Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finnish diplomats’ phones infected with NSO Group Pegasus spyware

bleepingcomputer.com

Post reply on HN
Print view View original

51–60 of 113 posts

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#51

Post by Semaphor »

ajkdhcb2 wrote: post #41
solarkraft wrote: post #35

Earlier quoted context omitted.

2FA is a good option for securing your centralized accounts. But unfortunately, if you're logged in on your phone and your phone is hacked, well, it's still game over. For crypto currencies it may help to store them on a hardware wallet, since accessing your money will require explicit interaction. But, as far as I understand (please correct me, not up to date with the security mechanisms of hardware wallets), if you…

> if your computer is compromised while doing it, you can still lose it. The hardware wallet itself has a screen, and requires you to confirm your transactions, so generally not true

Just for people who don’t know, it’s shows relevant data regarding the transaction: Sum, currency, target address.

Now, if you verify that data, you are safe… if the original address was correct. But as we are talking about a sophisticated targeted attack, where did you get the original address from? Because if it was your phone or your computer, we are back to step one, as that might already be manipulated.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#52

Post by dogma1138 »

nisegami wrote: post #42
solarkraft wrote: post #37

Earlier quoted context omitted.

Why would the NSA be motivated to find these vulnerabilities? They already have access to Pegasus :-) ... you don't think they're interested in closing them, do you?

Isn't the NSO on an entity list now? That should mean that the NSA no longer has access to Pegasus.

Do you really think that the NSA would be bound by sanctions? They’ll ping the Israeli government and ask for access if they need it and they won’t be turned down it would be just a matter of price.

The NSO isn’t a state run outfit outright but it has been used by Israel to score foreign relationship wins just like any other export and specifically arms export are used by other governments.

NSO is literarily the bargain bin option when it comes to SIGINT/COMINT, and for most of their clients they are pretty much the only option to get a high end targeted capability to compromise mobile devices.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#53

Post by kafrofrite »

polack wrote: post #32
sgjohnson wrote: post #22

Earlier quoted context omitted.

It’s not at all like in the dotcom days. Unlike SQL injections, these aren’t low skill attacks that can be mounted by skiddies.

You are right in that these attacks takes more skills or a little bit of money, so in that regard it's not the same. But in multiple ways I think it's the same; like that it's obvious that security is still not a priority when building the software and that you as a user have to assume that the platforms are compromised.

Any reasonably complex piece of software will have vulnerabilities. In other words, vulnerabilities are not a variable for the security equation, they are a constant. When designing something, vulnerabilities will exist. Generally, vulnerabilities, on their own, are not a great indication of how security is prioritized internally in any company.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#54

Post by dogma1138 »

alufers wrote: post #11
heavenlyblue wrote: post #9

Earlier quoted context omitted.

I can't believe that all text messages aren't stored somewhere on the NSA (or equiv.) server (so it should be easy to quickly find the zero-day after a single attack). They probably just aren't motivated enough to expose the zero-days associated with it.

How would you know how a message contains an exploit before you know such an exploit even exists? Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.

iPhones still can send and receive an SMS, it’s also not particularly difficult to send an crafted iMessage, a lot of these exploits also chain multiple exploits so an RCE in a 3rd party messaging app with a sandbox/privesc on the local device.

And even without that if you get an RCE within the context of a messaging app you might be able to get most of what you need since you probably would be able to read / write arbitrary memory within the context of that process and interact with which ever APIs the app has permissions for which for messaging almost always includes microphone and camera and often location too.

The only thing you don’t get from running an exploit within the context of a single app is usually persistence but if your exploit can survive the app being suspended then as most people rarely reboot their phones you can get pretty long lived sessions too.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#55

Post by Ekaros »

supernova87a wrote: post #18

Although I'm certainly no celebrity / important likely target of hackers, I'm interested in this just because recently I've gotten paranoid about my financial accounts (after a company I used to work for finally went public and I was fortunate to cash out an amount of $). When hackers use such exploits, do they then basically have something like remote control over your phone, and can start exfiltrating data / manipu…

And this is why I hate this whole mobile app thing. Sure show me the data, but for any actual transfer action I much prefer having to use the old fashioned one-time password list. At least then they need multiple things and it is not remote.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#56

Post by dogma1138 »

polack wrote: post #32
sgjohnson wrote: post #22

Earlier quoted context omitted.

It’s not at all like in the dotcom days. Unlike SQL injections, these aren’t low skill attacks that can be mounted by skiddies.

You are right in that these attacks takes more skills or a little bit of money, so in that regard it's not the same. But in multiple ways I think it's the same; like that it's obvious that security is still not a priority when building the software and that you as a user have to assume that the platforms are compromised.

No it’s not I don’t think you realize the skill gap.

There is no SQLmap for iPhones and a “Metasploit” for iPhones costs 10’s of millions and requires you to be able to negotiation contracts on a state level…

The amount of money and skill that is require to identify these vulnerabilities and develop them into functional exploits is pretty insane.

It goes well beyond what even basic RCE due to say unsafe deserialization in Java requires.

Anyone without any knowledge in programming could probably learn how to identify and exploit a SQL injection even without automated tools within days if not hours.

On the other hand even experienced developers look at something like FORCEDENTRY and can barely comprehend it.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#57

Post by dannyw »

bigbizisverywyz wrote: post #48
Tuna-Fish wrote: post #6

Earlier quoted context omitted.

No, they use zero-day exploits in common media formats. The spy sends you a message containing an image or pdf, your device parses it, is exploited, and then removes the message, before there ever is a notification about it. You will never know that it ever happened. For example, see FORCEDENTRY, which is one of theirs, and the technical deep dive of it is about the most amazing piece of technical writing released la…

It was an amazing technical achievement that they pulled off, but also a lot of work instantly destroyed with one patch. Somebody's day got ruined when that was discovered. And kudos to the Google project zero guys for an amazing writeup.

Nobody's day is ruined; they'd certainly have multiple zero-click zero-days in the backburner.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#59

Post by skinkestek »

Epa095 wrote: post #40
throw8932894 wrote: post #30

Earlier quoted context omitted.

Quoted post unavailable.

>And your comment is just antisemitic. It's dangerous tossing that term around. There is enough real antisemitism in the world, and it's a real problem, we don't need to make-pretend extra. Critisism of the state of Israel does not equate antisemitism.

No post body was provided.

Re: Finnish diplomats’ phones infected with NSO Group Pegasus spyware

#60

Post by brian_herman »

lmilcin wrote: post #34
supernova87a wrote: post #18

Although I'm certainly no celebrity / important likely target of hackers, I'm interested in this just because recently I've gotten paranoid about my financial accounts (after a company I used to work for finally went public and I was fortunate to cash out an amount of $). When hackers use such exploits, do they then basically have something like remote control over your phone, and can start exfiltrating data / manipu…

Make sure your big $$$ are not available easily. Find a bank/brokerage that will actually do their job verifying you before they dispense your money. You are not able to defend yourself from targeted attacks. Period. It is one thing to try to defend from attacks of opportunity (ie. viruses, ransomware, etc.) and another from people who actually know their job and for some reason find yourself attractive target. Thus,…

Putnam investments are really hard to get money out of. For example, I tried to cash in an annuity, and it required a medallion certificate by another bank. A medallion certificate is like a notary but is only done by another bank.
Post reply on HN