8 ms·
WhatsApp forces Pegasus spyware maker to share its secret code
- licheness 3y ago[flagged]
- rdtsc 3y ago> Initially, the NSO sought to block all discovery in the lawsuit, "due to various US and Israeli restrictions," but that blanket request was denied. Interesting approach. The court could probably care less about Israeli restrictions as it's a different country. Officially US govt blacklisted Pegasus https://arstechnica.com/tech-policy/2021/11/us-blacklists-maker-of-pegasus-spyware-that-helps-governments-spy-on-activists https://arstechnica.com/tech-policy/2021/11/us-blacklists-ma.... However, I wouldn't be surprised if some US spy agencies are still using it. If that's the case, Pegasus might try asking US intel agencies to block the case on the basis of disclose of classified info or harming national interests. It would be interesting to see if all of the sudden "something happens" and the case is mysteriously dropped.
- ethbr1 3y agoI doubt US spy agencies still use it in any official capacity. Far easier to just request and obtain the resulting intelligence from partner intelligence organizations who are using it. Arms-length collection is less legally perilous. But which does bode poorly for any assertion of national security in US courts! "Are you using this software?" "Officially, no." "Then on what basis do you claim national security?"
- cheeze 3y agoI don't know much in this space, but if I'm the US Gov I'm happy that all of the attention is on Pegasus and not other (presumably) tens (hundreds) of similar programs out there.
- AniseAbyss 3y ago[dead]
- gsk22 3y agoThanks to the FISA "court" system, I doubt US spy agencies fear any legal reprecussions. No need to follow the law if you have a secret court where no one has standing to challenge your actions.
- ethbr1 3y agoOmnipotent and yet completely legally-neutered FISA is a lazy excuse to avoid thinking about things. There are no illuminati. There are powerful institutions, who nonetheless fear other powerful institutions. In this case, intelligence preferring to remain out of the courts and newspapers.
- staplers 3y agoThere are no illuminati. Interesting psyops to conflate corruption with "illuminati"..
- mardifoufs 3y agoWho said anything about illuminatis? Does FISA effectively allow intelligence agencies to hide stuff or not? And can you show me a concrete example of IA actually getting punished from other powerful institutions in any meaningful way?
- ethbr1 3y agoFISA allows them to conduct it legally. It doesn't have anything to do with hiding. Before FISA, they generally just did it, without asking anyone. And press reports on intelligence operations led directly to the Church/Pike Committees, which led to EO 11905/12036.
- mardifoufs 3y agoWho exactly was punished by that EO? You are proving my point, even the most "push back" IAs have seen in terms of concrete actions against them led to... a directive that forbid them from murdering people in foreign countries. No actual consequences for anyone involved, no one got even a slap on the wrist in terms of actual consequences. And that's after the church committee, which revealed some super damning stuff. Oh, and they went back to doing it after a few decades.
- rvba 3y ago> Far easier to just request and obtain the resulting intelligence from partner intelligence organizations who are using it. Couldnt they ask to spy on a phone owned by them to try to learn how the phones are infected?
- dkjaudyeqooe 3y agoWhat's "interesting" is that they claim protection available to governments, as if they speak and act on behalf of those governments.
- rdtsc 3y agoExactly, that's pretty odd. They could be delusional, just bluffing, or they really expect someone from the US government to put their finger on the scales for them, or make the scale disappear altogether.
- pvo50555 3y agocouldn't* care less
- libraryofbabel 3y agoMuch as it may pain you, “could care less” is an established idiom in American English that’s been in use for 70 years, and Webster’s dictionary has a whole page about it: https://www.merriam-webster.com/grammar/could-couldnt-care-less https://www.merriam-webster.com/grammar/could-couldnt-care-l..., in which they say: > people who go through life expecting informal variant idioms in English to behave logically are setting themselves up for a lifetime of hurt.
- SturgeonsLaw 3y agoI couldn't care less if there's a group of people misusing the phrase, logically "I could care less" means the exact opposite of "I couldn't care less". The majority of the world is not American, and presumably the majority of Americans don't use the incorrect phrase, so why should the rest of the world cater for a minority within a minority by putting their butchered phrase on equal footing with the correct phrase?
- skyyler 3y agoBecause you knew what they meant and trying to correct them only serves to make you feel good about your own knowledge. You aren't helping anyone when you correct them on this.
- deleted 3y ago[deleted]
- saagarjha 3y agoI would be very surprised if they were. Sanctions are no joke and there are plenty of Five Eye-aligned shops with similar capabilities.
