15 ms·
From Pegasus to Predator – The evolution of commercial spyware on iOS [video]
- hssuser 2y agoJust finished reading pegasus today. Fascinating how this will keep evolving, keep getting worse and we might as well act as if we are getting surveilled. Too much incentive to not have adversarial actors. Link for the lazy - not an affiliate link - https://www.amazon.com/Pegasus-Threatens-Privacy-Dignity-Democracy-ebook/dp/B09NK4VSG4/ https://www.amazon.com/Pegasus-Threatens-Privacy-Dignity-Dem...
- tptacek 2y agoThe fact that you've heard about it --- heck, the fact that there's a book about it --- should tip you off to the idea that Pegasus is not the SOTA implant. There's a whole marketplace of companies providing these services, both exploit chains and implant stacks, and most of then are firms you've never heard of before.
- cylemons 2y agoDumb question, what is SOTA implant?
- js2 2y agoI don't know either but perhaps "state of the art."
- reaperman 2y agoSOTA = “State of the art” “Implant” would be like any remotely installable persistent exploit that grants access to an attacker over a period of time. Also, I’m pretty luddite when it comes to highly-hyped AI stuff, (in spite of my income being heavily tied to developing AI models) but I have found ChatGPT to be shockingly good at explaining super niche terminology and even jokes. So I do recommend people feel comfortable turning to that if they ever feel uncomfortable asking “dumb” questions publicly.
- throwup238 2y ago@simonw made a custom GPT called the dejargonizer just for that purpose: https://chatgpt.com/g/g-3V1JcLD92-dejargonizer https://chatgpt.com/g/g-3V1JcLD92-dejargonizer
- pockmarked19 2y agoOr you could just Google it. [0] That's right. People can just Google things. [0] https://i.imgur.com/1Yx0m1U.png https://i.imgur.com/1Yx0m1U.png
- cylemons 2y agoI googled "SOTA implant" and got something totally different.
- gambiting 2y agoYeah except Google is just so often wrong or pushing crappy SEO results that I honestly think it's worthless nowadays.
- maeil 2y agoBit of a tangent, but.. Google has been going down hill for many years but since the December update a few weeks ago it has genuinely become atrocious. In their quest to combat AI slop (good idea), they've gone and made domain authority so much more important than the content, that now when you search for A B C, you get 20 pages from very "authoritive" sites that are about A, are slighyly about B and don't even mention C. This is despite plenty of great pages about A B C existing and serving the content we're looking for - we just never get to see them because the places they're hosted on aren't "authoritive" enough. Before, you'd get 5 pages, 1 of which likely had what you were looking for, and maybe 1-2 were AI slop. Now zero of them are what you're looking for, but at least we no longer have the (generally very obvious) slop? Brilliant improvement for the users.. The reason behind this is pretty obvious: most AI slop that had been ranking well likely had 0 ad spend, meanwhile the "authoritive" sites tend to have high ad spend. Ads was seeing numbers go down and unhappy customers, and they run the company.
- deleted 2y ago[deleted]
- tptacek 2y agoAn "implant" is like a rootkit; it's all the things you do with a compromise once your exploit chain pays off, and threat actors generally have standardized implant stacks. "SOTA" is just an abbreviation for "state of the art".
- hammock 2y agoYou make this comment everywhere Pegasus comes up. Half a dozen times on one submission.[1] Can you name some of the other firms we've never heard of? [1]https://news.ycombinator.com/item?id=42476828 https://news.ycombinator.com/item?id=42476828
- tptacek 2y agoNo.
- saagarjha 2y agoAlright then, keep your secrets.
- daneel_w 2y agoSo it's either because you, too, have never heard of them, or because you're obliged not to. Which one is it? Are you making an educated guess about their presence?
- saagarjha 2y agoNo he knows what they are he's just being annoying
- daneel_w 2y agoMy questions were rhetorical ;) I've commented on his "patterns" previously, in particular whenever Signal's lack of anonymity is the topic. Apparently it's an offense so one must watch the way they phrase their responses to such statements.
