Darknet Diaries did a few podcast episodes on the NSO group from the perspective of people who have directly interacted with or have been the target and it really puts it into perspective how horrific they are. They operate under the protection of the US and are directly allowed to spy on US citizens without any recourse whatsoever.
One particularly grotesque case was the illegal wire tapping of Ben Suda after launching a criminal probe in to Israeli war crimes, which they used to threaten the prosecutor and used it to hide evidence that they knew was under scrutiny or take the cases to court just to drop it so they can tell the ICC that they did make an attempt to prosecute, which is a loophole that disallows the ICC to take up those cases.
I'm certain many countries do this stuff, as well as operate botnets and threaten journalists... but the uniqueness here is that these intel groups located in Israel operate under complete protection of the US without any scrutiny or oversight alongside the US government. We are living in this dystopian universe that people have warned about, for decades at this point.
The US hosts and protects firms that are better at this than NSO, and not just because they're smart enough not to be in the news.
Do these firms target US citizens without a US warrant?
US citizens are routinely targeted by CNE operations enabled by commercial tools, yes.
You don’t need a warrant to target US citizens unless you are the government.
The arrangement is that UKs GCHQ spies on US citizens and shares the info with CIA/NSA .
Well, this is not really true, given what we know about the government actor doctrine.
On the other hand, if you “target” Americans and you’re not the American government, you’re committing a crime.
Note here that we are describing firms that produce CNE tools, not organizations (lawfully constituted or otherwise) that actually use them. Production of exploits and implants is broadly legal everywhere in the world, including the US and Europe. The legality gets murky when you sell to non-governmental organizations (if prosecutors can demonstrate you knew the crimes that were to be committed with them), but most of the market appears to be governmental.
Why was this dead? If anything, Thomas' reputation here should at least entitle him to being heard.
My fellow showdeader, Click the time on the dead post and press “vouch”
I did.
Agreed that the flag seems highly dubious here.
Who are you talking about?
> or take the cases to court just to drop it so they can tell the ICC that they did make an attempt to prosecute, which is a loophole that disallows the ICC to take up those cases.
As an aside, it should be noted that this wouldn't be sufficient to trigger complimentary at the ICC if its obvious the investigation was not in good faith. The icc can ignore any domestic investigation it believes was not a serious attempt to investigate.
Like it'd be a pretty silly court if you could get out of everything by running your own sham investigation.
I refuse to use Israeli tech in my stack if at all possible. I don't see how someone could use software like Snyk and not put themselves at risk (founders are ex-IDF Unit 8200). Especially in the area of security, it seems like using Israeli tech is inviting the wolf straight into the hen house. No thanks.
I didn't know this about Snyk. Taking them out of my tools and unregistering myself immediately. Thanks!
You're welcome. One of the founders has since started a new AI venture called Tessl:
https://finance.yahoo.com/news/exclusive-tessl-worth-reporte...
The VC firm Boldstart has deep ties to the Israel intelligence community, so you pretty much want to avoid any of their investments.
Yes, I think the pager attack is also an interesting case study. It's one thing to execute a supply chain compromise for information gathering, where the target may never know what happened. On the other hand, flaunting your abilities in that area will just lead you to being cut out of supply chains.
Hezbolla didn't intentionally include israel in its supply chain. The impressive part of the attack is that they managed to insert themselves into an enemy's military supply chain without their enemy knowing - which is a 101 thing militaries try to prevent. If they were just abusing their known position in a supply chain, it would be much less impressive.
So i don't think it follows that the attack would lead to israel being cut out of supply chains, since the attack didn't involve that.
It wasn't "impressive", it just operated outside the bounds of moral values that the rest of the world holds, so it was unexpected.
Treating NSO owners / decision makers the same way as Gary McKinnon would be more appropriate. But I guess they are more "equal".
I'm not a lawyer so maybe I'm misunderstanding something but the plaintiff is Whatsapp, not the journalists. This isn't really about holding NSO Group accountable for hacking journalists at all
The fact journalists were compromised seems only incidental, the ruling is about weather or not NGO Group "exceeded authorization" on WhatsApp by sending the Pegasus installation vector through WhatsApp to the victims and not weather they were unauthorized in accessing the victims. Its a bit of a subtle nuance but I think its important.
Quoting the judgement itself:
> The court reasoned that, because all Whatsapp users are authorized to send messages, defendants did not act without authorization by sending their messages, even though the messages contained spyware. Instead, the court held that the complaint’s allegations supported only an "exceeds authorization" theory.
> The nub of the fight here is semantic. Essentially, the issue is whether sending the Pegasus installation vector actually did exceed authorized access. Defendants argue that it passed through the Whatsapp servers just like any other message would, and that any information that was 'obtained' was obtained from the target users' devices (i.e., their cell phones), rather than from the Whatapp servers themselves
> [...removing more detailed defendant argument...]
> For their part, plaintiffs point to section (a)(2) itself, which imposes liability on whoever "accesses a computer" in excess of authorized access, and "thereby obtains information from any protected computer" pointing to the word "any"
> [...]
> As the parties clarified at the hearing, while the WIS does obtain information directly from the target users’ devices, it also obtains information about the target users' device via Whatsapp servers.
Adding a little more detail that comes from the prior dockets and isn't in the judgement directly but basically NSO Group scripted up a fake Whatsapp client that could send messages that the original application wouldn't be able to send. They use this fake client to send some messages that the original application wouldn't be able to send which provide information about the target users' device. In that the fake client is doing something the real client cannot do (and fake clients are prohibited by the terms) they exceeded authorization.
Think about that for a moment and what that can mean. I doubt I'm the only person here who has ever made an alternative client for something before. Whatapp (that I recall) does not claim that the fake client abused any vulnerabilities to get information just that it was a fake client and that was sufficient. Though I should note that there were some redacted parts in this area that could be relevant.
