Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp forces Pegasus spyware maker to share its secret code

arstechnica.com

Post reply on HN
Print view View original

41–50 of 170 posts

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#41

Post by nicce »

wkat4242 wrote: post #35
jokoon wrote: post #8

This is why I don't want to work in cyber security. You are dealing with dangerous people.

Meh. The same goes for police work and even more so for military. And cyber is a very wide range. A lot of roles are simply about training personnel in security principles and procedures, implementing data classification etc. Not everyone deals directly with attacks. Most of the work is preventative. In our company probably less than 20% of people who technically work in cyber, although that's in part because our SOC…

> Most of the work is preventative.

Current work culture is bizarre in cyber security. I am not personally very fan of it.

Nobody wants to work on defensive side. You are not getting either fame or money if you do your work well. The expectation is that you do your work perfectly. There is no actually measurements in place to prove that your good code prevented 100 data breaches!

But on the other hand, if you are on offensive side, sometimes find cool bugs, you get fame and money. Does not matter if there is a long break sometimes. Your goodness is measures based on how much money you got.

What does it mean? People start doing bug bounties. They hoard tools only for themselves to make more money, instead of releasing them to improve general security. They keep small bugs themselves so that they can be used in exploit chains to get bigger bounties.

If the reputation of the company is based on the participations of the bug bounty program, they start doing less and less in-house engineering and outsource the cyber security testing for bug bounty platforms.

And vicious cycle starts.

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#42

Post by SturgeonsLaw »

libraryofbabel wrote: post #40
pvo50555 wrote: post #24

Earlier quoted context omitted.

couldn't* care less

Much as it may pain you, “could care less” is an established idiom in American English that’s been in use for 70 years, and Webster’s dictionary has a whole page about it: https://www.merriam-webster.com/grammar/could-couldnt-care-l... , in which they say: > people who go through life expecting informal variant idioms in English to behave logically are setting themselves up for a lifetime of hurt.

I couldn't care less if there's a group of people misusing the phrase, logically "I could care less" means the exact opposite of "I couldn't care less".

The majority of the world is not American, and presumably the majority of Americans don't use the incorrect phrase, so why should the rest of the world cater for a minority within a minority by putting their butchered phrase on equal footing with the correct phrase?

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#43

Post by jevoten »

xxpor wrote: post #36
kristofferR wrote: post #30

Can anyone explain this case? Why would a US court have any jurisdiction over a foreign Israeli spyware vendor that has already been blacklisted by the US government? And why would Israel send their spyware source code to WhatsApp even if they lose the case?

Because the NSO group handles dollars. If they didn't respond, they'd lose by default, and the court could order any assets the US can get their hands on seized. If they're getting paid in NIS by countries outside of Israel, the currency conversion happens with dollars as the intermediary. There's the US's window.

How is "Because the NSO group handles dollars" related to "the court could order any assets the US can get their hands on seized"? Presumably, if they were getting paid in bars of gold, the US could seize those too, if they could get their hands on them, no?

On the other hand, if they were paid in US dollars, but in cash, that wouldn't establish jurisdiction, nor could it be seized, if the transfer happened outside US territory?

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#44

Post by skyyler »

SturgeonsLaw wrote: post #42
libraryofbabel wrote: post #40

Earlier quoted context omitted.

Much as it may pain you, “could care less” is an established idiom in American English that’s been in use for 70 years, and Webster’s dictionary has a whole page about it: https://www.merriam-webster.com/grammar/could-couldnt-care-l... , in which they say: > people who go through life expecting informal variant idioms in English to behave logically are setting themselves up for a lifetime of hurt.

I couldn't care less if there's a group of people misusing the phrase, logically "I could care less" means the exact opposite of "I couldn't care less". The majority of the world is not American, and presumably the majority of Americans don't use the incorrect phrase, so why should the rest of the world cater for a minority within a minority by putting their butchered phrase on equal footing with the correct phrase?

