9 ms·

> What are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patche

> What are the odds that NSO has like 20 other zero-days in their arsenal each set ready to deploy the day the current vulnerabilities are discovered and patched? I feel it's the safe money, certainly. One exploit dev in a given year can churn out multiple weaponized 0 days, surely they have more than one dev working on such things, so you're talking about a stockpile of likely dozens of vulns. Some might collide with public vulns so they lose a few, but you knock one down and I have to assume they have others staged. > Apple is rich enough to increase their bounties large enough to attract them to right side instead? That's a good question. I think at NSO's price point the answer is probably "no", but I don't know. At best Apple could be competitive, but bug bounty work is far riskier - you might spend a long time without getting a payout, either due to some bad luck, collisions with already reported vulns, or a vendor just being a dick (pretty sure Apple have been dicks). > what should anyone who even vaguely suspects state sponsored spying do? Probably have more than one phone, for starters. Use authenticated protocols, not SMS/MMS. It's insane that anyone can just send data to your phone unprompted. I'd probably disable cell service altogether unless I'm actively making an outbound call to a known contact.

wayfinder 3y ago
The only way Apple could make them report the vulnerability is if the bounty was not far from the amount of profit that NSO is making with their software.
- devmor 3y ago
  The comment is not suggesting that Apple make the vulnerability attractive to report for the NSO as an organization, but presumably attractive to report for whatever hackers the NSO may purchase vulnerabilities from - or individuals employed by the NSO. In such a case, Apple "only" needs to make the bounty high enough to significantly exceed the sale price of the vuln, or the salary of aforementioned employees.
  - wayfinder 3y ago
    Yeah you're right. For some reason I was thinking only NSO had these zero-days, which is not possible.
  - fomine3 3y ago
    For who had already sold a vuln to a criminal org like NSO once, I wonder will they switch to clean Apple. Perhaps they get more chance to be investigated, or not?.
- Muromec 3y ago
  > The only way Apple could make them report the vulnerability is if the bounty was not far from the amount of profit that NSO is making with their software. At which point it becomes cheaper to buy a law to force disclosure of those 0 days to vendor?
andersa 3y ago
Why is it on Apple to defend everyone against hackers sponsored by another country to begin with? The governments should be providing any resources necessary to defend here...
- zozbot234 3y ago
  Because Apple makes the phones, silly. The iPhone is a 100% proprietary device, we know zilch about what code is running on it. Why should anyone be responsible besides the manufacturer? Maybe the government should care about the Obamaphone, but not anything beyond that.
  - kube-system 3y ago
    Close to 100% but not quite. It has some open source components.
  - saagarjha 3y ago
    NSO Group seems to know quite a bit about what code is running on it.
  - austhrow743 3y ago
    If an Israeli hit squad kills someone in a McDonalds, we dont get on McDonalds case for not providing a safe and secure place for their customers. Not putting up a sign when the floor is wet is on them. Assassins is on the government. It's not clear to me why things being different in the software world is so obvious that not seeing why is silly. Regarding Obamaphone, in the US there is a government agency responsible for such things. The NSA. It's tasked with securing US information infrastructure on top of its more known role of signals intelligence. It just happens to favour the latter over the former so its not about to share its stockpile of iPhone zero days with Apple.
    - ameister14 3y ago
      If McDonald's advertised their hamburgers as especially safe from outside influence and you are assassinated by someone poisoning your McDonald's hamburger, people will probably be upset at McDonald's.
Infernal 3y ago
> Use authenticated protocols, not SMS/MMS. It's insane that anyone can just send data to your phone unprompted. I'd probably disable cell service altogether unless I'm actively making an outbound call to a known contact I was just listening to Darknet Diaries episode 100 this past weekend and they mentioned an NSO-crafted zero-click vulnerability in Whatsapp that Citizen Lab had detected being exploited. Though I suppose Whatsapp (anyone with my phone number can message me) wouldn’t qualify as an authenticated protocol.
- insanitybit 3y ago
  At least, or I think, in Whatsapp it's possible to block unsolicited messages. Or to hide the message until you accept it.

wayfinder 3y ago

The only way Apple could make them report the vulnerability is if the bounty was not far from the amount of profit that NSO is making with their software.

devmor 3y ago
The comment is not suggesting that Apple make the vulnerability attractive to report for the NSO as an organization, but presumably attractive to report for whatever hackers the NSO may purchase vulnerabilities from - or individuals employed by the NSO. In such a case, Apple "only" needs to make the bounty high enough to significantly exceed the sale price of the vuln, or the salary of aforementioned employees.
- wayfinder 3y ago
  Yeah you're right. For some reason I was thinking only NSO had these zero-days, which is not possible.
- fomine3 3y ago
  For who had already sold a vuln to a criminal org like NSO once, I wonder will they switch to clean Apple. Perhaps they get more chance to be investigated, or not?.
Muromec 3y ago
> The only way Apple could make them report the vulnerability is if the bounty was not far from the amount of profit that NSO is making with their software. At which point it becomes cheaper to buy a law to force disclosure of those 0 days to vendor?

andersa 3y ago

Why is it on Apple to defend everyone against hackers sponsored by another country to begin with? The governments should be providing any resources necessary to defend here...

zozbot234 3y ago
Because Apple makes the phones, silly. The iPhone is a 100% proprietary device, we know zilch about what code is running on it. Why should anyone be responsible besides the manufacturer? Maybe the government should care about the Obamaphone, but not anything beyond that.
- kube-system 3y ago
  Close to 100% but not quite. It has some open source components.
- saagarjha 3y ago
  NSO Group seems to know quite a bit about what code is running on it.
- austhrow743 3y ago
  If an Israeli hit squad kills someone in a McDonalds, we dont get on McDonalds case for not providing a safe and secure place for their customers. Not putting up a sign when the floor is wet is on them. Assassins is on the government. It's not clear to me why things being different in the software world is so obvious that not seeing why is silly. Regarding Obamaphone, in the US there is a government agency responsible for such things. The NSA. It's tasked with securing US information infrastructure on top of its more known role of signals intelligence. It just happens to favour the latter over the former so its not about to share its stockpile of iPhone zero days with Apple.
  - ameister14 3y ago
    If McDonald's advertised their hamburgers as especially safe from outside influence and you are assassinated by someone poisoning your McDonald's hamburger, people will probably be upset at McDonald's.

Infernal 3y ago

> Use authenticated protocols, not SMS/MMS. It's insane that anyone can just send data to your phone unprompted. I'd probably disable cell service altogether unless I'm actively making an outbound call to a known contact I was just listening to Darknet Diaries episode 100 this past weekend and they mentioned an NSO-crafted zero-click vulnerability in Whatsapp that Citizen Lab had detected being exploited. Though I suppose Whatsapp (anyone with my phone number can message me) wouldn’t qualify as an authenticated protocol.

insanitybit 3y ago
At least, or I think, in Whatsapp it's possible to block unsolicited messages. Or to hide the message until you accept it.