Live data from Hacker News

Apple sues NSO Group to curb the abuse of state-sponsored spyware

apple.com

41–50 of 477 posts

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#41

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this.

The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!).

Let’s, just for a second, propose that apple went full Monty and locked the whole shebang down with the kind of tech they’d need to resist NSO. That’s more custom silicon, signed binaries everywhere, even fewer per app permissions, literally treating any piece of software running on the device as a potential threat vector even more than they already do. What would this get you?

The BoM cost would go up, a lot. The cost of writing software would go up, a lot. And perhaps worst of all: it would only raise the cost of a chain of exploits, not eradicate it.

Right now a chain of exploits is ~$5M on iOS. What if it was $50M? Would that actually stop a nation state?

I’m sorry but there’s no world where Apple can make perfect security.

Finally, the cost of this lawsuit is a drop in the ocean compared to what they already spend trying to secure the software and hardware in iOS devices.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#42

Earlier quoted context omitted.

There's no way it hasn't been escalated to a diplomatic level already, that's probably the biggest impediment to the suit doing anything. Both NSO's host country and client base get an incredible amount of protection from the state department.

This doesn't take into account recent events, e.g. the U.S. sanctioning NSO after their dealings in India and with American police departments was confirmed. In any case, this is a civil suit in federal courts. Even if State wanted to intervene, it would have to do so through informal channels.

Their website is still up, posting news, hosted on AWS on one of the us-west AZs.

The US is going at them with less vigor than a whack-a-mole torrent site de jure.

> In any case, this is a civil suit in federal courts. Even if State wanted to intervene, it would have to do so through informal channels.

But didn't we just agree that the federal court system is pretty toothless here without the support of the state department?

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#43
post #33

Earlier quoted context omitted.

The pdf was literally right in the link: https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_11... UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

A portion of the community only reads the headlines and forms their opinion based on that alone, I'm not saying it's right, I'm just trying to add some context to what appears to be your incredulity at the parent commenter's question.

I read the whole article, but didn't read the entirety of the separate element that first contained the link to the article as printer friendly text.

There's a pretty big UX failure to stick important content there.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#44
post #3

Where did they sue NSO group? If it's a US suit, I don't see that meaning much. Why wouldn't NSO just ignore it in that case?

"Venue", meaning where the suit may take place, is a complicated legal beast. Apple is in the US. NSO Group agreed to certain T+Cs when they opened their fake iCloud accounts. That T+C probably says you agreed to be sued in California.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#45
post #7

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: > The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those a…

I will just add, the author of the NYT piece has a book out on this subject. The book is decent, has some cringe worthy descriptions of technical things if you are a technical person, but overall I learned a huge amount reading it.

A lot of the commentary, accusations, and opinions in the comments here would be addressed or better colored if you're interested enough to read her book (https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...).

Also, just to be clear, one of the reasons I like the book is because it's written by a person that doesn't understand all the deep technical aspects of these things.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#46
post #11

The amount of time that Apple sat on this is telling. First reports on NSO activity are from 2016, Facebook filed in 2019, Apple iOS 14.8 fix released in Sept 2021. Only when the constant negative news about NSO started chipping at their reputation, did they decide to make this symbolic (and ultimately ineffective) move.

Read the New York Times article. It says that Apple was only able to file this suit because of a court ruling in a similar suit by Facebook and because it was given code that showed it how Pegasus works. There is nothing at all "telling" about Apple's timing.

I am all for Hanlon's razor.

But it reads to me as: Apple legal team has to act because Facebook suit (and the info made public) makes it impossible to say that "Apple was not aware" of such and such details.

To me it is much easier to believe the above, compared to your "Apple is only now seeing this info, and only now is aware, and only now can act".

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#47
What about Apples own spyware they were going to force on users to scan for CSAM did they ever make a final decision on what they were going to do with that? Update to iOS 15 is what they recommend but then it is Apple spying on you not some foreign companies. I don’t want either.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#48
post #38
post #32

The framing of NSO as "state-sponsored" cannot be overstated, and Apple didn't miss the chance to do just that. A hard blow to Israel's policy just as much as it is to NSO itself.

One could interpret this as the software is "sponsored" by the governments that finance their operations and purchase their products. This would be countries like Saudi Arabia, Mexico, Germany, and Kazakhstan, not necessarily Israel. Though the fact the US has sanctioned an Israeli business does seem to have potential implications on Israeli policy. [1] [1] https://www.reuters.com/technology/us-blacklists-four-compan…

Beyond merely selling their products to Israel, the NSO Group itself is an Israeli firm, founded by ex-Israeli intelligence, and whose products are subject to Israeli national export controls.

https://en.wikipedia.org/wiki/NSO_Group

That's a level of sponsorship way beyond simply being a customer... that's state espionage served with a side of profit. It's evil when the USA does it, it's evil when the Russians do it, it's evil when China does it, it's evil when Israel does it... but nobody does anything about it because all those states would prefer strong surveillance rather than rights for activists and journalists.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#49
post #33

Earlier quoted context omitted.

A portion of the community only reads the headlines and forms their opinion based on that alone, I'm not saying it's right, I'm just trying to add some context to what appears to be your incredulity at the parent commenter's question.

I read the whole article, but didn't read the entirety of the separate element that first contained the link to the article as printer friendly text. There's a pretty big UX failure to stick important content there.

[deleted]

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#50

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). Let’s, just for a second, propose that apple went full M…

> I’m sorry but there’s no world where Apple can make perfect security

i think everyone knows that perfect security is not possible, the operative word being ‘perfect’. i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today, which would still be miles and miles away from ‘perfect’, vulnerable to nation state actors etc etc etc

Post reply on HN