- ignoramous 3y agoYep, here's TAG's (Threat Analysis Group) recent report on Commercial Surveillance Vendors (CSVs) making millions with SaaS-like business models: https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors_-_TAG_report.pdf https://storage.googleapis.com/gweb-uniblog-publish-prod/doc... Apparently, the social & political elites worldwide are tripping themselves over to purchase licenses from these CSVs that cost millions.
- bradleyjg 3y agoIt would be interesting to see if all of the sudden "something happens" and the case is mysteriously dropped. Conspiracy theories notwithstanding you’d see a sealed court filing and not “something happens.”
- qingcharles 3y agoRight. I don't know that I've ever just seen a case vanish from a docketing system like that...!
- lupire 3y agoIs this a new precedent, that "legal" hackers that operate in two countries can be forced to divulge their vulns?
- SturgeonsLaw 3y agoI hope so, the fact that attackers can hide behind international borders is an eternal thorn in the side of us blue teamers. Anyone who commits a crime in another country should be subject to that country seeking legal redress.
- bluGill 3y agoThat is typically the case. If you commit a crime and flee to a different country, where you go will arrest you and turn you over to the country that you did the crime in. there are many treaties on this. It gets complex, some countries will not turn criminals over if the death pentalty is would be used for example. However in general if you commit a crime you can't flee to a different country. countries like north Korea and Russia are exceptions. Which is why malware so often comes from them. Anyone else and you are likely to be caught.
- andyferris 3y agoThe one that gets me is when someone does something on the internet that is legal in their country, but not in another, and the other tries to extradite and charge the person as a criminal. If I run an Internet-facing server, where is it deemed to be? Everywhere?
- sjy 3y agoThat generally doesn’t happen. https://en.wikipedia.org/wiki/Double_criminality https://en.wikipedia.org/wiki/Double_criminality
- rangestransform 3y agoIf an extradition treaty would mean recognizing the judgments of Russian kangaroo courts in the US, I’d rather not
- cedws 3y agoI don't understand why the NSO Group, and by extension Israel, has not been sanctioned over this spyware. It's a dangerous company that sells tools ripe for abuse to some of the West's worst anti-democractic enemies.
- devwastaken 3y agoPeace and "defense" are marketing. Eisenhower warned of the military industrial complex and it's growing power. It's mainly not "the wests" enemies contracting NSO, it is the west.
- FactKnower69 3y ago-1 because this comment made me feel bad. The US and its client states have never done anything to deserve this reputation, and to suggest that they have is frankly nothing short of unpatriotic. The Lavon Affair never happened.
- notso411 3y ago[dead]
- roywiggins 3y agoNSO has been: https://www.state.gov/the-united-states-adds-foreign-companies-to-entity-list-for-malicious-cyber-activities/ https://www.state.gov/the-united-states-adds-foreign-compani...
- cedws 3y agoAh, didn't know that, thanks. It seems NSO Group are still alive and kicking in spite of this.
- dkjaudyeqooe 3y agoFor the same reason it hasn't had any of $10 billion in military aid reduced even after acting counter to numerous US interests and values: Politics.
- jokoon 3y agoThis is why I don't want to work in cyber security. You are dealing with dangerous people.
- dominojab 3y ago[dead]
- deleted 3y ago[deleted]
- wkat4242 3y agoMeh. The same goes for police work and even more so for military. And cyber is a very wide range. A lot of roles are simply about training personnel in security principles and procedures, implementing data classification etc. Not everyone deals directly with attacks. Most of the work is preventative. In our company probably less than 20% of people who technically work in cyber, although that's in part because our SOC is outsourced.
- nicce 3y ago> Most of the work is preventative. Current work culture is bizarre in cyber security. I am not personally very fan of it. Nobody wants to work on defensive side. You are not getting either fame or money if you do your work well. The expectation is that you do your work perfectly. There is no actually measurements in place to prove that your good code prevented 100 data breaches! But on the other hand, if you are on offensive side, sometimes find cool bugs, you get fame and money. Does not matter if there is a long break sometimes. Your goodness is measures based on how much money you got. What does it mean? People start doing bug bounties. They hoard tools only for themselves to make more money, instead of releasing them to improve general security. They keep small bugs themselves so that they can be used in exploit chains to get bigger bounties. If the reputation of the company is based on the participations of the bug bounty program, they start doing less and less in-house engineering and outsource the cyber security testing for bug bounty platforms. And vicious cycle starts.
- 3y ago
- deleted 3y ago[deleted]
- troyvit 3y ago[flagged]
- deleted 3y ago[deleted]
- LispSporks22 3y agoIs Signal one of the other platforms they mention?
