Live data from Hacker News

NYT journalist hacked with Pegasus after reporting on previous hacking attempts

citizenlab.ca

291–300 of 330 posts

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#291

Earlier quoted context omitted.

How so?

You don’t need any input from the user/target. Once the malicious code reaches the device the exploit works its magic.

An open source cellular modem firmware is long overdue, but there's no government on Earth that would be keen on allowing it to happen, the best we have is 2G/3G stuff that has been illegally leaked and reverse engineered.

A lot of dragons lurking in the dark there.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#292

Earlier quoted context omitted.

You don’t need any input from the user/target. Once the malicious code reaches the device the exploit works its magic.

An open source cellular modem firmware is long overdue, but there's no government on Earth that would be keen on allowing it to happen, the best we have is 2G/3G stuff that has been illegally leaked and reverse engineered. A lot of dragons lurking in the dark there.

The network side is already covered by OpenBTS and srsRAN - I believe the latter is already including 5G.

Wonder what's blocking the client side. Power efficiency? No target market since cheap LTE sticks can be had for under 20€ apiece?

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#293

Earlier quoted context omitted.

Great rec! This is one of my favorite technical podcasts. The host does a great job getting into the technical details of the subjects while still appealing to non-techincal listeners. It's really impressive.

Subbed. Any other recos? Been looking to scratch that Reply All itch.

I really like the Jane Street podcast "Signals and Threads". It goes into how Jane Street (a prop trading firm) solve difficult problems in a hard problem space.

https://signalsandthreads.com/

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#294
post #18

On the other hand, perhaps the hardware/OS designs of iOS and Android devices are fundamentally flawed, when viewed from a security-first perspective.

Yeah. Aren't there even known cases of journalists being tracked through hacks and killed? (Like https://www.cnn.com/2019/01/12/middleeast/khashoggi-phone-ma....) Flawed computer code ever putting people into dangerous situations and being involved with deaths should be considered like the Therac-25 incident: a case study and a call to action to change the industry so that regular practices that solve the issue are in effect everywhere.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#295
post #262

Earlier quoted context omitted.

Android is an even larger attack surface when political people don't take any of the precautions you mention, which they most likely won't. The President of the United States does indeed have a specialized phone that is modified by WH staff to either be only for phone calls or only for twitter/news (which means 2 phones)[0], but they're still iPhones. As long as there's not some 0-authorization 0-click vulnerability…

Could anyone deactivate texts on an iphone or did they get a special iOS version from Apple?

Texts or iMessage?

Texts shouldn't be difficult, just disable on the carrier end. MDM might be able to restrict it further just in case. With iMessage you can just not sign in to an Apple ID. Or use MDM.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#296

I really hope the blur on the picture ( https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima... ) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.

https://en.m.wikipedia.org/wiki/Christopher_Paul_Neil

Pedo who used to swirl his face not knowing people can unswirl.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#297
post #190

Earlier quoted context omitted.

Known font, known range of possible characters (almost certainly ascii), and probably several blurred characters in there that we know (like the t in attachment). If the blur is differentiable per-character, it's probably reversible.

Even without automation. Just make a list of blurred alphanumerics, then match every blurred character in the picture against the character list. with some patience probably doable in a single day

That’s called generative recognition, and it’s the best way to do it (probably can be formally proved under some noise model assumptions) if you have a good model of the data and enough computational resources.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#298

Earlier quoted context omitted.

How can you possibly not escape the use of a smartphone?

Plenty of jobs these days essentially require one, be it for communication, authentication, or what have you.

Preferably, don't take those jobs. Or, if you must, tape the cameras and remove the microphone. Use a wired headset for talking and unplug it when not in use. When not on the job, turn it off and wrap it in aluminium foil.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#299

Earlier quoted context omitted.

I built a redaction process for a small company once. My critical security step was rendering out the PDF as individual flat image files, then re-assembling it like a traditionally photo-copied document. That way the loss-full operation is enforced, at the cost of forcing end users to OCR unsearchable image-scan (like) PDFs.

It's the only way to be sure!

You could replace the censored text with gibberish before blacking it out. Or some secret message for QAnons to find.

Re: NYT journalist hacked with Pegasus after reporting on previous hacking attempts

#300

Earlier quoted context omitted.

Great rec! This is one of my favorite technical podcasts. The host does a great job getting into the technical details of the subjects while still appealing to non-techincal listeners. It's really impressive.

Subbed. Any other recos? Been looking to scratch that Reply All itch.

For staying up to date with infosec news I recommend "Risky business". Very different style of podcast, but a great way for me to stay up to date with the field.
Post reply on HN