I dunno, I mean the CFAA is a pretty vague law that has had these very broad applications in the past so I'm not actually surprised I was just kinda hopeful to see that rolled back a bit after the Van Bruen case a few years ago and the supreme court had some minor push back against the broad interpretations that allowed ToS violations to become CFAA violations.
Edit: Adding a link to the judgement for anyone interested: https://storage.courtlistener.com/recap/gov.uscourts.cand.35...
Edit2: And CourtListener if you want to read the other dockets that include the arguments from both sides (with redactions) https://www.courtlistener.com/docket/16395340/facebook-inc-v...
> I doubt I'm the only person here who has ever made an alternative client for something before.
I've been on both sides of the issue by authoring unofficial clients, and battling abusive unofficial clients to services I run. The truth is, complete carte blanche for either side is untenable. 99.99% of well-behaved clients are tacitly ignored, I'm not against those that deliver malware, or bypass rate-limiting having their day in court.
Laws need to be clear about where the line is though. If circumventing rate limiting is illegal then that should be explicit, including the criteria used to determine that a service is in fact rate limited in such a legally binding manner. As it is an API is available but somehow is not considered public (criteria unclear) and thus engaging with it in certain ways (criteria unclear) is out of bounds.
If we want using a service to perpetrate a crime to itself be an additional crime then that should be made explicit. In the (unlikely) event that NSO wasn't actually perpetrating any crimes against the end users then that fact is probably what needs to be fixed.
Given the nature of who the stakeholders are, the neatest way to achieve an end is to target authorization. It focuses on the how instead of the who or what.
This reduces embarrassment for stakeholders, protects sources and methods, and sends a message.
The law is as broad as can be. If it were a US National instead of NSO Group, some crazy calculation of damages would be used to extract a plea in lieu of a thousand months in prison.
THE CFAA is definitely ripe for reform. It wouldn't be hard to argue it's broad and vague. There's definitely this overarching sweep of online behaviors that could easily be classified as benign.
i dont think users of whatsapp would have standing against people hacking whatsapp to get their data.
whatsapp owns the systems, so its up to whatsapp to sue
The thing of value isn’t in WhatsApp in this case.
You can’t sue a dude for stealing a screwdriver to break into your home with. Your tort is the act against you.
What?
So if someone robs a bank and empties my safety deposit box I can't sue them because it was the bank that had the money, not me?
Well, haven't you heard? The issue with your analogy is: you don't own your data.
(One might argue that it's similar with "your" money ((in the bank)) , but that's not the point)
Different scenario. The bank is a bailor — they have an duty of care for property in their possession that you retain ownership to.
You can sue the thief for stealing your property and the bank for negligent bailment. Same concept as a valet crashing your car.
If someone steals the ownership registry the bank maintains regarding the deposit boxes-- may be the better analogy. Or list of the owner and box number. Clearly this is information the bank controls, not the individual.
> fake client to send some messages that the original application wouldn't be able to send which provide information about the target users' device
> I doubt I'm the only person here who has ever made an alternative client for something before
I think the distinction here for "exceeds authorisation" is pretty apparent. I don't read this judgement as being damning for people wanting to make their own clients.
They made a third party client for deliberately malicious purposes. If you go ahead and make a discord client with the intention of spamming or otherwise causing harm to its users, I think it's completely reasonable for you to get in trouble for that.
> with the intention of spamming or otherwise causing harm to its users
That sounds hopelessly ambiguous to me. What if Google decides that making use of yt-dlp is causing harm to them? What is the criteria here?
We wanted email spam to be illegal and so it was explicitly made illegal. We wanted robocalling to be illegal and so it was explicitly made illegal. In such cases we have (reasonably) clear criteria for what is and is not permitted.
I thought Whatsapp and signal share the same encryption
It was a buffer overflow in a VOIP stack:
* https://www.theverge.com/2019/5/14/18622744/whatsapp-spyware...
Interestingly enough, Signal (and others) had the same sort of vulnerability on Android from a WebRTC stack:
* https://googleprojectzero.blogspot.com/2020/08/exploiting-an...
The big issue in both cases is that the exploit was triggered before the user answered the call.
I think the moral here is that a secure messenger should not execute inherently insecure code (i.e.complex code) on behalf of entities that are not really well trusted by the user. The default should be always plain text.
> I think the moral here is that a secure messenger should not execute inherently insecure code (i.e.complex code) on behalf of entities that are not really well trusted by the user. The default should be always plain text.
Whattsup and co, are very happy to execute untrusted code: images displayed in messages, websites fetched and rendered. Basically a bad actor's wet dream.
The other moral here is to stop using memory unsafe languages. It's just so incredibly dumb that we keep making excuses for this.
> The other moral here is to stop using memory unsafe languages. It's just so incredibly dumb that we keep making excuses for this
Has your "memory safe" language been audited for security ?
I think most influential companies such as Microsoft snd Google have said that c and c++ need to be deprecated. I think replacing old code with memory safe languages takes time, effort and money. Hopefully in a decade we can this can be fully done.
Does Rust make RCE impossible?, I don't think it does.
There is the option of not having data and code sharing the same stack, that seems like a better solution to me but that's such an option is not usually talked about.
It makes this kind easy pivot to RCE impossible. Attacks these days are generally more sophisticated than simple buffer overflows, fwiw. Targeting function pointers from a heap overwrite gives the same capabilities.
> Does Rust make RCE impossible?, I don't think it does.
Well, RCE (cargo) is built into it. /s
Was the spyware persistent? That is, would a reboot clear it? Not that it matters. Presumably, the attackers were so motivated they would re-infect the device the moment they saw it go dark.
No and you've provided a good reason why it doesn't have to.
The encryption isn't alleged to have been compromised. The app itself deals with a lot of untrusted input (eg, thumbnailing video files you've been sent) so there's a meaningful attack surface outside the protocol itself.
note for signal users: in settings, you can disable link previews and automatic media download.