- klabb3 3y agoI think they mention every platform for marketing because once the device is rooted, they can extract data from any app. That doesn’t mean the vulnerability was in the app mentioned, nor that it was the fault of an app at all. At the end of the day, it’s between platforms (specifically iOS and Apple) and these exploit devs/traders, afaiu. That’s why Apple hates them. For better or worse, putting a torch under Apple’s ass is probably a good thing for the rest of us. OTOH, you could argue that Apple should be more of top of these things and reward the security researchers better. Things are better than 20y ago, but still it’s probably more lucrative to sell exploits to these shady actors than to scrape the floor for peanuts in hope that mega corps will reward their discoveries.
- xvector 3y ago> than to scrape the floor for peanuts in hope that mega corps will reward their discoveries. Security researchers capable of finding these exploits aren't exactly starving for food. They could easily land a $500k+ job at any big tech company or make a similar amount bug bounty hunting.
- jmkni 3y agoI guess that once the device is rooted, they can just take screenshots/record the screen without the user knowing, so the specifics of how any particular app works don't matter?
- ChrisArchitect 3y ago[flagged]
- deleted 3y ago[deleted]
- ForHackernews 3y ago[flagged]
- deleted 3y ago[deleted]
- kristofferR 3y agoCan anyone explain this case? Why would a US court have any jurisdiction over a foreign Israeli spyware vendor that has already been blacklisted by the US government? And why would Israel send their spyware source code to WhatsApp even if they lose the case?
- Izikiel43 3y agoBecause it's the US. Same reason they can do FATCA
- xxpor 3y agoBecause the NSO group handles dollars. If they didn't respond, they'd lose by default, and the court could order any assets the US can get their hands on seized. If they're getting paid in NIS by countries outside of Israel, the currency conversion happens with dollars as the intermediary. There's the US's window.
- jevoten 3y agoHow is "Because the NSO group handles dollars" related to "the court could order any assets the US can get their hands on seized"? Presumably, if they were getting paid in bars of gold, the US could seize those too, if they could get their hands on them, no? On the other hand, if they were paid in US dollars, but in cash, that wouldn't establish jurisdiction, nor could it be seized, if the transfer happened outside US territory?
- xxpor 3y agoThe US government has jurisdiction over all US dollars. That's how sanctions work.
- jeroenhd 3y agoIf I bring a suitcase full of dollars home with me from a trip to the US (assuming I make it through border control with that much cash), I don't see what kind of jurisdiction the USA would have over me for simply owning dollars. These are just pieces of paper, they don't provide any kind of jurisdiction. The American banking system may refuse to serve me perhaps, but it's not the dollars that give the American government any control. Hell, several countries outdid e the USA use American dollars as an official currency, but that doesn't make them vassal states to the USA.
- fortran77 3y ago[flagged]
- corford 3y agoNow liquidated it seems: https://find-and-update.company-information.service.gov.uk/search?q=Novalpina https://find-and-update.company-information.service.gov.uk/s...
- saagarjha 3y agoMaybe they’d have a chance to get upset if they weren’t annoyed by you bringing this up every time?
- deleted 3y ago[deleted]
- submeta 3y agoSnowden revelations were years ago. And what we saw back then was unbelievable. I can’t even imqgine what the agencies are using these days. So what’s Pegasus anyway compared to what the agencies might have and use.
- sylware 3y agoAnd whatsapp? When are they "forced" to provide a simple and stable in time interop protocol stack ? (with reuse of irc,smtp,noscript/basic (x)html/etc?) This one is not better than the other.
- jamesrom 3y agoApple and Google can disable Pegasus whenever they wish.
- eli 3y agoHow?
- jamesrom 3y agoThey almost certainly know the exploits being used by Pegasus. It's in their best interest to turn a blind eye. Bookmark this post.
- eli 3y agoI don’t believe you.
- _kbh_ 3y agoAt least some of exploits that were used to install Pegasus have been patched. You can find details here >https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer... Vulnerabilities in third party apps that are used to install Pegasus Apple has less control over.
- mh8h 3y agoNo way Israel allows the export
- ametrau 3y agoThat is a rogue nation that somehow is always treated with kid gloves.
- brettermeier 3y agoI don't get why Pegasus should send their real source code to WhatsApp, even if they lose this case. They could just send over some nonsense, or am I missing something?
- halJordan 3y agoYou're missing courts and their legal powers.
- brettermeier 3y agoCouldn't they rip out the sensitive stuff and if it's noticed nobody from Israels government will know about it? Or is the power of the US too big to cover such thing? I guess it is, but really?
- acqbu 3y agoJust so you know: https://grapheneos.org/ https://grapheneos.org/ and https://signal.org/ https://signal.org/ do exist!
- punk_ihaq 3y agoIsn't this a red herring though? If some spyware has ring0 level access on device, security properties of apps like Signal don't really matter since the spyware can trivially access them(?)