9 ms·
EU parliament member hit by Israeli Candiru spyware
- chmod775 2y agoSounds more like it missed. They sent him a link, and he was wise enough to not click on it.
- throwawaydummy 2y agoDon’t we live in a world where zero click exploits are a thing? I thought the target didn’t have to click the links just receive them
- PaywallBuster 2y agonot all of them are zero click :)
- xn7 2y agoZero click exploits are a thing, but they are very expensive and have limited shelf life (once they have been used a few times, they tend to get found out and patched). Most actors won’t use one, unless it is a very, very high value target. It seems that the EU parliament member was not high value enough, and got lucky.
- trueismywork 2y agoThat's why I disable HTML in emails
- seanhunter 2y agoJust to be aware that's a start but it's not a full mitigation. Some of the prominent zeroclick exploits have been "rich content" in messaging products such as whatsapp[1] and imessage[2]. Definitely not an expert but I'm presuming they take advantage of the "helpful" behaviour those apps have to preview content and then pair that with some sort of exploit in the library that parses/displays the content. So say they have an exploit in a jpeg library that whatsapp uses then they send a specially-crafted jpeg via whatsapp, whatsapp "previews" the image and that triggers the exploit to compromise the jpeg library and pwn the user. [1] https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... [2] https://appleinsider.com/articles/23/06/01/zero-click-ios-malware-attack-through-imessage-is-actively-infecting-iphones https://appleinsider.com/articles/23/06/01/zero-click-ios-ma...
- echoangle 2y agoI wonder how that was supposed to work? Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? Chrome on Android and WebKit on iOS? That would be concerning, but how realistic is that?
- chmod775 2y agoVery. These companies pay good money for 0 days and invest considerable effort into finding their own. Also these attacks are aimed at individuals and executed by state actors. They likely already knew what phone, OS, and browser the MEP was using and selected an appropriate attack from the catalog.
- spurgu 2y agoI would guess/assume that work phones of MEPs are restricted to a specific set of manufacturers and models, which makes targeting different from having to consider all options. They might also have specific software installed across most of them that could be part of the targeting.
- chatmasta 2y agoYes, but the exploits are so valuable/expensive that they’ll only use them during targeted operations. Otherwise they risk burning the exploit. So just remain uninteresting and you should be safe.
- talldayo 2y ago> Am I to believe that they have exploits for every browser engine on every OS that infect my phone just by visiting a page? This has been the reality of mobile phone security for almost a decade now. Any sufficiently-complex digital system will be rife with UB and exploits.
- Veserv 2y agoWould cost a few million dollars upfront with effectively zero marginal cost. Less than buying one tank or starting a McDonalds.
- spoonjim 2y agoInteresting that they named their company after the Amazonian fish that can supposedly swim up your penis and lodge itself inside
- tsimionescu 2y agoSeems to be a pattern in these circles - there's at least also Palantir, named after the crystal ball that corrupted Saruman in The Lord of the Rings.
- dudeinjapan 2y ago[flagged]
- A_D_E_P_T 2y agoI don't know if this needs to be stated, but the idea is that they're intentionally named after unpleasant or evil things. Presumably as a way of saying: "We're dangerous/edgy/hard-core; no skulduggery is beneath us."
- dudeinjapan 2y agoI never made that connection. The Palantiri in LOTR were neither inherently good nor evil, they were "seeing stones" with both communication and remote-viewing capabilities, equivalent to a what an iPhone, CCTV cam, or spy satellite can do today. It's an appropriate and cool name for a company whose whole mission is "intelligence gathering". (Yes, it is true that Sauron corrupted Saruman while communicating to him via his Palantir, but this would be tantamount to blaming Apple because someone called my iPhone and told me to be evil.)