Why are link previews a problem? Presumably I only generate previews for links I've vetted.
It seems like most of the exploits come down to blowing up a parser of one data format or another. Myriad from which to choose, they are written in C for historical reasons, and probably play fast and loose with validation in the name of performance.
True, I guess you're right.
The group exploited a bug in WhatsApp to deliver the spyware. It wasn't an E2E issue.
> A U.S. judge ruled on Friday in favor of Meta Platforms' (META.O), opens new tab WhatsApp in a lawsuit accusing Israel's NSO Group of exploiting a bug in the messaging app to install spy software allowing unauthorized surveillance.
The attack wasn't targeting the encryption part of whatsapp (afaik).
Encryption is important but it often is not the weakest link in the security chain.
People have to start assuming that any communication method in use is compromised. There’s just no way on earth orgs like the NSA would throw their hands up in the air and not find multiple different avenues into an app like signal. Its one of the most downloaded messaging apps. Investment into compromising it is very worth while. People should just assume everything involving a cell phone or computer is inherently insecure. Meanwhile for some analog methods (one time pads, even cupping a hand and whispering into anothers ear, etc), the power balance isn’t so lopsided between the state and the individual as it is with digital communications where everything is probably compromised in some way by now.
Password managers are such a high target that I wonder how we’ve convinced people to put all their passwords in the same software.
Depends on your threats.
I’m more worried about financial scams than I am anything related to government. Password managers with random passwords are an excellent guard against that threat.
If I were worried about state actor threats, any keys or passwords would be memorized.
I'm not sure that would be a good idea. Do you, personally, want to be the weak link in the chain to something a nation state wants?
Whether I know the password, or I know how to access the password via a password manager, I am still the weak link.
The point is that a password manager is an additional weak link in the chain.
Well, hacking the password manager doesn’t involve you meeting a $5 wrench.
Kinda sounds like I prefer to be compromised via password manager…
Back to using the same password everywhere then.
Bitwarden is already a big step up from what most people are doing, then if you want to hide from gouvernement you better make sure you save your password on extremely secured device. But that's another treat level from the average Joe.
A great number of comments and posts on this site rave in favor of password managers and their use for "security" and convenience, despite what you say being such a very obvious flaw.
KeePass has been around for ages for free.... surprised cloud solutions are so popular
Well no Chinese should be using software that involved Americans. That is just common sense. When the chips are down everyone gets drafted by their country's security apparatus.
> "Surveillance companies should be on notice that illegal spying will not be tolerated."
That is kinda funny, although sad at the same time
On the flip side, I guess that means META allows WhatsApp users being only “legally spied” on
Every social media company allows legal spying. Warrants and wiretap orders are issued every day in the United States.
With end-user-device-controlled e2ee, the only information available to law enforcement is metadata. With a warrant, they could seize your device (or the backups, if unencrypted)
Unfortunately, I don’t think end-to-end encryption guarantees much when it comes to legal intercept in proprietary messaging apps. The intercept functionality could be done in the client and capture data, not just metadata.
Why hasn't any evidence of such client-side interception ever been surfaced? Reversing apps and software has been done since forever, and has been used to discover things the app-makers don't want made public - such as unannounced new products, but this happens perennialy with Apple & OS updates, and upcoming features in apps that are behind flags.
> Why hasn't any evidence of such client-side interception ever been surfaced?
In such scenario only the target of the wiretap would receive the modified client application. Both google and apple allow pushing updates to small subset of users. It's not unthinkable that they also have the (internal) ability to push a specific update to a specific user.
But I guess now you'll move the goalpost to ask "Why hasn't any Googler come forward and admitted it's happening?" That is a fair question, but I think most people would see this legal spying as no big deal and perhaps even a good thing.
> It's not unthinkable that they also have the (internal) ability to push a specific update to a specific user.
So the lack of evidence is itself evidence of another layer of nefarious activity? Are Apple in on it too (since they approve updates control the app store roll-outs)? I have no stomach for debates over unfalsifiable scenarios - your position is clearly set in stone.
Isn't that obvious though? Meta wants exclusive spying rights to its users. You spying on users with Meta's products is not allowed. If you want to spy on your users, build an app that's so popular billions of people sign up willingly to allow you to spy on them. Have you no decency?
> Meta wants exclusive spying rights
You're allowed to say "The NSA", we're all adults here. No need to speak in euphemisms.
"Unauthorized hostility against pioneer detected"
Which is ironic considering the FBI and CISA just today announced that you _should_ use WhatsApp and not use SMS for two factor authentication. Although they point out the biggest problem is mobile users click on links in SMS. We live in a mostly captured and anti consumer environment. I'm not sure there's any great advice.
https://www.newsnationnow.com/business/tech/fbi-warns-agains...
Of course there is. Always prefer an authenticator app over SMS. Also, Passkeys are supposed to be a big upgrade in this regard.
Whatsapp is not still vulnerable to the hack (as far as we know) and SMS applications have had similar vulnerabilities in the past.
There should be no difference with usual botnet owner/ransomware gangs and such companies. Management should go to prison for good 20-30 years for that and being extradited worldwide. Considering that ransomware gangs are probably less harmful to the society than guys who hack journalists and politicians, putting their lifes at literal risks, not just their pockets.
There should be no "legal" hacking of someone's devices apart from extraction of data from already convicted people in public court with the right to defend themselves
Its not like this is that different than traditional "weapons" (i hate the "cyberweapons" analogy, but if the shoe fits).
Sell guns to governments, even unsavoury ones, it is very rare anything will happen to you except in pretty extreme cases. Sell guns to street gangs, well that is a different story. Like i don't think this situation is different because it is "hacking".
