulnerability attractive to report for the NSO as an organization, but presumably attractive to report for whatever hackers the NSO may purchase vulnerabilities from - or individuals employed by the NSO. In such a case, Apple "only" needs to make the bounty high enough to significantly exceed the sale price of the vuln, or the salary of aforementioned employees.
  - wayfinder 3y ago
    Yeah you're right. For some reason I was thinking only NSO had these zero-days, which is not possible.

stef25 3y ago

> Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead? TL;DR, Apple probably doesn't care enough You're in a very exclusive club if you're targeted by NSO (ie. very few people are victims) and most of the general public probably doesn't understand or care enough to get their pitch forks out. Personally if I was anywhere near being a possible NSO target I'd dump all my devices or at least have them fully airgapped, the only way you'll win that fight.

devmor 3y ago
>Personally if I was anywhere near being a possible NSO target I'd dump all my devices or at least have them fully airgapped, the only way you'll win that fight. You still wouldn't win that fight without applying those rules to everyone you come in contact with. And even then, the absence of such data could create a pattern enough to identify parts of your life if they have enough data from people that are not around you. Escaping surveillance from bad actors is essentially no longer a winnable fight. you can only do your best to mitigate it.
zozbot234 3y ago
> You're in a very exclusive club if you're targeted by NSO (ie. very few people are victims) That's a dangerous assumption. We only know about the victims who are clueful enough about OPSEC to even be informed about the issue, let alone find out about an attack.
- saagarjha 3y ago
  We do know it’s somewhat expensive to target people.
- numpad0 3y ago
  It's hard to make yourself a target to highly qualified subgroups of intelligence people, for reasons rightful or not. Simply committing or conspiring for crimes with e.g. extremist terrorist groups won't do that(not recommending to do so, obviously).

Veserv 3y ago

They probably have around 3-10 other zero-click zero days on hand. And if NSO somehow burns all of their in-house production, the vulnerability brokers I know have a couple tens ready for usage in their inventory for a few million dollars each. This is not even private knowledge; the brokers run legal US incorporated businesses that sell to governments, businesses, and the vendors who make the insecure products such as Microsoft and Apple. Apple knows for a fact that they are delivering products with tens to hundreds of known critical security defects. Apple does not buy out the zero-days for two reasons: First, you can not buy your way to security. Second, the benefits do not outweigh the costs. For the first point, it is impossible to buy your way to serious security. Apple currently pays a $1M bounty for a zero-click RCE with persistence [1] and $2M to do the same to Lockdown Mode, around the cost of a single Tomahawk cruise missile. They set this price because it takes around 1-3 engineer-years to find such a security defect, so the bounty is approximately the cost of labor. If they paid $10M, around the cost of a single M1 Abrams tank, they would get a absolute flood of new reports since suddenly the ROI is 10x and the number of security defects detectable at the $10M level is vastly more than at the $1M level. However, to deter countries, you need to get to at least the $100M level, the cost of a single F-16. At the few million dollar level there are already tens to hundreds of known security defects, so at the $100M level there are almost certainly thousands to tens of thousands of vulnerabilities. So, to buy their way to protection against state-funded attackers would cost them trillions to tens of trillions of dollars, if it is even possible at all. Note that literally nobody has ever gotten past the few million dollar range using this strategy, or frankly using any strategy when attempting to retrofit a system not designed for security like iOS or Windows. For the second point, what does Apple gain by buying the zero-days? People keep buying iPhones no matter how many thousands of security defects get reported. All they have to do is make up new bullshit like Lockdown mode and everybody feels warm and fuzzy inside. The company, that has never once made a product within a factor of 100x of what is needed to protect against state-funded attackers, just makes up a marketing spiel about how they are "totally going to do it this time for sure, pay no attention to our record exclusively consisting of hundreds of failures" and everybody eats it up. We know they do not believe their own marketing fluff because they set the bounty for lockdown mode at $2M, only double the $1M for regular iOS, which is still only 1/5 of a single tank. Do you think a single state-funded attackers will be dissuaded by the price of a fractional tank? It costs more money to start a new McDonalds store. All the companies like Apple, Microsoft, Amazon, Google, Cisco, Crowdstrike, etc. need to do is lie and for some reason everybody keeps believing them for the thousandth time and their sales are protected. Commercial IT systems are completely and utterly insecure against attacks by moderately funded attackers. If you have operations worth more than $1M or are at the risk of targeted attacks, you are completely, 100%, vulnerable no matter what or how many of these systems you use. If that is not acceptable, then you must not use standard commercial IT systems with connectivity. That is, unfortunately, the only solution that currently works. It is up to you if you think the tradeoff is worth it. [1] https://security.apple.com/bounty/categories/ https://security.apple.com/bounty/categories/

