Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. State Department phones hacked with Israeli company spyware

reuters.com

Post reply on HN
Print view View original

471–480 of 651 posts

Re: U.S. State Department phones hacked with Israeli company spyware

#471

Post by mike_d »

Cyph0n wrote: post #42
fabianhjr wrote: post #38

Earlier quoted context omitted.

And simultaneusly: - not have any indication their tools were used - canceled the relevant accounts Which "relevant" accounts if NSO's tools weren't used?

I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean nothing.

Well since they do the exploitation on behalf of customers, yes?

NSO is very popular with governments that don't have robust domestic intelligence because all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.

Re: U.S. State Department phones hacked with Israeli company spyware

#472

Post by hugh-avherald »

jacquesm wrote: post #388
NikolaeVarius wrote: post #386

Earlier quoted context omitted.

Everyone spies on everyone else. Reminder that France vacuumed up messages on Enrochat after deploying malware globally, and they have clear text messages from users in any arbitrary country and have not disclosed what they will do with it or what they have. https://www.vice.com/en/article/3aza95/how-police-took-over-...

The specific claim here is that EU countries spy on the US. I do not believe they have that capability, so if you have some proof that would come in handy.

Just to clarify, you're asking for evidence of secret foreign intelligence operations?

Establishing mere capability is pretty trivial: they have diplomats in the United States who can talk to people.

Re: U.S. State Department phones hacked with Israeli company spyware

#473

Post by montblanc »

trasz wrote: post #259
montblanc wrote: post #73

Earlier quoted context omitted.

The U.S basically protects the whole of Europe by subsidizing NATO. It's probably in the trillions. Sorry but Trump had a point there. What it gives Israel is peanuts compared to that. Without U.S support to Europe who knows what happens, maybe the Russians and Chinese start looking at Europe as easy prey to pick on. Also the obsession with Israel isn't a uniquely American thing, it's the same in France and Canada an…

There is no military danger Europe would need protecting from. The only thing US is subsidising is itself: all those trillions go directly back to US and benefit US, not Europe.

no military danger aprart from Russia and China I agree. And perhaps Iran/Turkey etc. Other than that the EU is super secure.

Re: U.S. State Department phones hacked with Israeli company spyware

#474

Post by webmaven »

shmatt wrote: post #173
q1w2 wrote: post #144

Earlier quoted context omitted.

Aside from that obvious contradiction - this also indicates that the tools they deploy are either NSO hosted or use a licensing system to run. There was a recent Darknet Diaries episode that reported evidence that at least some of the NSO tools are hosted services.

I can't imagine something like this not being in the cloud. The potential for a customer to give their local NSA/8200 the tool to figure out the 0days used is too large Pegasus is only as good as its 0days are secret

> I can't imagine something like this not being in the cloud. The potential for a customer to give their local NSA/8200 the tool to figure out the 0days used is too large

Heck, forget about bothering to extract 0-days; if you have access to the binary, straight-up warez techniques would be applied to nerf any restrictions (licensing or otherwise) on the operation of the software, as well as any monitoring functionality that can "phone home".

Re: U.S. State Department phones hacked with Israeli company spyware

#475

Post by smabie »

jacquesm wrote: post #444
smabie wrote: post #436

Earlier quoted context omitted.

I think pretty much everyone has stolen something before, right?

That says more about you than it does about humans in general.

True, but what I've done should say a lot about humans in general right? I'm told I'm human, after all.

Re: U.S. State Department phones hacked with Israeli company spyware

#476

Post by cwkoss »

webmaven wrote: post #446
OneLeggedCat wrote: post #424

Earlier quoted context omitted.

> I don't think we want to live in a world where absolute moral purity (as determined by the most vocal, biased critics of a given person) is required to hold public office. Well lucky you, we have the exact 100% polar opposite of that system currently. I think it would be fine to move toward it a little.

> Well lucky you, we have the exact 100% polar opposite of that system currently. I think it would be fine to move toward it a little. I'm skeptical of the notion that outing public officials (when the blackmail material is personal in nature as posited by the GP) would move toward that goal. I don't even think an exception should be made for material that would expose hypocrisy in policy-making (eg. 'pro-life' lawma…

Why?

Re: U.S. State Department phones hacked with Israeli company spyware

#477

Post by montblanc »

JumpCrisscross wrote: post #233
montblanc wrote: post #223

Earlier quoted context omitted.

That still doesn't mean they knew about this. How would they even know it were American phones? Its very possible it were some IPhone with a Ugandan sim card. How do you know who's using it - do the Ugandans tell you? It's a very real possibility NSO servers simply show some Ugandan number. I have no more knowledge on this than anyone here but I don't find it realistic NSO would take this chance.

> doesn't mean they knew about this Mitigating but not exonerating. (Also, unknown and possibly unknowable.) NSO are still selling cyberweapons hitting the United States. If they didn't give a shit about keeping an eye on their kit, that's a negligent gap in oversight by Jerusalem. It's a good thing we have a talking-not-shooting relationship with Israel. The U.S. would be within its rights to launch a proportional c…

Got it and we don't even mention Uganda in all of this. Makes sense.

Re: U.S. State Department phones hacked with Israeli company spyware

#478

Post by webmaven »

junon wrote: post #227
mjamil wrote: post #189

Is anyone working on a microkernel design for privacy-sensitive devices (like phones) that would prevent outright this class of kernel-level arbitrary code execution exploits? We're stuck with iOS and Android for the foreseeable future, but is there hope that we'll get this right some day? Actually, would a microkernel design even be sufficient? Given that hackers exploit deserialization, memory safety, and variable…

Yep, a number of people are, myself included. OSDev channels have a few people who talk about it. The Fuchsia folks are around, too, and are quite friendly people. They probably have the most hopeful chance of a widespread release, though admittedly I worry about the affiliation with Google getting in the way of pro-consumerism. Just my opinion though.

I wonder if some combination of Fuchsia, Titan, and Tensor would be sufficient to mitigate a baseband processor vulnerability.

Re: U.S. State Department phones hacked with Israeli company spyware

#479

Post by tsol »

sva_ wrote: post #230
maltalex wrote: post #46

I don't understand the focus on NSO in these stories. If U.S State Department personnel in Uganda were shot from an M-16, would the headline mention "an American arms manufacturer"? No, because it's ridiculous. For better or worse, NSO's product is a weapon. How is it any different from an M-16? Where is the outrage towards the people who used this weapon against the State Department?

> For better or worse, NSO's product is a weapon. How is it any different from an M-16? Where is the outrage towards the people who used this weapon against the State Department? It is highly unlikely that NSO group actually gives out their exploits, based on what we know about previous exploitations that have become known. It's more like they offer an interface to execute their exploits on a given target. The fact t…

Hacking as a service is a good way to put it

Re: U.S. State Department phones hacked with Israeli company spyware

#480

Post by jacquesm »

hugh-avherald wrote: post #472
jacquesm wrote: post #388

Earlier quoted context omitted.

The specific claim here is that EU countries spy on the US. I do not believe they have that capability, so if you have some proof that would come in handy.

Just to clarify, you're asking for evidence of secret foreign intelligence operations? Establishing mere capability is pretty trivial: they have diplomats in the United States who can talk to people.

We have plenty of proof of the US spying on allies in spite of those being secret foreign intelligence operations, there is afaik none whatsoever of say the Germans, the Belgians or the French doing something similar to the US.
Post reply on HN