- tptacek 2y agoI have no idea how to parse this, but if you thought I was going to give you a list of all the CNE vendors I'm aware of on an HN thread, obviously, no. Why would you care anyways? I know enough to know that I'm speaking factually about the state of the market, but I don't work in it or interact with it in any meaningful way, so you could just as easily say "if you know about that vendor, that means they're not a SOTA CNE vendor either". You might be right! On this leg of the thread, we're considering basically one issue: is NSO Group one of the {only,most} {important,impactful,sophisticated,whatever} CNE vendors. Is someone seriously arguing that's the case? I'd assume the idea that there are lots of vendors more impactful would be pretty banal, but maybe there really are people on this thread whose understanding of CNE comes entirely from that book linked upthread?
- darknavi 2y agoFascinating video with terrible audio for some reason. It made it hard to watch the video. It fixes its self a few minutes in at least.
- Syonyk 2y agoSounds fine to me... ? It's not a native English speaker, but the audio seems entirely standard for conference audio.
- darknavi 2y agoFor me (English audio) the first ~13 minutes clips pretty hard.
- nyclounge 2y agoLikewise here. Even tried the audio only link. It is also choppy, can the organizer upload a better version? It is quite difficult the hear what he is saying sometimes.
- javaunsafe2019 2y ago[flagged]
- SSLy 2y agoyou don't know anything about audio production, do you?
- can16358p 2y agoYup, the audio was so bad that it started to hurt my ears and had to stop. Would love to watch/listen to a version with fixed audio though!
- javaunsafe2019 2y ago
- sneak 2y agoIf you are a presenter, please please please please stop it with the “put up slide, read bullet points off the slide, repeat” format. It’s excruciating.
- deleted 2y ago[deleted]
- lnsru 2y agoThat’s probably how 80% of presentations I attended last couple years were presented. Open slide, read sentences written there, go to next slide. Not nice.
- seanhunter 2y agoThere’s an excellent essay about how Powerpoint encourages this style and how bad it is for everyone by Edward Tufte called “The Cognative Style of Powerpoint” https://www.inf.ed.ac.uk/teaching/courses/pi/2016_2017/phil/tufte-powerpoint.pdf https://www.inf.ed.ac.uk/teaching/courses/pi/2016_2017/phil/...
- layer8 2y agoYou generally need to practice a talk a lot to be able to free yourself from the slides, especially if you don’t often do talks. For a one-off talk it’s not always realistic.
- Syonyk 2y agoIf you use iOS: Turn on Lockdown mode. All your devices. Don't look back. Grant exemptions for individual, known/trusted websites/apps if needed to regain functionality that's critical. Even if you have to whitelist a few websites or apps, it's better than having all the interfaces exposed to all the things. You eliminate a ton of "complicated, probably exploitable things" in spaces known to be commonly exploited. Oddball image formats, the Javascript JIT engine, "complex" messaging (Facetime, MeMojis, that... entire ecosystem of weird-not-text-not-image stuff that Apple does), WebGL, WebRTC, link preview processing (I expect a common 0-click exploit chain is through that system), and probably some other stuff. The phone/tablet is entirely usable without this stuff. Some websites don't render images properly, "that one guy's website" doesn't do the animations, but you can individually bypass Lockdown mode for sites, apps, etc - and you still get the protections for everything else. And if you're a web developer or app developer, please. Test your website on an iOS device with Lockdown mode enabled. Pick image formats that render properly, it's not hard. And if your app requires something that isn't supported in Lockdown mode, that's fine - but please show some sort of useful error message that indicates that, perhaps, this crash/glitch/whatever is the result of Lockdown mode, and you can disable it by following these steps. Then, also, don't sell to some random purchaser of apps. But Lockdown mode really, really helps reduce the attack surface. Try it. You'll like it! And it might just help prevent getting you popped by this sort of crap. ... then install QubesOS on your full computers and don't look back. ;)
- captn3m0 2y agoEven large mainstream app developers are not testing against Lockdown mode. Amazon’s app doesn’t load Customer support chat with it enabled for example. Also, is JIT disabled for alternative browser engines in EU?
- saagarjha 2y agoI don't actually think there is official API to check if the device is in Lockdown Mode. But to be clear this is an academic curiosity for now as nobody is actually shipping an alternative browser engine in the EU that is being targeted by a sophisticated attack.
