Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple sues NSO Group to curb the abuse of state-sponsored spyware

apple.com

Post reply on HN
Print view View original

51–60 of 477 posts

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#51

Post by cronix »

reaperducer wrote: post #19
udev wrote: post #11

The amount of time that Apple sat on this is telling. First reports on NSO activity are from 2016, Facebook filed in 2019, Apple iOS 14.8 fix released in Sept 2021. Only when the constant negative news about NSO started chipping at their reputation, did they decide to make this symbolic (and ultimately ineffective) move.

Read the New York Times article. It says that Apple was only able to file this suit because of a court ruling in a similar suit by Facebook and because it was given code that showed it how Pegasus works. There is nothing at all "telling" about Apple's timing.

I think it also didn't hurt for the US Dept. of Commerce to add NSO Group to the Entity List for Malicious Cyber Activities just 2 weeks ago. It certainly doesn't hurt your case for the US Gov't to officially list them.

> NSO Group and Candiru (Israel) were added to the Entity List based on evidence that these entities developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers. These tools have also enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent. Such practices threaten the rules-based international order.

https://www.commerce.gov/news/press-releases/2021/11/commerc...

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#52

Post by kingcharles »

strict9 wrote: post #7

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: > The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those a…

I was the victim of a state-sponsored attack. I took it to court. I tried to subpoena the contents of the government agents' iPhones but Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. The lawyer specifically told me all he does is go around the country and lie to judges to get them to cancel subpoenas.

We introduced the T+Cs from one major online provider to show how the government violated them. The government stipulated that they had violated the T+Cs and that they had broken the law. Two different courts both stated that government agents are allowed to violate federal and state computer and data access laws to conduct intelligence-gathering operations, and they are certainly allowed to violate T+Cs even when a violation of a T+C is a criminal act (which it is in many jurisdictions).

One thing that is lulzy is that I recently received a letter from one government agency stating that the evidence I had requested by subpoena was no longer available because they left it on a server in violation of the T+Cs and never took a copy of it and the provider deleted the account.

It hasn't reached the appellate courts yet.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#53

Post by freejazz »

udev wrote: post #46
reaperducer wrote: post #19

Earlier quoted context omitted.

Read the New York Times article. It says that Apple was only able to file this suit because of a court ruling in a similar suit by Facebook and because it was given code that showed it how Pegasus works. There is nothing at all "telling" about Apple's timing.

I am all for Hanlon's razor. But it reads to me as: Apple legal team has to act because Facebook suit (and the info made public) makes it impossible to say that "Apple was not aware" of such and such details. To me it is much easier to believe the above, compared to your "Apple is only now seeing this info, and only now is aware, and only now can act".

Look, if you don't know how legal standing works, that's one thing. But to reject the explanation provided to you and to cite your own ignorance as a legitimate source of disbelief while you poo-poo away a dispositive fact isn't reasoning.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#54

Post by tpush »

rStar wrote: post #40
reaperducer wrote: post #19

Earlier quoted context omitted.

Read the New York Times article. It says that Apple was only able to file this suit because of a court ruling in a similar suit by Facebook and because it was given code that showed it how Pegasus works. There is nothing at all "telling" about Apple's timing.

except thats it’s curiously well timed for this news to drop at the beginning of holiday shopping, like an advertisement, or possibly, this is pure marketing. nso and apple are partners. apple leaves holes, nso exploit, said holes.

Conspiratorial nonsense.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#55

Post by freejazz »

JumpCrisscross wrote: post #22
monocasa wrote: post #14

Earlier quoted context omitted.

Under what law?

> Under what law? NSO used Apple's services, thereby agreeing to U.S. jurisdiction. (It also deals in dollars and has customers in America.) If it ignores U.S. courts, it would be held in contempt at the very least. That enables the Feds to start freezing and confiscating assets, possibly even issuing arrest warrants. That happens domestically first and through treaties second. Given how much bad blood NSO has genera…

"That enables the Feds to start freezing and confiscating assets, possibly even issuing arrest warrants. That happens domestically first and through treaties second."

It's a civil case.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#56

Post by snowwrestler »

josh2600 wrote: post #41
rasengan wrote: post #28

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). Let’s, just for a second, propose that apple went full M…

You’re not wrong about the impossibility of perfect security.

But Apple is praising and promising to support independent security research in this press release. Meanwhile they have a reputation among independent security researchers for being standoffish, opaque, slow to respond, and even outright hostile in suing Corellium. They settled that suit but the reputation remains.

Apple is the most valuable company in the world. They do not appear to have the best security program in the world. Whatever Citizen Lab can do, Apple should be able to do better; they have a lot more resources and expertise.

I’m not doubting that Apple puts a lot of effort into securing their products. But it seems like they still have significant room for improvement.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#58

Post by rStar »

tpush wrote: post #54
rStar wrote: post #40

Earlier quoted context omitted.

except thats it’s curiously well timed for this news to drop at the beginning of holiday shopping, like an advertisement, or possibly, this is pure marketing. nso and apple are partners. apple leaves holes, nso exploit, said holes.

Conspiratorial nonsense.

unless you understand how tech, business, governments and security services work, then not so much

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#59

Post by kingcharles »

CubsFan1060 wrote: post #6
monocasa wrote: post #3

Where did they sue NSO group? If it's a US suit, I don't see that meaning much. Why wouldn't NSO just ignore it in that case?

The pdf was literally right in the link: https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_11... UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

It's not live on PACER yet sadly so I can't get a case number.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#60

Post by fragmede »

strict9 wrote: post #7

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: > The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those a…

Is it great? The lawsuit is Apple trying to enforce the iCloud EULA to stop reverse engineering. While NSO Group created hacking tools, and then did some questionable things with them, do we really want those inane licenses no one reads, and everyone scrolls down to hit [agree]; do we really want them to legally binding? Put another way, if it was someone HN liked, would we still say this is actually good? Because compared to the corporation known as Apple, NSO Group and its parent corporation are still "a little guy", and this move really doesn't seem like a good thing. Not for hackers in the HN definition for hackers, ie highly motivated tinkerers.

This community features not just fans of reverse engineering, but number of practitioners, eg the popular Nvidia TSEC key extraction that was featured recently[0]. The defendant's actions make them an easy target, but, like the ACLU protecting the civil rights of murderers, because we still live in a nation of laws, I don't see this as great. This is a continuation of Apple's continued use of lawsuits to silence any challenges to their marketing of being the secure computer choice (eg Apple suing Corellium[1]) rather than their products actually being secure.

[0] https://news.ycombinator.com/item?id=29315378

[1] https://news.ycombinator.com/item?id=28219278

Post reply on HN