Live data from Hacker News

Simjacker vulnerability exploited by surveillance companies

simjacker.com

11–19 of 19 posts

Re: Simjacker vulnerability exploited by surveillance companies

#11
post #9
post #5

This is from September 2019. They haven't really bothered with updating the topic since then: https://www.adaptivemobile.com/search/3a08888ea06c35015d1248...

Dead link?

Yeah it's just a search for "simjacker" on their site, which encodes it in a string instead of common sense.

Re: Simjacker vulnerability exploited by surveillance companies

#14

So which company, working for which government, and how to stop it? The article is just a talk-to-our-salesman piece?

Most likely: NSO Group

Less likely, NSO's expertise is in development of exploits for browsers and apps (ex: WhatsApp), not ss7 exploits

Re: Simjacker vulnerability exploited by surveillance companies

#15
post #11
post #9

Earlier quoted context omitted.

Dead link?

Yeah it's just a search for "simjacker" on their site, which encodes it in a string instead of common sense.

Found More info on the site here : https://www.adaptivemobile.com/blog/simjacker-frequently-ask...

Re: Simjacker vulnerability exploited by surveillance companies

#17
post #2

I'm for cool research, but I am also tired of the trend where security companies come up with a flashy name, logo, url, etc. for every exploit/vuln.

I'm the opposite. Security researchers have struggled for decades to get people to fix their stuff after discovering something is broken. When a vuln has a human-readable name that sounds vaguely scary, even nontechnical decision makers can ask good questions like "are we vulnerable to this 'heartbleed' thing?". Anecdotal, but I've definitely noticed people talking about them; I've seen articles in mainstream press referencing some of these named vulns and have even had friends who are otherwise uninterested in computers ask me about them!

Certainly there's a self-serving glamorous aspect to it on the part of security researchers, but fun names and logos brings attention to issues that otherwise result in eyes glazing over. As much as this stuff makes me cringe to read, I'm willing to bet the branding for this issue will result in more eyes on it and probably will result in a fix. That's ultimately what vuln disclosure is about, after all.

Re: Simjacker vulnerability exploited by surveillance companies

#18
post #14

Earlier quoted context omitted.

Most likely: NSO Group

Less likely, NSO's expertise is in development of exploits for browsers and apps (ex: WhatsApp), not ss7 exploits

Circles is affiliated with NSO, and they use ss7 exploits.

Dont think they named directly who but they mentioned Circles, Rayzone in ChaosComputingClub a few days ago. THowever the link with the talk is dead for some reason - https://media.ccc.de/v/rc3-11511-watching_the_watchers_-_how...

Re: Simjacker vulnerability exploited by surveillance companies

#19
post #2

I'm for cool research, but I am also tired of the trend where security companies come up with a flashy name, logo, url, etc. for every exploit/vuln.

Yeah, the in-your-face advert right before the main text is very spammy too:

  "Do you know if attacks like like Simjacker or other next
  generation attacks are happening in your network?

  Book a meeting [with us to find out]."
The website feels like a con/ad rather than something legit.
Post reply on HN