Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple sues NSO Group to curb the abuse of state-sponsored spyware

apple.com

Post reply on HN
Print view View original

181–190 of 477 posts

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#181

Post by ethbr0 »

brutal_chaos_ wrote: post #147
voxic11 wrote: post #89

Earlier quoted context omitted.

They are just using the EULA as the basis for claiming jurisdiction. They are actually suing not to stop reverse engineering but rather to recover damages incurred by unlawful business practices. Basically their argument is that: 0) The defendant's can be sued under California law because they accepted the EULA. 1) California law makes businesses liable for damages incurred by their unlawful business practices. 2) Bu…

Nit (maybe moot): > 4) Apple incurred damages […] from expenses related to mitigating the hacking of their users. This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. Put another way, that also sounds like the corporate open source push, "We love open source because we don't have to support it, the community will!"…

From Facts(C),

"60. Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades.

61. These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial."

Hopefully the judgement is able to split the hairs between reputational and development harm to a company for security vulnerabilities, and harm to users for organized exploitation of those vulnerabilities.

The former feels like it should be free speech -- statement of facts related to the company's product(s). The latter is an obvious wrong.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#182

Post by LogonType10 »

ccouzens wrote: post #145
josh2600 wrote: post #102

Earlier quoted context omitted.

Can you point to a single instance of a cellphone vendor who takes security more seriously than Apple? Put a different way, is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? Apple can always do better. It should also scare the living hell out of us that they’re currently the best in the world. My point is that if Apple can’t secure you…

> Put a different way, is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? I'm going to answer about operating system rather than device. The selling price of an Android full chain with persistence zero click is up to $2.5 million. The selling price of an iOS full chain with persistence zero click is up to $2 million. https://zerodium.co…

This isn't the benchmark of how secure those systems are, just a benchmark of how valuable exploiting them is. Hypothetically speaking, iOS could be more secure, but an Android exploit could be valued more if high valued targets tend to use Android. Keep in mind that phone OS usage varies quite a bit by country and wealth.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#183

Post by kmonsen »

ethbr0 wrote: post #157
theginger wrote: post #101

Earlier quoted context omitted.

What is great is it could bring some much needed clarity on the subject. A ruling against the EULA might bring some clarity to the limits of powers tech companies have over us. A ruling for the EULA might shine a light the power these companies DO have and force governments to bring in laws to curb them. It is not a good situation, where Apple / Microsoft could turn around and say to someone who broke the EULA or per…

What normal people probably want is the state of affairs that historically existed: Government (legislative) mandates via law what rights consumers are entitled to, that cannot be stripped from them. Companies are free to request waiving or agreeing to anything not enumerated in the above. What's broken down recently is that legislatures aren't doing their job of proactively mandating consumer rights, and consequentl…

Realistically speaking we have no legislature anymore.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#184

Post by Sporktacular »

nickff wrote: post #142
Sporktacular wrote: post #117

Earlier quoted context omitted.

I get bothered by the use of the term "nation-state" in this context. And I thought I was pedantic.

> "I get bothered by the use of the term "nation-state" in this context. And I thought I was pedantic. " I don't think I'm being pedantic, it seems like people use the word 'sponsor' in these contexts to exaggerate and vilify. Nobody seems to have used the word 'nation-state' in this post; what made you think of it?

It's used throughout the comments and the topic generally. I don't call it out (for meaning a state with borders aligned with an ethnicity) because I get the point being made.

As for sponsorship, states sponsor their industries by providing labor trained at public expense, promoting them abroad through trade agreements, access to trade representation etc. so there is the technical definition of sponsorship met.

The revolving door between Unit 8200 and surveillance startups is documented as is Israel's courting of KSA and the UAE with access to intelligence sharing and capabilities as a bargaining chip. And why wouldn't they? It's good for the state and its industry. Just sucks for everyone else.

The definition of sponsorship doesn't matter when it is met in every sense of the word.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#185

Post by catlikesshrimp »

ziddoap wrote: post #160
rektide wrote: post #144

Earlier quoted context omitted.