- A_D_E_P_T 2y ago> The Palantiri in LOTR were neither inherently good nor evil, they were "seeing stones" with both communication and remote-viewing capabilities, equivalent to a what an iPhone, CCTV cam, or spy satellite can do today. Within the context of LOTR's narrative, they were tools that were corrupted by evil and employed to unambiguously evil ends. A weapon such as a warhammer is also just a tool, and Morgoth had his hammer Grond. If a company names themselves after Grond, it's safe to surmise that they're trying to be dark/edgy and convey a certain posture or attitude. It would be silly for them to say, "well ackshually it's just a warhammer, and a warhammer is an ethically neutral tool, whether it's good or evil is down to its wielder, and ultimately it's no big deal."
- hathym 2y ago[flagged]
- PestoDiRucola 2y ago[flagged]
- deleted 2y ago[deleted]
- tiernano 2y agoDid they not write it?
- Yoric 2y agoWell, the title makes it sound like Israel deployed it (see other comments - at least a few people seems to have jumped to this conclusion), while it's software that has been purchased and deployed by many countries around the world.
- flanked-evergl 2y agoIs the US behind everything that is done with software created by American companies?
- jonathanstrange 2y agoThis is a misleading question because we're not talking about any kind of software. This kind of spyware is generally treated like a weapon and only sold to befriended government entities on an expensive per-seat basis. It often falls under arms-control exporting conditions, though I don't know about the specific regulations in Israel.
- deleted 2y ago[deleted]
- Yoric 2y ago[flagged]
- 2y ago
- OhioMan2943 2y agoI notice issues relating to these groups (israeli cyber groups) are very quick to be denied or delegitimised on HN
- Larrikin 2y agoAnything attributed to Russia or China also is, but usually the grammatical mistakes give the game away.
- kstenerud 2y agoIt's the new world we live in. Every power group has their army of adherents they can tap to kill a story they don't like. Even those we generally consider "goodies" do this now.
- cen4 2y agoAre there sites like HN out of EU covering EU related news?
- 6510 2y agoEnglish is required for IT.
- Rinzler89 2y agoThere's nothing exactly like HN out there. But EU tech. news sites exist (most have a linux focus though and you'll need to use machine translation): https://www.theregister.com/ https://www.theregister.com/ https://linuxnews.de/ https://linuxnews.de/ https://www.root.cz/ https://www.root.cz/ https://www.golem.de/ https://www.golem.de/ https://www.heise.de/ct https://www.heise.de/ct https://www.computerbase.de/ https://www.computerbase.de/ https://gnulinux.ch/ https://gnulinux.ch/ https://www.linux-magazin.de/ https://www.linux-magazin.de/
- cen4 2y agoThanks!
- 2y ago
- Drubbard 2y ago[flagged]
- snird 2y ago[flagged]
- sim7c00 2y agoi agree. Often these are also specifically said to be 'ex militairy' types or founders etc. it's actually really hard to be anything else but 'ex militairy' in a country which has everyone forced in the army a few years... - all these useless points of information show u it's propaganda. maybe not 'official' but then indirect. someone infected with the disease and spreading it.
- pona-a 2y agoInaction is an action. Facilitating the development and sale of malware while benefiting from it through tax revenue and hard power with full awareness is, to me, enablement. The action taken against such vendors proved nominal, as they still continue to operate with no shortage of news stories like this one. It would be naive to think the government itself would not use such a powerful source of intel. Regardless of your political affiliation, states act according to their self-interest. In international politics, the only constraints are what you can do, and how much you can get away with. If one can find a reasonable motive and prove a possible causal link, absent of further evidence, the prior is guilty.
- deleted 2y ago[deleted]
- alephnerd 2y agoit's much more prosaic than that - it's just A LOT of money. Israel isn't a signatory of the Wassenar Arrangement, which helped Israeli startups rapidly corner the 0-Day and Exploit Market. Before the 2010s, the Israeli software scene was largely targeting commodity use cases by trying to undercut existing vendors like Cisco or Arista in price. Israeli companies saw a market opening that could differentiate them and decided to take it. It's a segment that would have existed in the US, France, or CEE but regulations prevented it from emerging.