The NSO created/ran cloud instances for each client country and reviewed and approved every target. The didn’t sell weapons like in your analogy. They were effectively assassins for hire.
The problem with selling exploits is you want to maintain “ownership” of the exploit details, lest your customer just take the exploit and sell/use it without paying more or use it to attack you or your friends. This means you end up with veto power. I.e. culpability.
All the cartels in Mexico buy their guns from America and nobody is going to jail over it.
People do in fact get sent to prison for that, straw purchases are a federal felony. Not all of them actually get caught, which is true of any crime.
Except when the ATF does it, no big deal
More information about this: https://en.wikipedia.org/wiki/ATF_gunwalking_scandal
Kind of like the CIA importing heroin and cocaine. The laws cover this scenario but we have a problem with especially poor enforcement when the crimes are committed by parts of the government.
And meanwhile, if the government sells guns to cartels... no big deal. Rarely throw a fall guy under the bus. Or often not even that.
Trying to remember the quote I last heard, something to the tune of "we don't want to punish, we want to educate", which was about "educating" LEOs and entire police departments they shouldn't be selling fun switch guns illegally to gangs and private buyers.
(And do I even have to mention "fast and furious?" Hah! Feds get it the easiest.)
Certainly the ones that hack journalists should go to prison.
Anyone can be a journalist, so the requirement should be that all of us have our human rights protected by criminalizing this heinous behavior.
Why should journalist badge provide some kind of protection shield? [1]
[1] https://en.wikipedia.org/wiki/Pablo_Gonz%C3%A1lez_Yag%C3%BCe
In Israel's opinion? It shouldn't: https://en.wikipedia.org/wiki/List_of_journalists_killed_in_...
Israeli forces killed 38x more journalists than Hamas did on October 7th.
Also by now the number of people killed in Gaza by Netanyahu is very close to the number of Ukrainian people killed by Putin. Did anyone suggest sanctions against Israel for that genocide? Nope, they enjoy their full immunity and keep going forward with a massacre that has the same exact motivation as the Russian invasion: rob other people of their territory and resources. Two war criminals, two rogue terrorist states, yet two completely different weights.
I agree with the first part, at least in spirit.
The second part though doesn't make sense. If the US president can send drones to kill terrorists without taking them to court, surely he can order hacking their phones. If you think that there's no case where the latter is ok you shouldn't you fight against the former first?
> send drones to kill terrorists
The part that you miss is, are they only killing "terrorists" extrajudicially? To take that propaganda at its face value is to ask, what else could they be killing brown people for, if not terrorism?
To further this. Look at how easily they are bringing terrorism charges on American citizens now (check out the Mangione case)
And I would guess they’ll use the opportunity to increase the reach as well
I didn't say if I think that drone killing is justified or not, since I have no opinion on that - I don't know enough to form an opinion. I only say that since the government have the right to send killing drone it doesn't make sense to raise pitchforks against phone hacking
The thing is, extrajudicial murder justified by labeling the victim “terrorist” is illegal and should not be accepted in a free and open society.
The ‘terrorist’ label was invented as a means of abrogating human rights by governments who felt they were encumbered by the obligation to protect human rights. “Terrorist” labeling is a totalitarian-authoritarian apparatus to avoid culpability for its actions when a government decides the easiest solution to its problem is outright murder.
Do you not think that terrorism exists, that the label has been co-opted for other purposes, that terrorists cannot be treated as combatants, that non-declared-war conflicts should not have deliberate strikes or something else?
It seems to me like terrorism has a pretty plain definition: Using violence against civilians/non-combatants to further a ideological goal, primarily via fear.
It's often misused as an excuse, but there are actual terrorists, the word has a meaning and we should not let it be watered down by either the people wanting to use it as an excuse or the people trying to shroud terrorism in something else.
Every single nation state in the context of this discussion has murdered civilians/non-combatants to further an ideological goal and are thus guilty of acts of terrorism - in the case of the US, for example, terrorism is official doctrine used for regime change across the world. The US literally funds, arms and supports terrorist groups whenever its ruling military determine that their domestic population has no stomach for outright war - in most cases, in fact, terrorism is how the US gets its regime change designs implemented.
As citizens of nations which use terrorism as a tool for their political purposes, it is long since past the point we let ourselves be bullied by terminology and started instead to enforce the legislation required to rid our own ranks of war criminals - who are factually terrorists.
And now watch as the definition is stretched to fit whatever the powerful want to do
Like how they are now charging the UHC CEO suspect with terrorism
Then, if you support the guy, now a terrorist, well then you can be called a terrorist too
I don't get what's happening in this thread. This is a pretty clear statement: hacking isn't worse than the killing that the government is already allowed to do. It's a pretty straightforward argument which for some reason seems to be being misunderstood.
I'll gently push on the premise though: hacking isn't worse for the victims than death, obviously, but I think it's possible weaponizing of exploits does more total damage. Both collateral, due to the manufacturing of exploits which ultimately leak and harm a bunch of unrelated actors, and because the marginal hacking is lower cost, practically and politically. So a given attack is likely to be used against groups we'd recognize less clearly as "terrorists" / deserving of the harm / etc.
Thanks for the understanding. I'll say that because of that we should make the price for using the device much higher. For example using it should require authorization by process that will involve a stiff political price/barrier. Maybe a bi-partisan committee. Something of that sort.
> I have no opinion ... I don't know enough to form an opinion.
Why speak in hypotheticals supporting some phantom opinion? Concern trolling is even worse.
It is not hypothetical, the fact is that killing drones are used in practice, and it just doesn't make sense to oppose lesser measures that are being used without judgement when killing is allowed.
> killing is allowed
You said it is okay / allowed because "terrorists". Otherwise, it is a heinous crime. Just like the Pegasus one.
Ever heard of drone papers?
I have no idea what you are talking about. Ok is a value judgment which I didn't state. Allowed is a fact. Are you arguing with what I'm saying or with an opponent in your mind?
