Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pavel Durov listed in leaked Pegasus project data

theguardian.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Pavel Durov listed in leaked Pegasus project data

#21

Post by beagle3 »

zeropoint46 wrote: post #18
fsflover wrote: post #7

Earlier quoted context omitted.

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

Just curious if maybe you or anyone else knows. Are alternatives OS's such as lineage, postmarketOS, copperheadOS, etc. safe from this exploit?

Likely not ; they might be, by chance - but the exploits are often for bugs in places like media parsing libraries (e.g. jpeg decoder), which are not usually modified in those alternatives.

Different compile settings might render an exploit ineffective. But I’d expect any remotely popular Android derivative (e.g. lineage) to be tested by the attacker - and even postmarketOS, which is not Android based, is likely to use some of the same media parsing libraries.

Re: Pavel Durov listed in leaked Pegasus project data

#22

Post by eingaeKaiy8ujie »

zeropoint46 wrote: post #18
fsflover wrote: post #7

Earlier quoted context omitted.

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

Just curious if maybe you or anyone else knows. Are alternatives OS's such as lineage, postmarketOS, copperheadOS, etc. safe from this exploit?

GrapheneOS is an Android distribution focused on security and it's likely to protect you from this. Read this Twitter thread https://twitter.com/GrassFedBitcoin/status/14168360691237847....

>GrapheneOS is heavily focused on security enhancements making exploitation significantly harder:

>grapheneos.org/features

>Those other operating systems [Calyx and Lineage] don't improve resistance against exploitation and won't provide more resistance against an exploit working against AOSP/stock.

>If they specifically target GrapheneOS and put work into adjusting their exploit chains and finding new bugs as necessary, then they could certainly develop an exploit working against GrapheneOS. Costs will be higher and they'll usually need to specifically take it into account.

>Firmware exposed to remote attack surface like the radios (Wi-Fi, Bluetooth, cellular, NFC) and GPU is generally a lot harder to exploit than the OS and those components are isolated. It's much rarer and generally involves using an OS exploit to bypass the component isolation.

>Nearly all of these exploits are memory corruption bugs. GrapheneOS does actually provide hardening for firmware through attack surface reduction including the LTE only mode and other features. It can't directly harden firmware, but it can avoid exposing as much attack surface.

>So, for example, with the GrapheneOS 4G only mode enabled, vulnerabilities in 2G, 3G and 5G are not usable to exploit the cellular radio, only those exposed by 4G.

>The radio firmware also does have substantial hardening and internal sandboxing, but GrapheneOS can't improve it.

>GrapheneOS also fortifies the OS against exploitation by an attacker that has gained code execution on a component like the GPU or radio.

>Main hardening we provide is for the most common path of exploiting an RCE bug in userspace and then exploiting the kernel to escape sandbox.

GrapheneOS runs only on Pixel phones which have great hardware security.

Also, DON'T USE CopperheadOS: https://grapheneos.org/history/copperheados

Re: Pavel Durov listed in leaked Pegasus project data

#23

Post by [deleted] »

zeropoint46 wrote: post #18
fsflover wrote: post #7

Earlier quoted context omitted.

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

Just curious if maybe you or anyone else knows. Are alternatives OS's such as lineage, postmarketOS, copperheadOS, etc. safe from this exploit?

[deleted]

Re: Pavel Durov listed in leaked Pegasus project data

#24

Post by eingaeKaiy8ujie »

Y_Y wrote: post #16
fsflover wrote: post #7

Earlier quoted context omitted.

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

I love my PinePhone but I can't run WhatsApp on it. I suppose I could use an emulator, but it's slow enough already.

You shouldn't use WhatsApp. It's a product of a spyware company.

Re: Pavel Durov listed in leaked Pegasus project data

#25

Post by kaba0 »

fsflover wrote: post #7
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

GNU/Linux don't even have a notion of security let alone having anything comparable to even backdoored android/ios.

