Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pegasus spyware found on journalists’ phones, French intelligence confirms

theguardian.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#51

Post by sofixa »

JumpCrisscross wrote: post #43
PradeetPatel wrote: post #31

Is there no regulatory or compliance requirements for surveillance software? Instead of blaming the victims of pegasus, we should focus our attention on the lack of actions from key policymakers and regulatory bodies. It is not possible for every individual to be a technical expert when it comes to malware removal, but we can reduce the likelihood of misusing surveillance software by creating an ethical framework aro…

> Is there no regulatory or compliance requirements for surveillance software? Nope! It's not even clear if Pegasus and its employees broke any laws. (Though I would love to see CFAA and copyright law tested against this.) Optimistically, this might be the wake-up call to change that.

IANAL but lots of countries have laws against gaining access to computing devices or data without prior authorisation.

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#52

Post by bsder »

PradeetPatel wrote: post #31

Is there no regulatory or compliance requirements for surveillance software? Instead of blaming the victims of pegasus, we should focus our attention on the lack of actions from key policymakers and regulatory bodies. It is not possible for every individual to be a technical expert when it comes to malware removal, but we can reduce the likelihood of misusing surveillance software by creating an ethical framework aro…

To me, it would seem that this kind of software trips over all kinds of European laws and directives. Hell, it probably trips over all kinds of wiretap laws in the US.

Is it that nobody is filing these or just that the revelations are too new and that the lawyers are just beginning to spin up?

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#53

Post by jhgb »

robgibbons wrote: post #44
_rdvw wrote: post #34

Slight OT: the malware indicators of compromise that Amnesty International released have no license, thereby prohibiting use in other projects as far as I understand. https://github.com/AmnestyTech/investigations/issues/11 If anyone can help on that front it'd be much appreciated.

IANAL but arguably, those indicator files are merely lists of information, and therefore are not subject to copyright. They are not, on their own, a creative work. https://www.nolo.com/legal-encyclopedia/types-databases-that...

But that page says things like "[when] no judgment is needed to decide which names and addresses should be included". Surely somebody decided what are the things for a classifier to look for, and that would be a creative decision?

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#54

Post by robgibbons »

jhgb wrote: post #53
robgibbons wrote: post #44

Earlier quoted context omitted.

IANAL but arguably, those indicator files are merely lists of information, and therefore are not subject to copyright. They are not, on their own, a creative work. https://www.nolo.com/legal-encyclopedia/types-databases-that...

But that page says things like "[when] no judgment is needed to decide which names and addresses should be included". Surely somebody decided what are the things for a classifier to look for, and that would be a creative decision?

Again, IANAL, but a decision whether to add a domain or email address to one of these lists is not a creative decision, it's a mechanical boolean decision. It's a matter of fact, not of creativity or subjective inclusion. The regex pattern they used might be an example of a creative work, but the list of matches is probably not.

In the same sense, recipes are not copyrightable. The thought that goes into composing them may be creative, but the list of ingredients itself is not subject to copyright.

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#55

Post by mtnGoat »

stavros wrote: post #12
benque wrote: post #10

Earlier quoted context omitted.

One man's journalist is another man's .... ;-)

And the same invariable lie is always used, "oh, don't worry, we're only going to use this against the bad guys". Bad guys only exist in a world without nuance.

bad guy is a just not a term that should be trusted when coming from politicians at this point. "bad" is an opinion in the sports of politics and power, because they are worried about their own hind end, not that of the state at large.

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#56

Post by cronix »

mcguire wrote: post #28

" Bredoux added: “It takes a bit of time to realise it, but it’s extremely unpleasant to think that one is being spied on, that photos of your husband and children, your friends – who are all collateral victims – are being looked at; that there is no space in which you can escape. It’s very disturbing.” " Welcome to the future! It's pretty much the same as the past, only more effective.

A depressing thought experiment a professor once posited many years ago....Hitler comes to power in the internet era and now has state of the art tools to find people of certain traits, vs manpower and spies to discover them. Ability to go through your entire lives digital footprint. Every picture. Every video you've created, or viewed on a website. Every location you've visited, how long you were there, and who was around you. Everything you've ever searched. Everything you've ever purchased. Every contact you have. Content of email, text, phone calls, etc. All keyword searchable with beautiful charts and graphs showing how you relate to everyone you've ever come into contact with.

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#57

Post by fsflover »

cronix wrote: post #56
mcguire wrote: post #28

" Bredoux added: “It takes a bit of time to realise it, but it’s extremely unpleasant to think that one is being spied on, that photos of your husband and children, your friends – who are all collateral victims – are being looked at; that there is no space in which you can escape. It’s very disturbing.” " Welcome to the future! It's pretty much the same as the past, only more effective.

A depressing thought experiment a professor once posited many years ago....Hitler comes to power in the internet era and now has state of the art tools to find people of certain traits, vs manpower and spies to discover them. Ability to go through your entire lives digital footprint. Every picture. Every video you've created, or viewed on a website. Every location you've visited, how long you were there, and who was…

It's pretty much what we have in China now.

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#58

Post by gruez »

fartcannon wrote: post #50
pvarangot wrote: post #30

Earlier quoted context omitted.

The Pegasus thing didn't even survive a reboot, it was reinstalled by using the 0-day again on a fresh boot. Replacing the image would have done nothing if they were flashing a version that still had the iMessage vulnerability.

But if that imessage vulnerability was FOSS and you could flash your own image, you could fix it and move on with your life.

>But if that imessage vulnerability was FOSS and you could flash your own image

1. the vulnerability wasn't FOSS. It was kept under wraps because otherwise it would get discovered and apple would patch it

2. what makes you think that amateurs working in their free time can patch 0days faster than the vendors themselves?

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#59

Post by bilbo0s »

cronix wrote: post #56
mcguire wrote: post #28

" Bredoux added: “It takes a bit of time to realise it, but it’s extremely unpleasant to think that one is being spied on, that photos of your husband and children, your friends – who are all collateral victims – are being looked at; that there is no space in which you can escape. It’s very disturbing.” " Welcome to the future! It's pretty much the same as the past, only more effective.

A depressing thought experiment a professor once posited many years ago....Hitler comes to power in the internet era and now has state of the art tools to find people of certain traits, vs manpower and spies to discover them. Ability to go through your entire lives digital footprint. Every picture. Every video you've created, or viewed on a website. Every location you've visited, how long you were there, and who was…

We have all that, just without Hitler in power. At least in the US anyway, the government has access, should it become necessary, to a comprehensive catalog of your activities and communications. It's just that they should get a warrant before accessing it, which I'm not naive enough to believe that they do in all cases.

The ship already sailed on the whole "ubiquitous gaze" thing.

Re: Pegasus spyware found on journalists’ phones, French intelligence confirms

#60

Post by gruez »

pdkl95 wrote: post #18
dewey wrote: post #16

Earlier quoted context omitted.

> it would be easy to guarantee that you can get a rootkit-free phone The problem in this case is that you get the malware installed through a no-click required iMessage and not a "supply chain" attack on the image your phone is running on. How would that help?

It could help by simply being sufficiently different . The only reason this type of malware is such a widespread problem is the large monoculture of potential targets. Just like in agriculture (e.g. potatoes, bananas), a monoculture allows a single pathogen to affect an entire crop. In security this is a class break [1]. Utilizing different software implementations limits the scope of this type of attack. The current…

On the flip side, having a monoculture is good because you made more eyes looking at the same piece of code.
Post reply on HN