- PRONTAL5555 2y ago[flagged]
- PRONTAL5555 2y ago[flagged]
- saagarjha 2y agoThis is a good overview of the public commercial spyware landscape on iOS over the years, including attributions to several of the high profile players in this space. Unfortunately, the rest of the talk is a little depressing. You'll note that I have been using words like "public" and "high profile". Despite these cases coming to light, the actual market is far broader than what was discussed here. Some of the exploits presented were not able to be conclusively tied to a specific entity or operator. Many attacks go entirely undetected. The efforts in this space by defensive organizations are laudable, but very, very immature. There's this meme that has crossed over into the software space of the planes the come back with a lot of holes in them, indicating the regions where extra armor plating is actually the least important. The commercial spyware industry is a lot like that. Those stories you see of people finding exploits via crash logs and iOS databases? That's the lowest hanging fruit. People who know what they are doing are not leaving traces there. And pretty soon those who don't will stop dropping things there too. It's really, really important to understand that the detections well that these people are sipping from will dry up very soon. The proposed solutions from the talk are not nearly enough to help. Some of the things they're asking for (process lists, for example) are already exposed, but we're currently in the Stone Age of iPhone forensics on the defensive side. Those on offense, who are incentivized by money but also now by necessity, will far outstrip any attempts to catch them after-the-fact :(
- ignoramous 2y agoThanks. > ...we're currently in the Stone Age of iPhone forensics on the defensive side. Since I've seen your comments show a pretty good understanding of AOSP/Android, what's your take on its posture against CSVs? Especially given that Google has been pursuing both legal [0] & technical defenses (at every level of the software stack) against them quite actively. [0] Ex: https://www.centerforcybersecuritypolicy.org/hacking-policy-council https://www.centerforcybersecuritypolicy.org/hacking-policy-...
- pxeger1 2y agoWhat does CSV mean?
- mu53 2y agoPeople really underestimate the damage these tools are doing to society. Who can afford these tools? What lengths have people gone to earn/keep large sums of money? What problems are society going through right now? Its just stealing your data, which doesn't seem bad. But now, someone who probably doesn't like you has your location, habits, friends, future events. There are so many things that these people can do to interrupt the lives of journalists, activists, and just regular people with stalkers, and all of those things are covert because "How is your ex-girlfriend's friend supposed to know you made a bumble profile 2 days ago, find it, and match with you?"
- alecco 2y ago> People really underestimate the damage these tools are doing to society. Even when heads of state are being extorted. Morocco used it against France and Spain. It fizzled out of the news cycle and nothing happened. And those countries later announced multi-billion Euro investments in Morocco. If anything, this is a signal hiring Pegasus is very profitable and they can do whatever they want. https://en.wikipedia.org/wiki/Pegasus_(spyware)#By_country https://en.wikipedia.org/wiki/Pegasus_(spyware)#By_country
- tptacek 2y agoWho can afford these tools? The IC and security agencies of every country in the world with a GNI greater than, say, Bahrain†. So: probably like 300-500 different global threat actors (countries like the US have dozens of capable agencies; I assume Bahrain has 1-2). † I picked Bahrain because they're the smallest country we know for a fact has been a customer of multiple CNE vendors, but that probably means Bahrain plus the next 20-30 countries down the list.
- r9295 2y agoAn idea I that I considered implementing was to instrument parser libraries (png/pdf etc) with address sanitizer (for iMessage/Chrome/Webkit) and run the instrumented version for 5% of all parsing operations. If we get enough people to use this, exploits may be easier to discover?
- saagarjha 2y agoGoogle and Apple already do this to some extent: https://arxiv.org/html/2311.09394v2/#S5 https://arxiv.org/html/2311.09394v2/#S5
- amelius 2y agoQuestion: my colleague has a Mac with a Timemachine and thinks he is safe for ransomware. Is that, in a practical sense, true?