- ADeerAppeared 2y ago
- bawolff 2y agoNot to downplay, but i would assume high profile people like EU parliment members would be targeted with phishing emails on a near daily basis. Like presumably law makers would be target #1 for espionage. Heck most ordinary people get phishing emails on a regular basis. Idk, i guess i was expecting something more sophisticated based on the headline than just: spear phishing attempt foiled after user fails to click on the suspicious link.
- echoangle 2y agoWell, it wasn’t phishing. If the claims are correct, just opening the link would have compromised the phone. If that’s true, I find it try extraordinary. Phishing is just having a fake webpage asking for credentials, right? Infecting a phone with spyware just by visiting a webpage is much harder and much worse.
- bawolff 2y agoSpear phishing is usually inclusive of attacks from an email that involve tricking the user into doing something unsafe. E.g. see definition https://www.trendmicro.com/vinfo/us/security/definition/spear-phishing https://www.trendmicro.com/vinfo/us/security/definition/spea... > If the claims are correct, just opening the link would have compromised the phone I'm not sure if that is being claimed. The twitter post just said the link would have "exposed" them to spyware. One possible interpretation is that simply viewing the link in a web browser would be enough, but i think another interpretation is that the link contained some sort of malicious download. No way to know with the info we are given. I agree that a zero-day in a web browser would certainly be more interesting, i'm just not sure that is the case here.
- paulmd 2y agothis is exactly the kind of scenario where you’d expect to find a high-value zero-day deployed (state-level actor against a known, high-value target) so I see no reason to disregard the actual claim in favor of a lesser one. yes, this class of exploits definitely exists (a while ago there was one that worked just receiving a text message!) and is the primary reason why apple offers the lockdown mode for these sorts of people who actually might be the target of these advanced threats. Lockdown mode severely reduces the amount of “auto” shit that happens in the background, which ruins the experience but is also more secure against this style of attack.
- OhioMan2943 2y ago[flagged]
- boffinAudio 2y agoMore to the point, there actually is evidence of a connection to the Israeli government, inasmuch as "Candiru" was financed by the same people behind NSO, "Founders Group", and both of these entities have very clear ties to Mossad: https://www.dimse.info/candiru/ https://www.dimse.info/candiru/ "TheMarker Claims that NSO is also a customer of Candiru as it is often seen contacting the surreptitious firm for some espionage-related projects. Two industry sources said the main Candiru financial backer was Founders Group, cofounded by one of the three men who set up NSO, Omri Lavie." And then, there is its Board of Directors: "As surveillance industry sources also told Forbes, one of the lead investors is Founders Group managing partner Isaac Zack. According to Pitchbook, Zack is also a board member at wireless charging startup Humavox and at Sepio Systems. The latter is a cybersecurity company, focused on doing the exact opposite of Candiru: protecting hardware from being turned into silent surveillance devices. Its board also includes Tamir Pardo, the former head of the Mossad, Israel’s intelligence agency." https://www.forbes.com/sites/thomasbrewster/2019/10/03/meet-candiru-the-super-stealth-cyber-mercenaries-hacking-apple-and-microsoft-pcs-for-profit/ https://www.forbes.com/sites/thomasbrewster/2019/10/03/meet-...
- alephnerd 2y agoAlmost all startups in Israel are cybersecurity oriented. There is almost no dealflow for a non-Security startup in the Israeli market because Israeli VCs demand a short exit window, Cybersecurity startups are very M&A friendly, and Israeli VCs don't have as much experience with GTMing B2C and B2B2C compared to Enterprise. Cybersecurity is the right mix of easy but niche (only Israel, CEE, India have a thriving low level development scene because American universities increasingly moved OS and Kernel classes into "Computer Engineering" instead of "Computer Science"), easy exits (there are enough F1000 cybersecurity and enterprise companies to sell a startup to), large dealsize (cybersecurity/infra ACV tends to be mid-to-high 5 figures), and pre-existing network (the Israeli and Indian scenes started thanks to Palo Alto Network's successful IPO, and the founding team at PANW became VCs funding similar startups across Israel and India since the mid-2000s). Also, Israel is TINY (both in area and population). Everyone is at most 3 degrees of separation from Netanyahu or any other dignitary in the country - it's barely 9 million people.
