Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple alerts users in 92 nations to mercenary spyware attacks

techcrunch.com

Post reply on HN
Print view View original

31–40 of 301 posts

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#31

Post by danudey »

bparsons wrote: post #23
kmeisthax wrote: post #15

Note that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.

Interesting. By reading that term, I thought the exact opposite. Mercenary sounds decidedly like a non-state actor.

That was my first thought as well, though on further consideration I assumed that it was some kind of paid/for-profit criminal organization performing these attacks on behalf of a nation-state.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#32

Post by passion__desire »

Despegar wrote: post #9
bee_rider wrote: post #8

There’s a reddit thread by somebody who got one of these: https://old.reddit.com/r/iphone/comments/1c10jai/i_have_rece... The interesting thing IMO is they claim to just be some random college student. Which seems believable because if they were a real secret squirrel I guess they wouldn’t ask reddit about it, haha. I wonder if the hackers are targeting people based on phone numbers or something. (I could imagine a c…

Well the they might be just a college student, but they could have a relationship with the actual target in some way. And if it's part of a complex operation they could be trying some indirect approaches.

Or maybe have a bigger blast radius so that it is difficult to know the exact targets. Drown the detection algos in the noise.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#33

Post by nehal3m »

miohtama wrote: post #25
loceng wrote: post #22

Earlier quoted context omitted.

The power of language, where "state-sponsored" too accurately directs the population's attention to their government but where mercenary is vague and non-aiming - where a simple change in language is enough to quell that ire and attention of authoritarians; or should I say authoritarian behaviour to not out them directly as authoritarians?

Apple needs to work with authoritarian governments, or nobody is going to build our iPhones. I would guess it’s obvious for everyone who gets the message that they are political targets. However it is also important to call out abuse of power, like is in the case of India, Spain, Poland, where the governing party is spying the opposition in order to find ways to get rid of them.

> Apple needs to work with authoritarian governments, or nobody is going to build our iPhones.

Not only is this objectively true, I also have an iPhone. It's not news to me but it still makes me do a double take every time.

Maybe I should try oscillating to Linux and FairPhone again...

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#34

Post by vineyardmike »

Lendal wrote: post #30

Pet peeve: This story alternates between "nations" and "countries" as if they were synonyms. A nation is a group of people sharing cultural, ethnic, and historical ties. There are many more nations than there are countries, especially within the US. A country has a political boundary, a flag and an anthem. It's one thing to use a word in the wrong way, because maybe you don't know the other word exists, and that's ok…

With all due respect, I’ve simply never heard anyone use these terms “correctly”. I live in an English-speaking country, and the closest thing I’ve seen to this is university signs that say things like “this is tiger nation” or something similar. But I’ve also seen people use “country” to express that too.

I assume they’re alternating not because it’s AI written but because the author considered them synonymous and wanted it to sound less repetitive.

These words are just so overloaded that I think this is a lost battle. People hike in the back-country, you can live in the city or the country. And frankly if you used “nation” to represent a cultural group of people in almost any context I think people would not understand or worse - assume you were stoking some racial angst or land-dispute.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#35

Post by vngzs »

2OEH8eoCRo0 wrote: post #28
kmeisthax wrote: post #15

Note that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.

Interesting use of language on your part as well- what makes the NSO Group spyware illegal ?

I would describe this spyware's "illegal" status as colloquially true - despite the lack of a comprehensive, international, enforceable legal framework - at least in the USA [0]:

> As part of this effort, the End-User Review Committee of the BIS decided to add four foreign entities, among them two Israeli companies, NSO Group and Candiru, to the Entity List. The U.S. Export Administration Regulations (‘EAR’) impose additional license requirements for exports to listed entities, and limits the exceptions for exports, reexports, and transfers to such entities.

But they continue:

> The existing international and national frameworks regulating the export of sensitive spyware technologies lack the teeth necessary to deal with contemporary issues relating to the abuse of these technologies and the growing need for their enhanced supervision.

[0]: https://www.law.georgetown.edu/ctbl/blog/managing-risky-busi...

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#36

Post by jsheard »

bparsons wrote: post #23
kmeisthax wrote: post #15

Note that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.

Interesting. By reading that term, I thought the exact opposite. Mercenary sounds decidedly like a non-state actor.

The wording is technically correct since these attacks are often facilitated by private for-profit companies. It just glosses over who is paying them (state actors).

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#37

Post by the_mar »

__jonas wrote: post #20
speedgoose wrote: post #3

Earlier quoted context omitted.

But if the phishing scam manages to display such a message in a different way on your phone, you can’t trust the phone anymore as it has likely been hacked.

On the Apple Support page here: https://support.apple.com/en-in/102174 In the screenshot it says the threat notification was sent "via email and iMessage", so it would not be displayed in any different way on your phone, which I also find surprising. I definitely wouldn't expect to receive something like this as an Email, and I have turned off iMessage.

Just out of curiosity why would you have imessage turned off?

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#38

Post by ajross »

2OEH8eoCRo0 wrote: post #28
kmeisthax wrote: post #15

Note that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.

Interesting use of language on your part as well- what makes the NSO Group spyware illegal ?

The DMCA, in the US. Other statutes in other markets. Hacking computers is pretty prima facie criminal everywhere. It's true that there are inter-jurisdictional edge cases (cracking an iPhone in India via an attack from Israel probably isn't illegal in the USA,etc...) which allows NSO to operate more freely than we'd like. But no one seriously claims this is legal activity anywhere in particular, just that we can't catch them.

Basically the distinction is one of law enforcement authority, not legality.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#39

Post by tombert »

nehal3m wrote: post #33
miohtama wrote: post #25

Earlier quoted context omitted.

Apple needs to work with authoritarian governments, or nobody is going to build our iPhones. I would guess it’s obvious for everyone who gets the message that they are political targets. However it is also important to call out abuse of power, like is in the case of India, Spain, Poland, where the governing party is spying the opposition in order to find ways to get rid of them.

> Apple needs to work with authoritarian governments, or nobody is going to build our iPhones. Not only is this objectively true, I also have an iPhone. It's not news to me but it still makes me do a double take every time. Maybe I should try oscillating to Linux and FairPhone again...

I think as of right now, it's nearly impossible to buy a guilt-free computer of any kind. It's a spectrum, obviously, but I think if you were to audit every component of any computer you buy from basically any company, you'd eventually get something kind of depressing.

A relative of mine in the defense industry has told me that, generally speaking, the DoD requires that none of the components in missiles have parts manufactured by potential adversaries, which makes enough sense but is also extremely difficult now.

Re: Apple alerts users in 92 nations to mercenary spyware attacks

#40

Post by nativeit »

2OEH8eoCRo0 wrote: post #28
kmeisthax wrote: post #15

Note that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.

Interesting use of language on your part as well- what makes the NSO Group spyware illegal ?

Aren’t its primary methods of deployment and utilization widely considered to violate domestic and international laws for unauthorized access to targets’ devices and/or data? I might be mistaken, I don’t know for sure how common such statutes are outside of the US, but I’m pretty sure it’s illegal in the United States, even for law enforcement (the likely unconstitutional extrajudicial activities of some unnamed alphabet agencies notwithstanding). If nothing else, there are documented cases where it’s been used to spy on journalists and activists in Saudi Arabia, including the widow of the assassinated American journalist Jamal Khashoggi.
Post reply on HN