- jaktet 2y agoI don’t know about timemachine but I have some anecdotal experience with Dropbox and ransomware. Essentially one person’s computer was infected which encrypted all the files for everyone in Dropbox. Because Dropbox had versioning on the files I was able to restore all the files back to the point before they were encrypted after removing and wiping the infected machines. So if timemachine has versioning then maybe then you probably have some options, I’m not sure I’d call this being “safe” from ransomware.
- monai 2y agoAbsolutely not. Time Machine is just a SAMBA share with a nice UI on the client side. If the backup directory gets encrypted, all the versions of your files will also be encrypted.
- amelius 2y agoThere is a different opinion here: https://discussions.apple.com/thread/8282686 https://discussions.apple.com/thread/8282686 Not sure what to make of it. Is it possible to reach the server side of the Time Machine from the Mac itself? Has such a breach been demonstrated?
- kstrauser 2y agoMy Time Machine server doesn’t run an Apple OS. Someone would have to compromise my laptop and then pivot to separately attack my NAS. A state level actor could probably do that. The people running spray-and-pray ransomware ops almost surely couldn’t, or at least wouldn’t bother.
- amelius 2y agoAfaik, my colleague has a setup with regular Apple hardware and software.
- VagabundoP 2y agoThe only way this is going to change would be state/megastate level action. Make selling/using these attacks against government or other users a terrorist level event. Go after the heads of NSO and their like. I'd say at that point the companies would be absorbed into the national intelligence infrastructure of the host county and cease to be independent entities who can be bought for the highest bidder. And I know NSO is basically like that now, but I'd love to see some criminal sanctions for things that their software has been used for stick.
- max_ 2y agoThese goons that deal in the spy ware market are actually under the auspices of state. The state is rotten to the core. I don't even blame them. The real problem is the lack of philosophy and ethical standards in the tech industry. Computer Technology is so shallow. Apple for example talks about being a proponent of privacy and at the same time the M1 Computers have built-in terrible spyware that cannot be removed (Apple made sure of this). Every time I talk about this I am labelled as paranoid or sometimes "stupid". Alot of people simply rationalize this built in spying as "good". The bitter truth is that we made our bed. Now we have to sleep in it.
- Infernal 2y ago“M1 Computers have built-in terrible spyware that cannot be removed (Apple made sure of this).” Can you say more about this?
- Hilift 2y ago"...but as you can see, there is not a single mitigation that Apple implemented to detect commercial spyware samples on the device"
- omegacharlie 2y agoConsidering iOS devices are locked down to hell and back and achieving reboot persistence is extremely difficult, how hard is it to extract a sample of a malware payload in memory for purpose of forensics?
- saagarjha 2y agoQuite difficult on production devices
- bflesch 2y agoAFAIk it's extremely difficult. Even white-hat iOS forensics revolves around (ab)using old exploits in unpatched iPhones in order to access data.
- saagarjha 2y agoI don't think this accurately describes the state of iPhone forensics today.
- 1oooqooq 2y agofun fact: on Android, limiting 2G is a premium feature. buy top of the line android like pixel pro: there's a huge toggle switch "allow 2G". buy a middle or lower end device, no matter from Samsung, Motorola, etc... and for some inexplicable (heh) reason all companies decided that paying an engineer to apply a patch to remove that toggle from stock android was a solid investment :ponderingfaceemoji you can still disable it with the very user friendly *#*#4636#*#* and then picking any radio preference list that excludes gsm. (edit: hn swallows asterisks)
- ugjka 2y agonothing happens on my Samsung with that code
- motohagiography 2y agoi worked on solutions to this problem from the beginning and at a higher level there's a basic economic reason mercenary mobile malware will always be with us, and these spyware companies will almost always be a viable investment. first hand: it's an artifact of "small coalition" governments, typically funded by resource wealth, and therefore without sophisticated public services that can support a spy agency who would develop their own inline national surveillance and intelligence infrastructure. it means they will always have to go to the commercial or grey market (like these vendors) to get this spying capability in malware, and eventually there will be diplomatic consequences to cutting some of them out with vulnerability patches. there's another game at play where as iphones become more expensive and high risk to exploit, spyware providers switch away to things like vehicle entertainment systems, home and office AV and automation, and other personal tech. the market is small, but long term persistent. on the defender side, we just have to find a way to manage.