Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US judge finds NSO Group liable for hacking journalists via WhatsApp

reuters.com

Post reply on HN
Print view View original

181–190 of 306 posts

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#181

Post by tredre3 »

sangnoir wrote: post #153
dsp wrote: post #113

Earlier quoted context omitted.

Unfortunately, I don’t think end-to-end encryption guarantees much when it comes to legal intercept in proprietary messaging apps. The intercept functionality could be done in the client and capture data, not just metadata.

Why hasn't any evidence of such client-side interception ever been surfaced? Reversing apps and software has been done since forever, and has been used to discover things the app-makers don't want made public - such as unannounced new products, but this happens perennialy with Apple & OS updates, and upcoming features in apps that are behind flags.

> Why hasn't any evidence of such client-side interception ever been surfaced?

In such scenario only the target of the wiretap would receive the modified client application. Both google and apple allow pushing updates to small subset of users. It's not unthinkable that they also have the (internal) ability to push a specific update to a specific user.

But I guess now you'll move the goalpost to ask "Why hasn't any Googler come forward and admitted it's happening?" That is a fair question, but I think most people would see this legal spying as no big deal and perhaps even a good thing.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#182

Post by unyttigfjelltol »

EMIRELADERO wrote: post #178
8note wrote: post #152

Earlier quoted context omitted.

i dont think users of whatsapp would have standing against people hacking whatsapp to get their data. whatsapp owns the systems, so its up to whatsapp to sue

What? So if someone robs a bank and empties my safety deposit box I can't sue them because it was the bank that had the money, not me?

If someone steals the ownership registry the bank maintains regarding the deposit boxes-- may be the better analogy. Or list of the owner and box number. Clearly this is information the bank controls, not the individual.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#183

Post by stavros »

tptacek wrote: post #133
sweeter wrote: post #128

Darknet Diaries did a few podcast episodes on the NSO group from the perspective of people who have directly interacted with or have been the target and it really puts it into perspective how horrific they are. They operate under the protection of the US and are directly allowed to spy on US citizens without any recourse whatsoever. One particularly grotesque case was the illegal wire tapping of Ben Suda after launch…

The US hosts and protects firms that are better at this than NSO, and not just because they're smart enough not to be in the news.

Why was this dead? If anything, Thomas' reputation here should at least entitle him to being heard.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#184

Post by theptip »

stavros wrote: post #183
tptacek wrote: post #133

Earlier quoted context omitted.

The US hosts and protects firms that are better at this than NSO, and not just because they're smart enough not to be in the news.

Why was this dead? If anything, Thomas' reputation here should at least entitle him to being heard.

Agreed that the flag seems highly dubious here.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#185

Post by newspaper1 »

stavros wrote: post #183
tptacek wrote: post #133

Earlier quoted context omitted.

The US hosts and protects firms that are better at this than NSO, and not just because they're smart enough not to be in the news.

Why was this dead? If anything, Thomas' reputation here should at least entitle him to being heard.

[flagged]

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#186

Post by stavros »

ruined wrote: post #109
mjg59 wrote: post #16

Earlier quoted context omitted.

The encryption isn't alleged to have been compromised. The app itself deals with a lot of untrusted input (eg, thumbnailing video files you've been sent) so there's a meaningful attack surface outside the protocol itself.

note for signal users: in settings, you can disable link previews and automatic media download.

Why are link previews a problem? Presumably I only generate previews for links I've vetted.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#187

Post by stavros »

newspaper1 wrote: post #185
stavros wrote: post #183

Earlier quoted context omitted.

Why was this dead? If anything, Thomas' reputation here should at least entitle him to being heard.

[flagged]

I don't think it's off topic, we're talking about companies spying. Unsourced, maybe, though I suspect Thomas is a reliable enough source.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#188

Post by newspaper1 »

stavros wrote: post #187
newspaper1 wrote: post #185

Earlier quoted context omitted.

[flagged]

I don't think it's off topic, we're talking about companies spying. Unsourced, maybe, though I suspect Thomas is a reliable enough source.

It has nothing to do with the OP. Honestly he always jumps in to do whataboutism on Israel posts. He didn’t say who he was talking about, it doesn’t add and only detracts from the discussion here.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#189

Post by ghxst »

tptacek wrote: post #169
ghxst wrote: post #166

Earlier quoted context omitted.

That's probably a fair assumption too. I was mostly thinking that the customers / clients you have and services you have to offer can be largely dependent by people in positions of power where having the right connections and influence might be the key difference between a service or product being viable. For example - although not related to NSO - something like operation Trojan Shield required both Australian and L…

My mental model of how this works --- and I have some (imperfect) evidence for it --- is that a given one of these firms (NSO or one of its competitors) has an addressable market of N countries each with an average of K security agencies, and basically all of those agencies pay subscription fees to be continuously in a position to do a CNE operation when they want to. (Generally, I don't think countries just "buy exp…

> so much so that I think it makes more sense to think of exploits as subscription services.

I think this makes sense, especially given the uncertainty of when an exploit gets patched.

To my original argument of political power vs valuations you can probably say that having those same people you'd otherwise try to influence on your board with a financial incentive allows you to achieve the same thing, I'm not sure why I didn't consider that before.

Re: US judge finds NSO Group liable for hacking journalists via WhatsApp

#190

Post by tptacek »

ghxst wrote: post #189
tptacek wrote: post #169

Earlier quoted context omitted.

My mental model of how this works --- and I have some (imperfect) evidence for it --- is that a given one of these firms (NSO or one of its competitors) has an addressable market of N countries each with an average of K security agencies, and basically all of those agencies pay subscription fees to be continuously in a position to do a CNE operation when they want to. (Generally, I don't think countries just "buy exp…

> so much so that I think it makes more sense to think of exploits as subscription services. I think this makes sense, especially given the uncertainty of when an exploit gets patched. To my original argument of political power vs valuations you can probably say that having those same people you'd otherwise try to influence on your board with a financial incentive allows you to achieve the same thing, I'm not sure wh…

Don't get me wrong: I'm sure there's plenty going on between NSO and Israel, and a lot of politics involved. But I also know it to be a real industry, with lots of players.
Post reply on HN