Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. State Department phones hacked with Israeli company spyware

reuters.com

Post reply on HN
Print view View original

521–530 of 651 posts

Re: U.S. State Department phones hacked with Israeli company spyware

#521

Post by colatkinson »

wolverine876 wrote: post #461
Raqbit wrote: post #203

Earlier quoted context omitted.

Google is, with Fuchsia: https://fuchsia.dev

What are they doing?

The "marketing fluff" is here [0]. From my understanding, the relatively novel things they're doing at the lowest levels are making it a microkernel, and using a capability-based security model [1].

The former decreases the Ring 0 attack surface, and the latter makes it challenging to cause a confused deputy problem -- you know, the ol' classic "whoops this daemon running as root accidentally allowed a browser tab to read /etc/shadow." Or the time honored problem of a single exploit in one process giving access to all files (and in some cases, all processes' memory and resources) controlled by a given user. Capabilities also make it relatively easy to sandbox userspace code, and to reason about what it has access to. Kinda like containers, but as a core concept rather than tacked on a few decades into development.

Now these concepts aren't new, but they haven't been deployed or supported at the scale Fuchsia may end up at. Which obviously makes it a pretty exciting project in terms of real-world impact. That said, I believe there's been some speculation that part of the motivation for Fuchsia is to avoid the mess that is out-of-tree drivers on Android. So on the one hand, the kernel can be updated more easily, but on the other hand there may in practice be a lot more unpatchable binary blobs floating around doing important things.

For a more academic project that has many of the same security concepts there's seL4 [2], which has the additional bonus of doing some insanely clever formal verification of the kernelspace code [3]. They have formal proofs that the compiled machine code actually implements the specified of the security model correctly, which is the first of its kind AFAIK. They actually have a set of interactive tutorials for the platform [4], which are a great way to get a feel for how userspace works on a security-focused kernel.

As a disclaimer, I'm not associated with either project, and I'm sure my explanations will be ripped to shreds. My information comes purely from following the space in my free time.

0: https://fuchsia.dev/fuchsia-src/concepts/principles/secure

1: https://en.wikipedia.org/wiki/Capability-based_security

2: https://sel4.systems/

3: https://sel4.systems/Info/FAQ/proof.pml

4: https://docs.sel4.systems/Tutorials/

Re: U.S. State Department phones hacked with Israeli company spyware

#522

Post by sumedh »

vorpalhex wrote: post #270
Eelongate wrote: post #248

Earlier quoted context omitted.

In principle, America could drop Hellfire R9X sword missiles through the cars of every NSO employee. In practice, would American politicians have the nerve to go to war with NSO, when NSO probably infected all their phones years ago? How much dirt do they have on American politicians?

So you think because NSO breached a few state department phones that they have the deep dirt on every sitting congress member?

> that they have the deep dirt on every sitting congress member

Not all but do you really believe that the NSO group wont have some blackmail material on at least some US politicians?

Re: U.S. State Department phones hacked with Israeli company spyware

#523

Post by amitport »

illusivesaint wrote: post #268

Wow, Israeli's spying on their main sponsor?? Espionage is part of the political territory but hopefully this sets precedent to a change of optics. (Which probably not since Russia does it boldly for fun at this point).

Nobody claimed in the article that this is a case of Israel spying on the US. That would be quite a jump.

Re: U.S. State Department phones hacked with Israeli company spyware

#524

Post by gdrift »

rapind wrote: post #503
Eelongate wrote: post #248

Earlier quoted context omitted.

In principle, America could drop Hellfire R9X sword missiles through the cars of every NSO employee. In practice, would American politicians have the nerve to go to war with NSO, when NSO probably infected all their phones years ago? How much dirt do they have on American politicians?

Really, all you need is a subtle suggestion to the Israeli government that the hundred billions or so dollars they receive from the US every year might be impacted by continued NSO bad publicity.

  > hundred billions or so dollars ... every year
More like ~$4B (out of a total foreign aid of ~$50B annually).

https://usafacts.org/articles/how-much-military-aid-does-the...

Re: U.S. State Department phones hacked with Israeli company spyware

#525

Post by sampo »

justin66 wrote: post #323
Eelongate wrote: post #248

Earlier quoted context omitted.

In principle, America could drop Hellfire R9X sword missiles through the cars of every NSO employee. In practice, would American politicians have the nerve to go to war with NSO, when NSO probably infected all their phones years ago? How much dirt do they have on American politicians?

> In principle, America could drop Hellfire R9X sword missiles through the cars of every NSO employee. The next step isn't to blow them up, the next step is to sue them. I just assume the IDF and Shin Bet would like to be the only ones who blow up civilians in Israel, but I can't think of a single reason why the Israeli government would oppose an extradition request if they were presented with evidence of cyber-whate…

> I can't think of a single reason why the Israeli government would oppose an extradition request if they were presented with evidence of cyber-whatever.

If an American company would get caught doing the similar, would US allow extradition request of those people to some other country?

Re: U.S. State Department phones hacked with Israeli company spyware

#527

Post by amitport »

JohnWhigham wrote: post #105
FredPret wrote: post #16

Seems like not-the-smartest move for Israel to mess with one of the few powerful entities that desires its continued existence

This is just another incident in a long list that goes back decades of Israel getting carte blanche to do whatever they want to the US with little to no repercussion. The most famous probably being USS Liberty ( https://en.wikipedia.org/wiki/USS_Liberty_incident )

Really? Have you actually read the Wikipedia page you're referring to?

50 years ago during a full scale war with all surrounding countries, Israel accidentally (as determined by US investigation) hit a "spy-ship" near Egypt (one if the countries participating in the war).

Israel subsequenly paid around 70 million $ in compensation for the families.

Re: U.S. State Department phones hacked with Israeli company spyware

#528

Post by user-the-name »

dang wrote: post #148
user-the-name wrote: post #98

Earlier quoted context omitted.

> No, because it's ridiculous. Is it really.

Could you please stop posting unsubstantive and/or flamebait comments to HN? You've been doing it a lot, unfortunately, and we ban that sort of account. https://news.ycombinator.com/newsguidelines.html

[flagged]

Re: U.S. State Department phones hacked with Israeli company spyware

#529

Post by jacquesm »

jonnybgood wrote: post #484
jacquesm wrote: post #480

Earlier quoted context omitted.

We have plenty of proof of the US spying on allies in spite of those being secret foreign intelligence operations, there is afaik none whatsoever of say the Germans, the Belgians or the French doing something similar to the US.

Spying is intelligence collection. There many ways to collect intelligence. Some completely innocuous like going to a defense trade show and taking pictures. Or using satellites to capture imagery of sensitive locations or developments [1]. Military attaches at embassies who observe their host country’s military developments and operations [2]. These are capabilities that every developed nation has access to. For the…

Desire does not equate capability.
Post reply on HN