> I have no idea ...
This is what you wrote:
"The second part though doesn't make sense."
If the US president can send drones to kill terrorists without taking them to court, surely he can order hacking their phones. If you think that there's no case where the latter is ok you shouldn't you fight against the former first?"
> Ok is a value judgment ... Allowed is a fact
Factually, genocidaries are worse than terrorists.
L O L. No Israelis are ever extradited to the US for anything even though the US essentially financially bankrolls that entire country. It's basically a place we allow to go gloves off to militarily threaten our enemies, so we can sit back and maintain the "rights-based world order" without catching flak for our own deeds.
Friday, October 20, 2017:
WASHINGTON - Stanislav Nazarov, 46, a dual citizen of Israel and Russia, has been extradited from Israel to face charges in an indictment accusing him of taking part in an international money laundering scheme.
But hey, it's a free planet, and you can believe whatever you want to belive. I certainly wouldn't want to get between you and one of your pet narratives.
https://m.jpost.com/opinion/article-712631
https://repository.law.umich.edu/cgi/viewcontent.cgi?params=...
https://www.timesofisrael.com/diaspora-pedophiles-increasing...
You're very aware what I'm saying is true on a general scale. Sure, exceptions exist. You also know that the aid the US gives is significant and if it hadn't been given every year for decades, Israel would be nothing like what it is right now, it may not even exist.
Try refuting all the Israeli newspapers above which talk about how difficult it is to extradite obvious criminals from Israel. Apologies that you took my comment starting with "L O L" as if I literally meant no person ever in history has ever been extradited. Only a shockingly large portion have not been and will not be, enough to attract attention in the Israeli and foreign press.
Imagine if they chase NSO as hard as they chased Wikileaks
NSO helped Saudi kill a journalist for an American company and the father of American citizens.
And we're still huggy buddies with Saudi's Crown Prince and Netanyahu. Citizens lives only matter so much to our corrupt rulers
Well NSO does their work for them, so that’s not gonna happen
Also, look at how the govt has acted in the last year or so, they will never move against Israel
Unfortunately, incorporation is how you whitewash normal criminal culpability to just a cost of doing business fine.
Capitalism is neat that way. Diffusion of responsibility.
after spending time with pegasus / that group of tools for a few years can honestly say if you have family, friends etc the damage isn't that bad
if you are a refugee or fleeing with ambiguous rights etc it could lead to death but that is mitigated by the fact the people buying may not necessarily be able to get deep into the weeds to figure out how it works most get the leaked source follow a playbook etc
so most western journalists should be safe unless they incurred the wrath of five eyes or something at which point running would be futyl :)
There are many other companies beyond NSO Group, if I were a journalist I would write a more comprehensive list of them and educate about this whole "industry".
NSO Group is unique in that they are entirely sheltered from (largely due) criticism by their government, creating an unaccountable and injust basis of relations between the United States and Israel that many readers are concerned by. There simply aren't any other comparably corrupt "cybersecurity" outfits in the world.
Kinda similar to how the IDF has never been charged with war crimes despite several of their service-members being recorded breaking the law in their Israeli fatigues. It's not that international law was never broken, it's that Israel considers themselves above the rule of law and international bases of morality. That type of behavior absolutely must be called out in it's lonesome, such that no nation ever repeats Israel's embarrassing mistake.
Very few companies’ work results in outright murder of the targeted victims.
If you know of any other cyber criminal organizations like the NSO, where governments use their tools to select and murder targets, please describe them.
The previous commenter's point is that NSO is simply the firm in this space that you happened to have heard of. There are many more.
so many more i love being on HN for the same reason i live marvel movies everyone believes in rights n shit lol
once you meet your first transnational human trafficking ring with full fledged dev teams etc NSO seems very ethical among its ilk if you hear about it in the news its the tip of the iceberg
this is a really good source: https://www.surveillancewatch.io/
Like Verint, who tried to buy the NSO group, and has security DVRs in Walmarts all over the world...
Source?
Can you share some?
It is hard to believe that NSO group is allowed to operate. They sell technology to horrible places, they cause death torture, and a host of less horrible things.
Yet they are protected by the US and Israel, which I believe is the case that they have backdoors into all of it, and getting the targets to actually install this malware on their own saves a lot time.
All good, except for the actual real world victims.
> It is hard to believe that NSO group is allowed to operate. They sell technology to horrible places, they cause death torture, and a host of less horrible things.
That describes the entire Israeli defence industry, and a fair sized portion of Israel's cybersecurity industry, based on the stomach-churning sales pitches I've received.
NSO are not unique, they just got unlucky.
It describes the entire defense industry, and a fair sized portion of the cybersecurity industry, full stop.
> based on the stomach-churning sales pitches I've received.
Care to elaborate? This could be news story-worthy
How do you "not" allow them to operate? People write things like this that seem premised on the idea that Bahrain wouldn't have implant technology if you shuttered NSO, but the only thing that would actually change is who the invoice got sent to. These companies have an unbeatable value proposition, lots of competition, and the lowest capital investment requirements of any intelligence product.
I really feel like people aren't thinking this stuff through. Exploits and implants are not rocket science. There aren't a huge number of people in the world that are world-class at reliably exploiting modern targets, but it's not like there's just like 20 of them or something.
later
In case it's unclear from the comment: I don't think this is a good thing. I'm speaking positively, not normatively.
> premised on the idea that Bahrain wouldn't have implant technology if you shuttered NSO, but the only thing that would actually change is who the invoice got sent to
So what? Does this mean we should sell our arms to any horrible enemies of our state because if we don't, China will?