- dubbel 2y agoLink to the newsletter that the tweet screenshots: https://www.politico.eu/newsletter/brussels-playbook/orban-critic-mep-targeted-with-spyware/ https://www.politico.eu/newsletter/brussels-playbook/orban-c... No paywall/login wall at least for me right now.
- admissionsguy 2y ago[flagged]
- OhioMan2943 2y ago[flagged]
- bawolff 2y agoWell, do you have anything interesting to say about the political implications? Because i'm not sure what they are. If we knew who was responsible, we could talk about motive and implications of that, but we don't. I guess we could consider the broader picture of if this represents an increase on spying on civil society leaders (a bad thing, certainly), but without a base rate to compare with, it seems like conjecture on this is pointless. Does this represent something new, or is it just a continuation of the age old practise of keeping an eye on your enemies? I have no idea. I suppose there is something to be said that hacking a modern cell phone is much more invasive than watergate-style survelience, but that is not exactly a new observation. So what are the political implications we should be talking about?
- OhioMan2943 2y ago1. That the legislative stranglehold on the eu and other bodies by this country is so strong that they do next to nothing to criticise/sanction israel despite literally being hacked by them? Post-pegasus as well. 2. This states lack of care and oftentimes facilitation of these groups, and their close ties to its military 3. The sense of neo mccarthyism that this creates with the idea of constant surveilance through these types of vulnerabilities. I'm full of ideas tonight Same problem, but different lens and conception, and the circumstances and differences are >very< worth disucssing Seriously, let's start talking about those points in this thread
- alephnerd 2y agoThe article talks about a German MEP who was most likely targeted by Hungarian intelligence [0] due to his very vocal anti-Orban stance and how he was recently pushing against Hungary and Orban after his recent visits to Russia. The perpetrator was most likely Hungarian intelligence who used a product they bought from an Israeli company. Imo, the bigger question is why Hungary, Poland, Spain, Greece, and Cyprus (all countries part of the recent EU Spyware Scandal) [1] continue to allow their Interior Ministries to attack the phones of both domestic and foreign opponents. [0] - https://www.politico.eu/newsletter/brussels-playbook/orban-critic-mep-targeted-with-spyware/ https://www.politico.eu/newsletter/brussels-playbook/orban-c... [1] - https://www.politico.eu/article/parliament-defense-subcommittee-phones-checked-for-spyware/ https://www.politico.eu/article/parliament-defense-subcommit...
- biasedjournal 2y agothe spyware and other cyberattacks get published very selectively everybody is constantly a target of attacks but what makes it to the news is the journalist choice
- octopoc 2y agoBut, who sent the attack is the news. Sure we’re always bombarded with attacks by random cyber gangs, but when you’re targeted by an organization with official credentials that tends to raise some eyebrows.
- flanked-evergl 2y agoThe post does not claim the EU parliament member was targeted by an organization with official credentials.
- miohtama 2y agoAlso if you are profiting from spying your allies is generally frowned upon.
- em1sar 2y ago[dead]
- euroderf 2y agoThat C-word was a great joke in seventh grade.
