Live data from Hacker News

NSO hacked WhatsApp to spy on top government officials at U.S. allies

reuters.com

251–260 of 321 posts

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#251
post #121

What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?

My experience with Israeli companies suggests that a culture which values intellectual achievement and competition is more widespread there. Similar cultural enclaves exist elsewhere in the world and are presumably similarly effective, but they just aren't as large a portion of the population. Even small cultural differences can have outsized effects because of pollination-- e.g. it's easier to learn from an expert i…

My experience is the exact opposite. There is a culture of laziness and most offices are carried by a handful of outstanding people and propped up by significant foreign investment.

The difference with Israel, specifically in regards to hacking, is purely the amount of government support and protection independent actors receive for things that might otherwise be considered nefarious in other countries.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#252
post #131

What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?

There is no reason why other well educated countries could being doing the same thing, but with the Israeli's, nothing is off the table. If a company in Israeli learns how to hack WhatsApp, that is seen as an advantage for the Israeli government. If an American company learns how to hack WhatsApp, they bound by ethics to let WhatsApp know and make sure the issue is fixed. Israeli culture thinks that is crazy to do th…

The US also has export restrictions on crypto and other tech, which makes this kind of business harder for US companies. Especially with countries that aren’t strong Us allies.

When I worked in the radar business we couldnt just sell them to anyone.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#253
post #204

Earlier quoted context omitted.

I know a military contractor working on stuff for non-Nato airforces. These guys use WattsApp for everything. It blew my mind.

Fun fact, a few of my friends and even family work for NSO and until recently they used WhatsApp for their own internal communication. They literally moved off it a few days ago when shit hit the fan into more secure software because Facebook is targeting NSO employees.

Specifically what more secure software? Im looking for a secure messenger now.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#254
post #229
post #202

Don't forget that some disgruntled employee stole the software a few years ago. So who knows who has access to this. https://m.calcalist.co.il/Article.aspx?guid=3741738

That website made my screen go black and my phone get hot!

That wasn't just me!?

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#255
post #204

Earlier quoted context omitted.

Fun fact, a few of my friends and even family work for NSO and until recently they used WhatsApp for their own internal communication. They literally moved off it a few days ago when shit hit the fan into more secure software because Facebook is targeting NSO employees.

Specifically what more secure software? Im looking for a secure messenger now.

Signal is usually one of the more popular one for a more secure alternative.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#256
post #216

Earlier quoted context omitted.

'On the one hand WhatsApp probably have more people working on the app' From a career in software development, I tend to feel that the more devs, the buggier. Maybe, MAYBE (number of QA)/(number of devs) = reliability coefficient.

Correlates with my experience, too, however size of the QA team is not a reliable indicator. I've seen it first hand where the QA is huge, but doesn't have good devs, only people that point out process flaws.

A QA team is trying to find bugs with the current release. They are not looking for mitm attacks or misuse. That would be more security who are generally looking for more obvious issues at the network level.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#257
post #201

The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…

NSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.

That's really clever. Using a custom made program or something obscure would be the only safe way.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#258
post #246
post #201

Earlier quoted context omitted.

NSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.

Security by using obscure software has its own problems, alas. You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.

The more obsure and different the less likely. If closed source the knowledge belongs to the creators. If the circle is extremely small the chance of that knowledge being shared with your enemy is low. It goes up when that circle is increased.

When you want the biggest circle open source is safer. If your circle is small closed will be safer.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#259
post #246
post #201

Earlier quoted context omitted.

NSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.

Security by using obscure software has its own problems, alas. You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.

Within my experience, security by obscurity works only if you're low profile. If significant amounts of money will be spent decrypting your mess, it's game over.

OTOH, we usually only hear about the failed attempts, so there's a selection bias.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#260
post #246
post #201

Earlier quoted context omitted.

NSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.

Security by using obscure software has its own problems, alas. You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.

Terminology: vulnerability or flaw is what the good guys are looking for. Exploits are implementions of the attack enabled by the vulnerability.
Post reply on HN