Many many of these regimes target Americans. Kashoggi had American citizen kids. Why do we allow our own citizens to get harmed because we have to love Israel and NSO so much? Who gets paid to look the other way?
everybody tortures kills its all the same like Mary Kate the smart ones have figured out how to do it without attracting attention
ever heard of fingers in fedex boxes being sent to mothers in the states? does that make fedex liable?
probably not NSO is just the weak kid thats been caught and is the punching bag
> ever heard of fingers in fedex boxes being sent to mothers in the states? does that make fedex liable?
FedEx operates a service known to be used by criminals but also of so much utility to the average citizen that the government has an entire service to provide the same thing.
The government doesn't provide spyware to anyone commercially and neither should we tolerate companies that do.
NSO Group: Relationship with the Israeli state
https://en.wikipedia.org/wiki/NSO_Group#Relationship_with_th...
I'm quite surprised by the corporate history section.
Specifically, NSO Group is worth a lot less than I thought it was, even at its peak. ($1B+ valuation)
Also, the amount of infighting is... Surprising perhaps? Less surprising is the number of spinoffs out of it, and the number of competing Israeli spyware groups.
I'm constantly surprised by how good he Israeli startup environment seems to be.
Why is this? How are there so many acquisitions out of there?
Things like this are similar to law firms. The shelf life of vulnerabilities means that there isn’t a lot of intellectual property owned by the company. The value is in the people’s skills.
So once people get really good they quickly realize they can make more by starting their own company and siphoning off client relationships.
Valuations don’t really matter in their playing field. It’s more about power and politics, rather than raw numbers.
Didn't the US fund those guys to do exactly that?
The US often does unlawful things.
Especially using willing 3rd parties to allow for plausible deniability.
It is only legal and ethical when we do it.
You have to be really bad if Meta are somehow the good guys in the article.
The victims are the good guys. Meta is just not happy that their platform was exploited. Even if you consider them to be the bad guys, they needed to sue to curtail the bad PR
You’re right. That’s the right way to look at it.
Well, good. But also: build better software.
Ahem we don't do that here. We get to market faster before our runway ends so we don't risk our exit.
If it's approved by the AppStore, then it should be good, no?
made me chuckle needed this :)
I support this.
It’s not possible to be “perfect,” but if we do our best to get there, we’ll make really good stuff.
It’s unlikely to happen, though, as we have a system that explicitly rewards writing crap, because it makes money.
As long as we fail to reward good work, we will continue to get poor work.
> As long as we fail to reward good work, we will continue to get poor work.
I think that's a bit off. The problem is that we continue to reward poor work so the poor work continues.
That's correct. I was being generous.
Note that even my fairly mild statement was not received well. People really don't like discussion of improving the Quality of software, here. Too much money to be made in not-so-good stuff.
Correction: people don't really like low-quality comments that don't bring anything to the table beyond "let's make everything better".
Come on, you know me better than that.
In this case, the comment fit the conversation. The original comment was a short, pithy, and rather sarcastic one that was, nonetheless, correct. They pointed out that we need to write higher-Quality software, in order to give folks like the NSO people fewer “hooks.” The NSO folks are smart, dedicated people, that, in other circumstances, we would admire for their creativity and intelligence. They often take advantage of mistakes (or deliberate decisions) made by folks that we may find less admirable.
I like this community and medium, and sincerely want to be a “good citizen.” The opportunity to interact with people like you, is a privilege that I respect and value. We may not always agree on everything, but I find many of your contributions to be inspiring, educational, and relevant, so I appreciate you. You have taught me lessons, and have changed my mind, and, I’m sure, will continue to do so. You have great insight, knowledge, and experience, which I value, and appreciate you sharing it (for example: https://saagarjha.com/blog/2023/12/22/swift-concurrency-wait...). People like you, are why I like this place. We have no social interaction, so I have no idea if we’d get along, IRL. I would like to think we would, but I’m often wrong, and not afraid to promptly admit it.
For myself, I try to participate by making very specific suggestions, and “keeping it focused on me.” I don’t attack others, even if I find what they say to be quite offensive (or if they attack me, which is fairly common). Most times, I don’t feel that my comments would improve things, even if I vehemently disagree with someone, so they are best left unsaid. I don’t participate in any other social media, and I’m retired, so I do spend a fair bit of time, here.
I spent most of my career at a corporation that was all about Quality, and I suppose it must have rubbed off on me. At that company, Quality was a religion, and they took it to the point of obsession. After leaving, I have tried to practice their mindset in my continuing work. I write software that can have a big impact on the lives of its users, so I take Quality seriously, in order to reduce things like attack surface. I feel as if the current tech community has a baseline ethos of “write code as badly as we can get away with,” and that ethos is rewarded. I don’t think that treatises on better unit testing will be of interest to folks with that mindset. I feel as if the mindset, itself, is the issue, and code dumps won’t make a difference.
I often reference stuff I’ve written, not because I want traffic (I could absolutely care less, whether or not folks read my stuff. I write for myself), but because I don’t want to litter the place with “wall of text” commentary (as you can see, I lean prolix). A quick link to an article that I wrote, going into great detail, is better than a massive comment that won’t have as much information.
For example: https://news.ycombinator.com/item?id=42478993
Are those articles specific enough?
I don’t think you’ll find anyone who would disagree with the premise that we should improve software quality. Yes, even the people who value iteration speed and shipping. All things being equal, better quality is always better, because of course it is.
The problem arises when all things are not equal, and something needs to give. Perfect quality is generally not attainable or even desirable, because it sacrifices things in other areas that we care about even more. Sometimes the value of something is high enough that we will pay the price for it failing in some cases. That’s just how we do a cost-benefit analysis. I say this even though I work in software security, where most of my job exists and is made difficult by “bad” quality, and a lot of my effort goes into figuring out how to improve that. Depending on the circumstances, I may advocate for the balance to be adjusted in favor of more security (at the expense of something else) and sometimes I may actually decide that this is counterproductive. That’s really my actual response to the comment.