This sits so unwell with me, gives such limitless tyrannical & dictatorial control to a company. > As much as people might look at this and think Apple is being heavy-handed, it comes down to the fact that iCloud, iOS, and the App Store are their IP and they can (within legal limits) set whatever terms they please. Agreed. That's exactly what it seems like. And that sounds like immoral, unjustifiable, sickening hell.…

> Agreed. That's exactly what it seems like. And that sounds like immoral, unjustifiable, sickening hell. That Apple gets to hold all the cards, no one else on the planet gets any say in how a device might be used. I'm not a big proponent of IP, but you're basically saying it is immoral, unjustifiable, and sickening as hell that Apple enforces the rules that Apple wants on Apple products/services, which were created…

The law works fine when there is no monopoly.

But since Apple has 50% of the market share, the law doesn't work well anymore.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#186

Post by Sporktacular »

josh2600 wrote: post #41
rasengan wrote: post #28

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). Let’s, just for a second, propose that apple went full M…

It's not clear the user experience would have to suffer. Maybe there are more groups doing for software architecture what Signal did for messaging. Groups like Heisers' SEL4 and Qubes. As for expense, imagine how much more we would have paid today, in real and opportunity costs, if over the last 20 years everyone used this "no such thing a perfect security" fatalism as the excuse to not just do things a bit better.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#187

Post by boomboomsubban »

sharklazer wrote: post #163
tzahifadida wrote: post #129

If you think that israel is doing anything not sanctioned by the US government you are mistaken. In Israel NSO cant make a move without 7 agencies regulating it. This is considered a weapon sale. The same weapons the US are sponsoring israel and buy them from israeli industry. There is no way NSO will fail from this. So eula or whatever these are matters between states for national security interests.

The only thing I can add to what you said is another cynical thought of mine, starting with the question of why would Apple waste the money in this case? And the only answer I can come up with is that they need to re-establish their image of "security". I can't help but feel with various actions taken by them in recent times this being anything more than theatre unfortunately. If they prevail, I wonder if it will sim…

>why would Apple waste the money in this case?

To set a precedent that they can claim damages for violating their terms and conditions.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#188

Post by notyourday »

Apple simply needs to exercise its right to deplatform everyone who works for NSO. Oh and deplatform all government wonks of government of Israel as it is allowing NSO Group to operate.

Life in 2021 is very difficult without a smartphone. In fact it is so difficult that if working for NSO comes with "no smartphone forever" sticker NSO won't be able to find people to work for it.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#189

Post by ccouzens »

LogonType10 wrote: post #182
ccouzens wrote: post #145

Earlier quoted context omitted.

> Put a different way, is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? I'm going to answer about operating system rather than device. The selling price of an Android full chain with persistence zero click is up to $2.5 million. The selling price of an iOS full chain with persistence zero click is up to $2 million. https://zerodium.co…

This isn't the benchmark of how secure those systems are, just a benchmark of how valuable exploiting them is. Hypothetically speaking, iOS could be more secure, but an Android exploit could be valued more if high valued targets tend to use Android. Keep in mind that phone OS usage varies quite a bit by country and wealth.

I was responding to a specific comment about prices.

You're right that the price doesn't fully correlate with security. It will reflect supply (security and interest of researchers) and demand (how much there is to be gained by breaking into each platform).

Android is more widely used, but I gather more money is spent in the app store than the play store. I don't know the market share of "interesting" users.

My analysis would be that the number shows they're not that far apart. I'd be skeptical of anyone (IE apple's press release) saying that either platform is more secure. Security is too nuanced to be expressed as a total order.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#190

Post by LogonType10 »

ccouzens wrote: post #189
LogonType10 wrote: post #182

Earlier quoted context omitted.

This isn't the benchmark of how secure those systems are, just a benchmark of how valuable exploiting them is. Hypothetically speaking, iOS could be more secure, but an Android exploit could be valued more if high valued targets tend to use Android. Keep in mind that phone OS usage varies quite a bit by country and wealth.

I was responding to a specific comment about prices. You're right that the price doesn't fully correlate with security. It will reflect supply (security and interest of researchers) and demand (how much there is to be gained by breaking into each platform). Android is more widely used, but I gather more money is spent in the app store than the play store. I don't know the market share of "interesting" users. My analy…

Agreed! Thank you for posting that Zerodium link. It's always great to bring substantive data into a security discussion.
Post reply on HN