shmatt 3y ago

This comment pretty much dissects/explains NSO in the best terms ive seen in HN before. "Pegasus" is not one hacking entity like most articles make it out to be. Its 1) A bunch of services that download data, given root access to a phone 2) a bank of 0-days, we don't know how deep. For all we know, there are times when "Pegasus" doesn't work for hours, days, weeks, until the 0-day is rotated. We do know from some leaks that they have a mix of non-click and click exploits, and also support all different kinds of phone OS. Their hacking abilities are definitely overstated, for all we know, for smooth continuous customer support, they could be buying 100% of their 0-days, and not finding any themselves. A 0-click 0-day for iPhones is worth about $2,000,000[1], a company with contracts like NSO can afford a lot of those. IMO the media portraying them as super-hackers is pure hype. Its a bunch of crooked business people who figured out how to extract money out of countries [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...

sugarpile 3y ago
An extension to the link [1] above is: the price NSO pays for android zero click is higher than the price they pay foriPhone zero click exploits. This implies they do indeed a catalog of iOS exploits stashed.
- civilitty 3y ago
  It doesn't really imply anything because iPhone's global market share is less than 30% with customers concentrated in North America and China, both danger zones for NSO operations. Android exploits might also take far longer to patch across all vendors and users might take longer to update compared to iOS. It's fairly probable that iPhone exploits are just less valuable to a shady intel operation that sells mostly to small authoritarian regimes.
  - henry2023 3y ago
    Your comment is not considering that these governments are more likely to target politicians and journalists which are more likely to use iPhone regardless of where they are located. I don’t know if the implication that iPhone is less secure holds but it’s likely.

aaron695 3y ago

[dead]

rjvs 3y ago

> what should anyone who even vaguely suspects state sponsored spying do? They should keep their phone in Lockdown mode [1]. It's less useful as a computer in that case but the restrictions reduce the attack surface. 1. https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650

chaosbolt 3y ago

>What are the odds... Almost zero, if China with 1.5 billion people, unlimited money and lots of motivation couldn't hack into iOS then there is no way Israel can do it Multiple times... Just think about it... It would be a lot easier to just believe Apple gave backdoor access to the Israeli intelligence, it would explain why Europe is at their throat recently after Israel sold Pegasus to Morocco who used it to spy on French journalists and politicians which led to Morocco recognizing Israel and the US recognizing the western sahara and putting an embassy there, now those waters (between the canary islands and morocco) aren't the EU's but are shared with Morocco aka the US, and it all happened after discovering that mineral rich mountain (mount Tropic) that has lots of minerals used in battery manufactoring. That's just my tinfoily theory for the day... I don't believe all of it but I don't disregard that possibility...

rootsudo 3y ago

"Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead?" You assume it's just money and not poltical idealogy or "because I can, when I can."

ranndino 3y ago

In the email I got from them she says she didn't have to take any action for this crap to be installed on her iPhone.

mptest 3y ago

>Sounds like it’s safer to just not use a phone or try and circle through a series of them you buy second hand or something. the book Pegasus by laurent richard chronicles the challenges the journalists who brought us the pegasus leaked list with 50k + targets had to go through. Anyone who has grown cynical to journalism over time will be humbled by the death and terror that journalists endure to challenge regimes like SA or morocco. Pegasus was on jamal Kashoggi and his mistress(? iirc) phones.

jona-f 3y ago
Can you please put a little bit more effort in your writing. The broken punctuation and capitalization make it rather hard to parse.

MagicMoonlight 3y ago

As soon as you use it, people will find it. So they might have tons of fun toys available but only for very wealthy clients.

ghostpepper 3y ago

One problem I've heard about Apple offering similar bounties is that it creates a conflict of interest for their employees.

nymalt 3y ago

> Surely whatever money these guys spend buying these zero-days, Apple is rich enough to increase their bounties large enough to attract them to right side instead? Apple is a commercial organisation with a sole purpose of generating profit. And the bounties are at their equilibrium points already (or at least supposed to be). Apple is rich enough sure, but they will only spend money if this makes Apple even richer.