Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NYT journalist hacked with Pegasus after reporting on previous hacking attempts

citizenlab.ca

Post reply on HN
Print view View original

261–270 of 330 posts

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#261

Post by Griffinsauce »

marcan_42 wrote: post #242
boardwaalk wrote: post #239

I feel like phones should just have a "scrub anything that isn't ASCII text" option for paranoid folks. No unicode, no emoji, no media. I mean, I guess they could still f*ck that up, and maybe it'd be admitting defeat, but still.

AIUI part of the problem is that iMessage is a poor legacy design and relies on generic macOS serialization primitives. It's not like HTML where you can just scrub all the tags out. This can't be changed without breaking compatibility due to end to end encryption (the server can't adapt between versions). So there is a big attack surface inherent to the design, and Apple are stuck with it.

> Apple are stuck with it.

Are they?

They have an enormous level of control over their deployed software. It seems like they could push out the required changes and nearly all clients would support it in no time.

For the remaining clients it seems consistent with the feature to simply block incoming messages in the wrong format.

Now, whether they'd want to implement a feature that essentially advertises that they have a security problem is another thing. (the answer is quite obviously no, regardless of what's best for their users)

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#262

Post by dx034 »

judge2020 wrote: post #193
catlikesshrimp wrote: post #134

Earlier quoted context omitted.

"No they are not?" I deserved more than that. Iphones are a standardized attack surface. Apple prefers vulnerabilities not to be found than to be discovered and patched, leading to NSO holding on their discovered vulnerabilities for longer. An android device with no modem (baseband) is definitely more secure. Throw in a hardware switch for camera, mics, and wifi, which iphones will never have.

Android is an even larger attack surface when political people don't take any of the precautions you mention, which they most likely won't. The President of the United States does indeed have a specialized phone that is modified by WH staff to either be only for phone calls or only for twitter/news (which means 2 phones)[0], but they're still iPhones. As long as there's not some 0-authorization 0-click vulnerability…

Could anyone deactivate texts on an iphone or did they get a special iOS version from Apple?

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#263

Post by franga2000 »

johnfn wrote: post #231
fabianhjr wrote: post #220

Earlier quoted context omitted.

I just go solid opaque bar. Way easier to do and harder to screw up.

Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.

The EU has redacted PDFs this way a number of times, but I don't think anything truly sensitive ever leaked.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#264

Post by zrm »

marcan_42 wrote: post #242
boardwaalk wrote: post #239

I feel like phones should just have a "scrub anything that isn't ASCII text" option for paranoid folks. No unicode, no emoji, no media. I mean, I guess they could still f*ck that up, and maybe it'd be admitting defeat, but still.

AIUI part of the problem is that iMessage is a poor legacy design and relies on generic macOS serialization primitives. It's not like HTML where you can just scrub all the tags out. This can't be changed without breaking compatibility due to end to end encryption (the server can't adapt between versions). So there is a big attack surface inherent to the design, and Apple are stuck with it.

There is a known solution to this. You version the protocol. New endpoints talk to each other with the new version, old endpoints that only understand the old version use that. After a period of time there are few enough people who still have the old version and it gets disabled.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#265

Post by microtonal »

Xavdidtheshadow wrote: post #241
bduerst wrote: post #230

Earlier quoted context omitted.

Subbed. Any other recos? Been looking to scratch that Reply All itch.

Very different show, but I enjoy the Accidental Tech Podcast (aka "ATP"). It's a weekly news show that focuses on tech (mainly Apple). They do a good job with technical details and talking through tech product decisions (why did Apple/Google/FB do X? What are its merits?). People have sort of polarized opinions about each of the 3 hosts, but IMO they each have their moments.

I have been listening to ATP for years, and I love it. I didn’t know that there were discussions about them.

To me, one of the powerful things of ATP is that it’s one of those cases where the sum is more than the parts. The hosts complement each other very well.

I also like that, although it’s an Apple-centered podcast, they are willing to take a critical stance towards Apple. I once listened to one of the other major Apple-related podcasts (not Gruber) and the level of fanboyism was cringeworthy.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#266

Post by bayindirh »

johnfn wrote: post #231
fabianhjr wrote: post #220

Earlier quoted context omitted.

I just go solid opaque bar. Way easier to do and harder to screw up.

Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.

I remember that. Unredacted versions were also circulated.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#267

Post by burnished »

saagarjha wrote: post #250
throwawayboise wrote: post #198

Earlier quoted context omitted.

Same way the mafia used to do it when they realized all their phones and cars were bugged. No technology. Talk in person, outside. Seriously, if you are a journalist investigating anything that might upset the powers that be in a nation-state, don't use any online technology and for gods sake not a mobile phone.

It’s very difficult to live a normal life without using technology of some kind.

I think you've gone beyond the bounds of a 'normal life' if you're setting out to piss off that power that be.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#268

Post by emptyparadise »

asdff wrote: post #248
estaseuropano wrote: post #125

Earlier quoted context omitted.

they need an actual functional phone. You can't be a journalist and not have a fully functional phone that access the internet whenever needed. I'm sure they use burners for sensitive stuff, but what are they supposed to use for their regular work, calls with the school, car navigation, ...

Just use a dumb phone and a garmin like journalists did in the early 2000s?

How do you communicate with your sources?

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#269

Post by Xavdidtheshadow »

microtonal wrote: post #265
Xavdidtheshadow wrote: post #241

Earlier quoted context omitted.

Very different show, but I enjoy the Accidental Tech Podcast (aka "ATP"). It's a weekly news show that focuses on tech (mainly Apple). They do a good job with technical details and talking through tech product decisions (why did Apple/Google/FB do X? What are its merits?). People have sort of polarized opinions about each of the 3 hosts, but IMO they each have their moments.

I have been listening to ATP for years, and I love it. I didn’t know that there were discussions about them. To me, one of the powerful things of ATP is that it’s one of those cases where the sum is more than the parts. The hosts complement each other very well. I also like that, although it’s an Apple-centered podcast, they are willing to take a critical stance towards Apple. I once listened to one of the other majo…

That's a good point! They're honestly some of Apple's biggest critics. I feel like I've learned a lot about product design based on their ongoing feedback.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#270

Post by mjevans »

johnfn wrote: post #231
fabianhjr wrote: post #220

Earlier quoted context omitted.

I just go solid opaque bar. Way easier to do and harder to screw up.

Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.

I built a redaction process for a small company once.

My critical security step was rendering out the PDF as individual flat image files, then re-assembling it like a traditionally photo-copied document.

That way the loss-full operation is enforced, at the cost of forcing end users to OCR unsearchable image-scan (like) PDFs.

Post reply on HN