Because you knew what they meant and trying to correct them only serves to make you feel good about your own knowledge.

You aren't helping anyone when you correct them on this.

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#45

Post by Onawa »

skyyler wrote: post #44
SturgeonsLaw wrote: post #42

Earlier quoted context omitted.

I couldn't care less if there's a group of people misusing the phrase, logically "I could care less" means the exact opposite of "I couldn't care less". The majority of the world is not American, and presumably the majority of Americans don't use the incorrect phrase, so why should the rest of the world cater for a minority within a minority by putting their butchered phrase on equal footing with the correct phrase?

Because you knew what they meant and trying to correct them only serves to make you feel good about your own knowledge. You aren't helping anyone when you correct them on this.

I agree. I've learned to not care when people say 'expresso' instead of 'espresso', and 'ex cetera' instead of 'et cetera'. I know what they mean, you know what they mean, and correcting everyone only serves to alienate others.

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#46

Post by SturgeonsLaw »

lupire wrote: post #5

Is this a new precedent, that "legal" hackers that operate in two countries can be forced to divulge their vulns?

I hope so, the fact that attackers can hide behind international borders is an eternal thorn in the side of us blue teamers. Anyone who commits a crime in another country should be subject to that country seeking legal redress.

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#47

Post by xxpor »

jevoten wrote: post #43
xxpor wrote: post #36

Earlier quoted context omitted.

Because the NSO group handles dollars. If they didn't respond, they'd lose by default, and the court could order any assets the US can get their hands on seized. If they're getting paid in NIS by countries outside of Israel, the currency conversion happens with dollars as the intermediary. There's the US's window.

How is "Because the NSO group handles dollars" related to "the court could order any assets the US can get their hands on seized"? Presumably, if they were getting paid in bars of gold, the US could seize those too, if they could get their hands on them, no? On the other hand, if they were paid in US dollars, but in cash, that wouldn't establish jurisdiction, nor could it be seized, if the transfer happened outside U…

The US government has jurisdiction over all US dollars. That's how sanctions work.

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#49

Post by ethbr1 »

gsk22 wrote: post #33
ethbr1 wrote: post #4

Earlier quoted context omitted.

I doubt US spy agencies still use it in any official capacity. Far easier to just request and obtain the resulting intelligence from partner intelligence organizations who are using it. Arms-length collection is less legally perilous. But which does bode poorly for any assertion of national security in US courts! "Are you using this software?" "Officially, no." "Then on what basis do you claim national security?"

Thanks to the FISA "court" system, I doubt US spy agencies fear any legal reprecussions. No need to follow the law if you have a secret court where no one has standing to challenge your actions.

Omnipotent and yet completely legally-neutered FISA is a lazy excuse to avoid thinking about things.

There are no illuminati.

There are powerful institutions, who nonetheless fear other powerful institutions.

In this case, intelligence preferring to remain out of the courts and newspapers.

Re: WhatsApp forces Pegasus spyware maker to share its secret code

#50

Post by jeroenhd »

xxpor wrote: post #47
jevoten wrote: post #43

Earlier quoted context omitted.

How is "Because the NSO group handles dollars" related to "the court could order any assets the US can get their hands on seized"? Presumably, if they were getting paid in bars of gold, the US could seize those too, if they could get their hands on them, no? On the other hand, if they were paid in US dollars, but in cash, that wouldn't establish jurisdiction, nor could it be seized, if the transfer happened outside U…

The US government has jurisdiction over all US dollars. That's how sanctions work.

If I bring a suitcase full of dollars home with me from a trip to the US (assuming I make it through border control with that much cash), I don't see what kind of jurisdiction the USA would have over me for simply owning dollars.

These are just pieces of paper, they don't provide any kind of jurisdiction. The American banking system may refuse to serve me perhaps, but it's not the dollars that give the American government any control. Hell, several countries outdid e the USA use American dollars as an official currency, but that doesn't make them vassal states to the USA.

Post reply on HN