However, as you probably noticed, I didn’t reply with that. I called it low-quality. In fact I think the whole discussion is low-quality, not because it is not a real point, but because it’s not interesting. I understand and appreciate that you have worked on software quality throughout your career. I want you to be proud of your efforts in this area. And it’s completely reasonable to point to that and go “this is what’s missing from our industry”. It’s not actually very novel or actionable. So, despite me not actually voting on the thread, I felt it was not valuable.
When I was in high school I happened to be pretty decent at physics. In fact I won some awards and was nationally ranked. This is kind of like your situation, except of course my skills were less general and also more ephemeral. But it’s as if I, given my arguably decent understanding of physics, went “the problem with climate change is that we’re using too much energy”. First of all, this doesn’t actually use any of those skills to proclaim. Even someone who failed high school could probably tell you that. But secondarily, and more importantly, I haven’t actually said anything useful. My knowledge of mechanics is great but solving climate change is a huge problem, both deeply technical but also social and political. It’s a lot harder than going “stop applying force over distance to things”. The same is true for preventing exploits: I’m sure you’re great at writing apps that have low defect rates, but when it comes to protecting against nation-state threats there’s a whole lot going on beyond “let’s not make any mistakes”. More relevant would be a discussion about, say, memory safety, or auditing, or whatever that is actually on-topic and actionable. What you’ve posted is something that is really just a “hear hear here’s an obvious problem let’s fix it” which invites nothing beyond people who will do nothing but agree with you, or somehow twist it into their pet peeve and rant against it. Neither is against the rules but I think it doesn’t make for insightful conversation, so I’m telling you about it now.
Point taken.
But I feel that the root cause is attitude and encouragement. Sort of “the wolf you feed” kind of thing.
That’s not really something that can be addressed by technology or even education.
That’s the kind of thing that we handle with social infrastructure. Peer pressure, cultural norms, “tribal knowledge,” etc.
In my mind, the best way to approach that, is by contributing small, almost “throwaway” human-interaction-level “course corrections.” We set the examples we want others to follow, and talk about why we do stuff, as opposed to always making it about how.
Some of the most valuable lessons that I learned about Quality, in my career, were offhand comments, made by folks that lived Quality, and demonstrated the required mindset.
One of the specific things I’d also like to emphasize, being in this industry, is that people often misjudge how to make their software secure. Yes, it involves caring and some level of quality of course, but you can write a perfect, well-designed, award winning app that people love with all the care that goes into that. That won’t stop NSO Group from completely and utterly hacking it. So to some extent yes it is a problem of not caring enough about your software but I want to make it clear that it’s not something your average developer can fix if they just tried harder. You need someone who is an expert in this stuff involved. This is different from UI design in that you can kind of work through it yourself with the appropriate amount of effort. In security, if you don’t actually know what you’re doing, you will do it wrong regardless of how hard you try. Even the people who know what they’re doing make plenty of mistakes. There is some basic tribal knowledge that I’m sure you’re familiar with (“parse, don’t validate”, “principle of lowest privilege”, “type systems and memory safety prevent bugs”) but you can’t really peer pressure someone into making secure software if they’re past the point of not being completely incompetent.
Sounds like what is needed, is humility, and maybe folks that know how to do it, making the information more accessible.
That’s not always something folks want to do. Information is valuable.
> My knowledge of mechanics is great but solving climate change is a huge problem, both deeply technical but also social and political.
> More relevant would be a discussion about, say, memory safety, or auditing, or whatever that is actually on-topic and actionable.
It's curious that the first sentence mentions social and political issues, whereas the second sentence completely ignores them. The original comment of ChrisMarshallNY was addressing the social and political issues in tech, albeit vaguely.
You also mention valuing "iteration speed" without acknowledging the predictable devastation this has on quality.
Shipping less, and shipping slower, is on-topic and actionable.
The biggest barriers to addressing global warming are social and political. Many powerful people don't want to address it. Indeed, they've intentionally promoted the idea that the problem doesn't even exist. Purely technical discussions are futilely rearranging the deck chairs on the Titanic if they ignore this.
I do think that ChrisMarshallNY misdiagnoses the problem a bit:
> I feel as if the current tech community has a baseline ethos of “write code as badly as we can get away with,” and that ethos is rewarded.
The second clause of the sentence is redundant, because the first clause is the heart of the matter. Anyone who operates purely according to financial incentives will inevitably cut corners. Crap is profitable, for various economic reasons that are beyond the scope of this comment. In order to achieve high quality consistently, you have to care about quality, about craftsmanship, independently of financial awards. This doesn't mean you don't care about financial awards, just that you have to care about both quality and money. For lack of a better term, you need business ethics, where some ethical principles are inviolable. You can seek profit without seeking profit maximization.
Note that religion is largely independent of financial considerations:
> At that company, Quality was a religion, and they took it to the point of obsession.
See, now we’re getting somewhere. This is far more interesting than just going “we need quality”.
> It's curious that the first sentence mentions social and political issues, whereas the second sentence completely ignores them.
I didn’t talk about them here because I wasn’t really interested in getting into an argument about it. I think you know me well enough to agree that I am well aware of the social and political implications of these kinds of attacks, and that I do actually care about them quite a lot. It’s just that this comment section and even sometimes Hacker News in general is not a great place to talk about a country’s policy on offensive cyberattacks or industry opposition preventing moving to safer practices, for example.
> You also mention valuing "iteration speed" without acknowledging the predictable devastation this has on quality.
You know I don’t actually necessarily think this is as simple as you say it is. Obviously rushing to ship will lead to worse quality. But being able to iterate and release software faster can sometimes have a positive impact on quality. Compare the quality of our favorite vendor’s browser to, say, Google’s: I think it is quite reasonable to say that the software quality of the latter is actually far higher, and bugs get fixed faster, specifically because of their release cadence. Now, I don’t actually want to use Chrome and there are a hundred people working on sneaking in ads into it or whatever, but it’s not actually “ship slow and get it right”.