I think your best bet would be a Pixel phone with GrapheneOS, though I'm not sure whether it was effected here.

Re: Pavel Durov listed in leaked Pegasus project data

#26

Post by shantara »

csydas wrote: post #19
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

>> Personally, I wasn't worried: since 2011, when I was still living in Russia, I’ve got used to assuming that all my phones were compromised. I know it's fun to slam on Telegram (and for sure its encryption has flaws, I really don't think anyone denies this), but everyone needs to understand the mindset of Durov and what I'm guessing is the mindset of russian-born telegram developers: your phone can be compromised,…

In my previous job I have worked for a company that developed enterprise focused encrypted chat apps. When interviewing potential hires, one of the first general questions we asked was to give a high-level list of possible attack vectors on an installed app and its user data. Very few developers even considered the OS and device themselves as a potential threat, despite these interviews taking place well after Snowden revelations.

Re: Pavel Durov listed in leaked Pegasus project data

#27

Post by lootsauce »

Pretty tired of seeing people surprised and concerned when they get a look at how the sausage is made like this. Bill Binney in 2002 and Edward Snowden in 2013 should have disabused us all of any pretense of order and justice in this system.

World governments, Big Tech be like: "We are shocked, shocked! to find back doors and spying in here!"

The two work in tandem to facilitate the needs of each other. This is just the new military industrial complex for an age of hybrid war. Not going away any time soon, no matter how we feel about it.

As pointed out in another post today "A key product of ubiquitous surveillance is people who are comfortable with it" [1] All of the revelations with no recourse or reform lead to what we have now, everyone assumes big brother is watching and thats just how big brother wants it.

[1] https://news.ycombinator.com/item?id=27904820

Re: Pavel Durov listed in leaked Pegasus project data

#28

Post by kjaftaedi »

underseacables wrote: post #11
boomboomsubban wrote: post #8

Earlier quoted context omitted.

There are security and privacy reasons not to publicly dump leaks like this, and the distrust of the media should be somewhat offset by multiple outlets analyzing the data separately. That said, I'm unsure how the media could twist "x country spied on y individual." Knowing the types of people being spied on, it should be assumed most people of similar importance are being spied on by someone.

I take your point, but what echoes in my mind is when the Hillary emails were leaked, and people like van Jones were saying no you’re not allowed to look at that, but we the media, we are allowed to look at that. They could redact information, but I lament that my trust in the media is so low that I cannot fully trust it without seeing the raw data myself. Even having that raw data available would give me more confid…

What are you going to do with the phone numbers of 50,000 important individuals?

What sort of cost-benefit analysis are you doing that makes you think your right to see other people's PII trumps their privacy?

Re: Pavel Durov listed in leaked Pegasus project data

#29

Post by c7DJTLrn »

fsflover wrote: post #7
shekhirin wrote: post #4

Durov's post from his Telegram channel ( https://t.me/durov ): The phones of 50,000 individuals, including human rights activists and journalists, have been targeted by surveillance tools that were used by numerous governments. These tools can hack any iOS and Android phone, and there is no way to protect your device from it. It doesn't matter which apps you use, because the system is breached on a deeper level. Acco…

If you want to fight the Apple-Google duopoly, consider GNU/Linux smarthones Librem 5 and Pinephone.

Sorry, but Linux phones are a joke. The sad reality is that there is nothing on the market today that provides the security most of us here want.

Re: Pavel Durov listed in leaked Pegasus project data

#30

Post by Y_Y »

eingaeKaiy8ujie wrote: post #24
Y_Y wrote: post #16

Earlier quoted context omitted.

I love my PinePhone but I can't run WhatsApp on it. I suppose I could use an emulator, but it's slow enough already.

You shouldn't use WhatsApp. It's a product of a spyware company.

Haha, you're right about that. It's the only method of communication with many people and businesses around here. Which puts it roughly in on a par with the old-school phone network, except that has an oligopoly of spyware companies.
Post reply on HN