- alephnerd 2y agoI think people commenting on here are commenting on the "Israeli" part and are ignoring the bigger issue - which country is it that attacked the MEP. Israel is very laissez-faire about regulating the tech industry because it employs almost 10% of the country. As such, offensive security companies sell to anyone who isn't on the US Sanctions list. The question is which buyer did the attack. Hidden between the lines of the reporting is that it might be Hungarian intelligence [0] Imo, the bigger question is why Hungary, Poland, Spain, Greece, and Cyprus (all countries part of the recent EU Spyware Scandal) [1] continue to allow their Interior Ministries to attack the phones of both domestic and foreign opponents, and are abusing "Spyware for political gain" [2]. [0] - https://www.politico.eu/newsletter/brussels-playbook/orban-critic-mep-targeted-with-spyware/ https://www.politico.eu/newsletter/brussels-playbook/orban-c... [1] - https://www.politico.eu/article/parliament-defense-subcommittee-phones-checked-for-spyware/ https://www.politico.eu/article/parliament-defense-subcommit... [2] - https://www.politico.eu/article/eu-spyware-probe-slams-government-leaders-as-perpetrators-of-abuse/ https://www.politico.eu/article/eu-spyware-probe-slams-gover...
- mcantelon 2y ago>Imo, the bigger question is why Hungary, Poland, Spain, Greece, and Cyprus (all countries part of the recent EU Spyware Scandal) [1] continue to allow their Interior Ministries to attack the phones of both domestic and foreign opponents, and are abusing "Spyware for political gain" [2]. It's also a national security issue given that Israel may be piggybacking on the spying.
- alephnerd 2y agoThe management console for a lot of these products tend to be hosted on-Prem behind fairly restricted network controls with traffic closely monitored by customers. While this doesn't mean that there probably isn't some phoning in, it's extremely difficult to obfuscate. That said, the act of purchasing a product like this can absolutely be used as leverage, but that's any sort of weapons sale (which this functionally is)
- OhioMan2943 2y ago[flagged]
- dang 2y agoIt set off the flamewar detector, plus users flagged it. See also https://news.ycombinator.com/item?id=41071722 https://news.ycombinator.com/item?id=41071722.
- OhioMan2943 2y agoThanks for the transparency!
- darkhorn 2y agoThe country that is selling that software should be sanctined. People involving in the development of that software should be charged as spyes.
- impossiblefork 2y agoLegally, this is very feasible. Here in Sweden we have two laws which are applicable: the law against unauthorized surveillance and the law against unauthorized computer access and the law forbidding aiding anybody in such crimes. It's only two year's imprisonment, but there's presumably a lot of participants in the exploit development etc.
- swaginator 2y agoThis is pretty common, Israel has previously spied on the ICC and intimidated a prosecutor: https://www.haaretz.com/israel-news/2024-05-28/ty-article/.premium/the-guardian-israel-spied-for-years-on-icc-chief-prosecutor-including-in-recent-months/0000018f-bfe0-dfeb-a58f-bffa942f0000 https://www.haaretz.com/israel-news/2024-05-28/ty-article/.p... Not to mention the wiretapping of phones of members of the Palestinian authority, probably lots more that we just are not aware of.
- emchammer 2y agoPalestine's PSTN is routed through Israel (at least, if any switches still exist). Of all the reasons to criticize Israel, I don't believe that wiretapping calls to/from the Palestinian Authority is one.
- swaginator 2y agoThe implication in what you just said is that Israel having total control over Palestinian territory is taken for granted. They can wiretap with ease due to their illegal occupation. I think if the example was Canada wiretapping the US, the wrongness of it would be more apparent. I think in western discourse it's common to treat Israel like a hurricane or some other natural disaster and not a state with agency. It is framed as Israel "just being there" and not as them choosing to occupy an area and subjugate people, so much so that they designate a huge chunk of their GDP to the endeavor and require continuous funding from the US. Sorry if what I am saying is confusing, I am struggling to articulate the point I want to make. My point is mostly that sure, while wiretapping is several magnitudes less bad than murdering civilians and foreign aid workers, they are only capable of doing it so trivially because of their position of occupation, which is by design.
- Log_out_ 2y ago[flagged]