Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple alerts users in 92 nations to mercenary spyware attacks

techcrunch.com

Post reply on HN
Print view View original

261–270 of 301 posts

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#261

Post by kmeisthax »

2OEH8eoCRo0 wrote: post #28
kmeisthax wrote: post #15

Note that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.

Interesting use of language on your part as well- what makes the NSO Group spyware illegal ?

NSO Group is sanctioned, so buying their spyware is probably illegal if you're an American. Furthermore, several tech companies have sued or are in the process of suing NSO Group for their hacking operations. Expect those lawsuits to involve every HN user's two least favorite laws: DMCA 1201 and CFAA.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#262

Post by realusername »

saagarjha wrote: post #207
realusername wrote: post #178

Earlier quoted context omitted.

The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is

It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app.

That's why most of the exploits are targeting imessage

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#263

Post by gorbypark »

user_7832 wrote: post #111
spxneo wrote: post #96

It's probably far worse with Android users that Google is not disclosing. I'm seriously considering changing to Apple after this. Not that its secure but that they are willing to go to this length to communicate it.

> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android…

I've read (I have no sources) that while the "zerodium still pays more for an android 0-day" thing can be true, the conditions on the "top" payout are pretty strict, due to the same aforementioned variability between vendors. To get that payout you'd have to find something exploitable on nearly all vendors version of android along with working on 2-3 versions. In reality an iMessage exploit is going to pay out a lot more because it would be exploitable on nearly all iPhones running x version of iOS, for example. Finding an exploit in say "Samsung messenger" (I don't know if that even exists) would pay less than an equivalent iMessage one.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#264

Post by tialaramex »

godelski wrote: post #249
kibwen wrote: post #234

Earlier quoted context omitted.

> Some people think San Junipero, the one positive Black Mirror episode with an actual Happily Ever After romantic ending is a dystopian vision. IIRC, after the couple prances away hand-in-hand into the sunset, the camera pulls back through the fourth wall to reveal the darkened server room in which their minds are being emulated, blinkenlights glittering in the darkness among the monotone drone of case fans, zooming…

Not to mention that Black Mirror's entire agenda is near-Sci-Fi horror. The episode is specifically about getting trapped in nostalgia, a non-existent past. Yes, love is found in this pursuit, but so it death. All the music in the show is about living in a box and forgetting about the real world. Other characters talk about forgetting they're in the simulation and they talk about how they live in a graveyard. There's…

> Remember, once "you" are data, you can be copied.

If you're copied that's what "Hang the DJ" is about, and more darkly the short story "Lena". But San Junipero deliberately doesn't do that.

Alas, the thing you claim isn't the same as being is in fact exactly how you work today. Is this an existential nightmare? I got used to it pretty quickly, and in San Junipero you'd have a lot longer to get used to it. Greg Egan posits that, to the extent consciousness is anything it's somehow a consequence of patterns of computation. That is, if somehow the same patterns that you represent came into existence again they'd "be" you in every sense that matters. The "Lena" scenario remains horrifying, all those copies are the same person, instantiated over, and over, and over again to do menial tasks. But San Junipero is just life after death.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#265

Post by fsflover »

itscodingtime wrote: post #114
resource_waste wrote: post #66

Earlier quoted context omitted.

>What do these targeted people do then? Switching phones? When you can get a $130 Motorola that has better security... Yes. Since the 2018 iphone crack by the FBI, I am shocked anyone uses their iphone for secrets.

Is there a modern smartphone or cellphone the fbi, cia, nsa any nation state can not hack ? I can guarantee you the fbi can also hack a $130 motorolla.

Librem 5, when all hardware kill switches are in position "off".

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#266

Post by godelski »

tialaramex wrote: post #264
godelski wrote: post #249

Earlier quoted context omitted.

Not to mention that Black Mirror's entire agenda is near-Sci-Fi horror. The episode is specifically about getting trapped in nostalgia, a non-existent past. Yes, love is found in this pursuit, but so it death. All the music in the show is about living in a box and forgetting about the real world. Other characters talk about forgetting they're in the simulation and they talk about how they live in a graveyard. There's…

> Remember, once "you" are data, you can be copied. If you're copied that's what "Hang the DJ" is about, and more darkly the short story "Lena". But San Junipero deliberately doesn't do that. Alas, the thing you claim isn't the same as being is in fact exactly how you work today. Is this an existential nightmare? I got used to it pretty quickly, and in San Junipero you'd have a lot longer to get used to it. Greg Egan…

The Permutation City reference is irrelevant to San Junipero. I never made the claim that the entities in the simulation were not sentient. I made the claim that they aren't "you." These are very different things.

I haven't seen the newer seasons. But looking at the synopsis on wiki (Beyond the Sea?), this is a very different scenario. Permutation City might be a better one to look at for what I'm getting at. Remember in that story that you are essentially making a copy of yourself and putting it into that universe. That entity is not you, but it is sentient, conscious, and it's own thing. But you aren't in that simulation with it unless you virtually go in (and in their scenario you need to deal with the time differential).

San Junipero is a corporation promising you life after death. The same way Amazon Prime's Upload does. But San Junipero in Black Mirror itself made no claim, and the writers place a lot of not so subtle hints as to the idea that it isn't. Not only by nature of being a Black Mirror episode, but I suggest you look closer at the soundtrack of the episode and how its used in context.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#267

Post by jstarfish »

itscodingtime wrote: post #114
resource_waste wrote: post #66

Earlier quoted context omitted.

>What do these targeted people do then? Switching phones? When you can get a $130 Motorola that has better security... Yes. Since the 2018 iphone crack by the FBI, I am shocked anyone uses their iphone for secrets.

Is there a modern smartphone or cellphone the fbi, cia, nsa any nation state can not hack ? I can guarantee you the fbi can also hack a $130 motorolla.

[dead]

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#268

Post by saagarjha »

realusername wrote: post #262
saagarjha wrote: post #207

Earlier quoted context omitted.

I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is

It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app. That's why most of the exploits are targeting imessage

No. Most exploits target iMessage because everyone has it installed.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#269

Post by saagarjha »

sneak wrote: post #258
Cyphase wrote: post #241

Earlier quoted context omitted.

Is there any E2EE messaging service, or network protocol of any sort, that doesn't suffer from this? If an endpoint is compromised in whatever way, it doesn't matter how encrypted the data is in transit.

Signal doesn’t have this problem. By your terminology, all iOS devices are “compromised” by default from having non-e2ee iCloud Backup enabled by default. Signal chats on iOS are stored in a storage class that cannot be backed up or exported from the device.

Which is, of course, often not what users actually want.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#270

Post by saagarjha »

alfalfasprout wrote: post #210
bee_rider wrote: post #8

There’s a reddit thread by somebody who got one of these: https://old.reddit.com/r/iphone/comments/1c10jai/i_have_rece... The interesting thing IMO is they claim to just be some random college student. Which seems believable because if they were a real secret squirrel I guess they wouldn’t ask reddit about it, haha. I wonder if the hackers are targeting people based on phone numbers or something. (I could imagine a c…

It's fairly common practice to test out exploits on victims that aren't the actual target first.

Uh, no?
Post reply on HN