> Anyone who operates purely according to financial incentives will inevitably cut corners.
I think (vaguely, don’t hold me to this) that societally we do too little to punish this and that uncut corners should be valued more highly. But again you don’t hear me going “yeah everyone sucks because of money” as my comment because I don’t think this is a novel insight and I have nothing more to add. This was the reason why I said the software quality discussion wasn’t super interesting.
> the social and political implications of these kinds of attacks
> Hacker News in general is not a great place to talk about a country’s policy on offensive cyberattacks
That's not what I was referring to. By "the social and political issues in tech", I meant the general issues involved in building software, the internal and external cultures of the software developers.
> But being able to iterate and release software faster can sometimes have a positive impact on quality. Compare the quality of our favorite vendor’s browser to, say, Google’s: I think it is quite reasonable to say that the software quality of the latter is actually far higher, and bugs get fixed faster, specifically because of their release cadence.
You might have cause and effect reversed here. You suggest that the results are due to the engineering practices of the companies, whereas I would suggest that the engineering practices of the companies are a result of the values of the companies. It does appear to me that Google inherently cares more about security than Apple, and as far as I can tell, Google has more of an engineering-led culture than Apple.
Having said that, I don't think this is as simple as you say it is. ;-) For example, Google Chrome has a user-hostile silent forced updates system, which is what allows them to ship constant updates, whereas Apple Safari has a more user-friendly system where there's visibility and choice: you can see the pending updates in System Settings and choose when or even whether to install them. The latter type of update system is much less conducive to constant, frequent updates, because that would annoy users.
I don't understand why Apple has chosen to tie Safari updates to OS updates, on iOS and on the latest macOS, especially since the same Safari updates are not tied to OS updates on macOS N-1 and N-2. I mean, I understand why the major OS updates in the fall bring major Safari updates, but I don't understand why the subsequent minor Safari updates couldn't come separately, which will give Apple more flexibility to patch security vulnerabilities and other bugs in Safari.
Back to Chrome, I'm not sure I agree that its release cadence is good. First, Chrome has a public release schedule, and schedules are the death of software quality. Fixing bugs as soon as you can is fine, but forcing yourself to release things at certain fixed dates, simply for the purpose of releasing something, is not fine. The calendar is governing the release, not the readiness of the software. Moreover, Google Chrome is constantly, constantly, constantly introducing new features and other changes that have nothing to do with fixing bugs, which means that Google Chrome is constantly, constantly, constantly introducing new bugs, including new security vulnerabilities.
Apple also has a schedule: major new OS updates go out every September, no matter what. And this practice, the forced schedule, creates major quality issues. Ready or not, the updates must ship. Apple has more flexibility between Septembers, but unfortunately, contemporary Apple has also adopted the practice of using "minor" updates to constantly, constantly, constantly introduce new features and other changes that have nothing to do with fixing bugs. Part of the reason behind this is that Apple's forced yearly schedule doesn't give the company the time to finish things they've been working on and even promised at WWDC (another forced yearly schedule with self-imposed big announcements).
All of this is in stark contrast to "the good old days" when major Mac OS X updates had no fixed schedule. Of course the 10.N updates were still buggy, as major software updates always are, inevitably and predictably, but the major updates were infrequent, and they weren't forced on users. To the contrary, you had to go to a retail store and pay $129 for the privilege of receiving the discs to install a Mac OS X 10.N.0 version. The early adopters were self-selecting. And the minor 10.N.M updates were almost exclusively bug fixes without new features, so you had increasing quality over time, up and until the next major update.
> I think (vaguely, don’t hold me to this) that societally we do too little to punish this and that uncut corners should be valued more highly.
Perhaps, but I consider reward and punishment to fall under the same rubric as "incentives". And "getting tough on crime" rarely if ever works, for various well-known reasons. For example, wrongdoers don't believe they'll get caught, until they do get caught, making the punishment largely irrelevant to preventing the actions. And powerful people are very good at escaping the worst punishments even when they do get caught, as the powerful people tend to control the system of rewards and punishments.
IMO the only effective way to encourage good behavior and discourage bad behavior is to teach and foster personal ethics. The "incentives" have to be internal to one's own mind rather than external to one's body. Ethics make you do the right thing even when nobody is watching, even if you never get rewarded or punished. No system, no matter how "perfectly designed" can turn a bunch of bad people into a good, well-functioning society. The quality of the society depends essentially on the personal qualities of its members.
> I don't understand why Apple has chosen to tie Safari updates to OS updates
The main reason is because of WebKit, which is a built-in OS SDK.
If they update WebKit, then Safari also needs to be updated, to satisfy the new links, if for no other reason.
Aaaaand it's flagged out of the front page. @dang, so early in the day this is obviously some coordinated manipulation.
31. 206 points 9 hours ago US judge finds Israel's NSO Group liable for hacking journalists via WhatsApp (reuters.com)
22. 37 points 8 hours ago My Pal, the Ancient Philosopher (nautil.us)
15. 4 points 4 hours ago Testing for Thermal Issues Becomes More Difficult (semiengineering.com)
18. 11 points 2 hours ago The Christmas story of one tube station's 'Mind the Gap' voice (2019) (theguardian.com)“@dang” doesn’t do anything. Email hn@ycombinator.com.
Correct. If someone had emailed hn@ycombinator.com sooner, we would have fixed this sooner.
Probably done by the same NSO Group. But for US americans they are the good criminals, the chosen criminals
I'm shocked! But don't worry, I'm sure the nytimes, wsj, ap, etc will run hit pieces on this outrageous behavior by israel.
Dang doesn’t buy that anything ever actually happens here (just like the meme). I’m pretty sure dang is deeply associated with the IC.
Oh you guys.