Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO group iPhone zero-click, zero-day exploit captured in the wild

citizenlab.ca

Post reply on HN
Print view View original

651–660 of 886 posts

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#651

Post by megous »

sz4kerto wrote: post #624
resolutebat wrote: post #570

Earlier quoted context omitted.

Oh, but you see, NSO targets only "terrorists and criminals", so if you're a law-abiding citizen with nothing to hide, there's nothing to be concerned about. Right? It's not like there's any regimes out there where, say, casual investigative journalism or opposition politics would ever land you with criminal or terrorist charges, no sirree.

In Hungary, for example, which is an EU country and democracy (i.e. there are elections), investigative journalists have been targeted with Pegasus by the government.

Elections != democaracy. In Russia, there are also elections. So are they in Syria, and so on.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#652

Post by tryauuum »

jwr wrote: post #628
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

> That right there tells me that we as "the tech community" are way too okay with this sort of application of the tech. The tech we're all so convinced will "make the world a better place." This calls for a larger discussion of individual choices of every one of us. It would not be an easy discussion, because things are far from simple, and yet every one of us should actively think, instead of falling into the whatab…

Yep it's hard It's easy for me to say "I won't work on military stuff" but then again I'm single and have no kids

I don't know if I would have courage to stop working in Russian military IT tech if I were a sole provider for a family of three.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#653

Post by deskamess »

caisah wrote: post #577
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

The Indian government is a customer too.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#654

Post by rmbyrro »

black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

It gives me the impression that you find "the tech community" to be a cohesive collective that has the organization to switch gears in a given direction.

I wonder why you expect it to be like that.

In reality, "the tech community" is extremely diverse and not cohesive at all.

For one example, a large proportion of developers are barely making enough money to pay their most basic bills. They don't have enough mental space to even know what NSO is...

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#655

Post by akyuu »

SamuelAdams wrote: post #413
Obscurity4340 wrote: post #234

Its super interesting to me how much its emphasized that you shouldn't use Lockdown Mode unless you are a journalist or otherwise in direct palpable danger. They really do try to talk you out of it. Its curious, because there's very little difference in functionality (as experienced by the user) other than disabling a lot of Apple nonsense from running in the background expanding your attack surface. And everybody pa…

I use Lockdown Mode on my Mac because I don’t use iMessage, FaceTime, or other apple services on that device. It’s literally just a computer for software dev and maybe YouTube videos. I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari. What I would really like to see is options. For example on iOS I use shared photo albums, so it would be nice to keep that feat…

> I haven’t noticed any difference with web content either, but I also use Firefox / Chrome instead of Safari

Lockdown mode only affects Safari. If you use another browser, it doesn't make any difference.

Here are some features that are disabled in Safari when lockdown mode is enabled:

- JIT

- Remote fonts

- WebAssembly

- WebGL

- WebRTC

- PDF Viewer

- MP3 Playback

- Gamepad API

- Web Audio API

- Speech Recognition API

- MathML

- JPEG 2000

- MediaDevices.getUserMedia()

You can configure most of those in Firefox and Chrome, but it has to be done manually and cannot be disabled easily on a per-site basis like in Safari.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#656

Post by fweimer »

caisah wrote: post #577
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enforcement and security services in countries with a decent(-ish) track record regarding human rights. This way, your products and services are not obviously illegal. You can even tell your employees that your products and services are saving lives because it's actually true.

This strategy mostly works because the major operating system suppliers refuse to implement requested lawful intercept solutions for their consumer products. Instead, we end up with companies that try to fill the gaps, making a business of exploiting security flaws. It's possible for the OS vendors to completely dry this swamp, by offering competing services to law enforcement using the interfaces they already have (automated software updates, for example). The reputable clients would migrate rather quickly. These companies would be left with just the shady clients, making it much more difficult to justify their continued existence.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#657

Post by dkindler »

allie1 wrote: post #604
caisah wrote: post #577

Earlier quoted context omitted.

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spywar... . It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

To sell the software, they need approval from Israel’s govt, as the software is treated as a weapon

The US gov't almost certainly has a say as well.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#658

Post by moonchrome »

megous wrote: post #651
sz4kerto wrote: post #624

Earlier quoted context omitted.

In Hungary, for example, which is an EU country and democracy (i.e. there are elections), investigative journalists have been targeted with Pegasus by the government.

Elections != democaracy. In Russia, there are also elections. So are they in Syria, and so on.

Sounds like you don't like the outcome and dismiss the possibility that it's the result of the system. From what I understand Orban has a decent approval rating in his country. For Putin it's hard to say since Russia is so foreign and separated, just like China - the only source of info is random crap by your preferred biased media source.

But for Hungary - I've been there multiple times in the last few years, know a few people, and I have no trouble believing he won democratic elections.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#659

Post by wffurr »

VHRanger wrote: post #646
saagarjha wrote: post #546

Earlier quoted context omitted.

It’s an attack vector because it’s convenient. If iMessage didn’t exist people would email you exploits.

Are there zero click exploits in email?

There were, eg in Outlook: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

There probably still are and it’s possibly some three letter agencies or bad actors know about them.

Re: NSO group iPhone zero-click, zero-day exploit captured in the wild

#660

Post by jdright »

rmbyrro wrote: post #654
black_puppydog wrote: post #564

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the…

It gives me the impression that you find "the tech community" to be a cohesive collective that has the organization to switch gears in a given direction. I wonder why you expect it to be like that. In reality, "the tech community" is extremely diverse and not cohesive at all. For one example, a large proportion of developers are barely making enough money to pay their most basic bills. They don't have enough mental s…

That is the problem, we are not cohesive enough in shaming these people. They are criminals, and criminals don't post openly on linkedin proud of their work.
Post reply on HN