Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

appleinsider.com

Post reply on HN
Print view View original

61–70 of 177 posts

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#61

Post by gjsman-1000 »

Dah00n wrote: post #48
esens wrote: post #17

Earlier quoted context omitted.

Would it actually have more resources that say Apple? I think if Apple can not do it, I am unsure if anyone else could. All supposedly secure smart phones are not, but they are at least obscure. I think that one should probably buy an Apple (at least they control everything rather than the cobbled together android clones) and disable basically everything except exactly what is needed. At least that reduces the surfac…

Apple can do it (create a security focused phone), it just isn't anywhere near what they want to do. The instant security (or privacy for that matter) gets in the way of profit for Apple they will back away.

Or maybe it's because they're doing their best to make every iPhone the security-focused phone, while not doing anything that would anger the FBI enough to try to pass legislation. When you are that big of a company, the things you can get away with are much more restricted than a small company.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#62

Post by cunthorpe »

swiley wrote: post #28
3pt14159 wrote: post #12

I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. I'm sure there's a few journalists out there that take cybersecurity seriously, but I'd wager the vast majority are pretty trivially monitored.

Apple really doesn't help them. the marketing (lying) that iOS is secure is pretty intense.

To be fair it's probably the most secure environment for the average Joe, you're just saying that it's not perfectly secure, which would be impossible in this world.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#63

Post by wolverine876 »

pratheekrebala wrote: post #33
3pt14159 wrote: post #12

I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. I'm sure there's a few journalists out there that take cybersecurity seriously, but I'd wager the vast majority are pretty trivially monitored.

I see your point, however, having worked in newsrooms - it really is about their beat and their threat-model. My organization covers a wide range of beats and folks covering national security or other sensitive topics have an entirely different workflow compared to those covering, e.g. housing. I think being responsive to their needs and building trust will go much further. Also, designing a one-size fits all model w…

If someone gets access to the housing reporter's systems, that seems a great way to move horizontally or vertically to get access to the other reporter or to the entire organization.

I don't envy your challenge. Security must make it more expensive to the attacker than it's worth. Even the housing reporter's data could be highly valuable; with inside knowledge, someone could make a killing on real estate. The value of the national security beat information is astronomical.

I don't grasp why, with all the news about breaches, reporters still don't care.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#64

Post by gjsman-1000 »

site-packages1 wrote: post #60
xyst wrote: post #35

Earlier quoted context omitted.

Simple solution: just use "dumb phones" or burners No non-open source "smart" phone is going to be secure enough. If you never store your data on your phone, you are safe from these hacks. Now you have to just protect from physical attacks :)

CopperheadOS is an open source OS that builds on Android and can be used on the Pixel devices. I've found it to be quite secure.

Except for physical attacks. No root of trust means that if your phone was ever stolen, installing a PIN guessing app is easy. Extracting the encrypted data for attacking it elsewhere is also easy.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#65

Post by smoldesu »

esens wrote: post #17
max_ wrote: post #14

Time for a cyber security focused smartphone?

Would it actually have more resources that say Apple? I think if Apple can not do it, I am unsure if anyone else could. All supposedly secure smart phones are not, but they are at least obscure. I think that one should probably buy an Apple (at least they control everything rather than the cobbled together android clones) and disable basically everything except exactly what is needed. At least that reduces the surfac…

Plenty of people have "beaten" Apple for security, though oftentimes these hardened phone OSes are only secure through obscurity.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#66

Post by wolverine876 »

xenocratus wrote: post #16
3pt14159 wrote: post #12

I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. I'm sure there's a few journalists out there that take cybersecurity seriously, but I'd wager the vast majority are pretty trivially monitored.

But it also depends on what kind of journalism they're doing, right? Not all report on criminal activity, or on investigating the government. It's kinda like threat-models, no need to be super secure if your work brings no risks to you, your organisation, or those you come in contact with.

Anything that will change a stock price is enormously valuable, for example.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#67

Post by smoldesu »

gjsman-1000 wrote: post #32
sneak wrote: post #24

Earlier quoted context omitted.

No, that's not what paranoid means. Your statement is simply incorrect and your use of the word is derogatory.

Only if you say so. There is a degree of rational fear, rational expectation of being tracked. Your degree of fear though is irrational unless you are, in fact, a journalist in an authoritarian state. You are saying that you are so paranoid, you don't trust iMessage to be End-to-End Encrypted because it has zero-click exploits developed as part of a cyberweapon that is explicitly targeted against high-profile journal…

That's absolutely not paranoia, so I'd suggest you leave GP alone instead of burning karma and making yourself look like a fool.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#68

Post by pratheekrebala »

jdavis703 wrote: post #51
3pt14159 wrote: post #12

I dated a journalist once. She used some random free app for phone calls because recording calls isn't built into iOS and she needed to record calls. I suggested a small device for her to plug her headphones through, but she declined. I'm sure there's a few journalists out there that take cybersecurity seriously, but I'd wager the vast majority are pretty trivially monitored.

I did help desk support at a news agency. We were constantly cleaning up malware from journalists computers... The journalists were constantly downloading all sorts of sketchy files as part of their job. Basically, if you're leaking state secrets / embarrassing repressive governments, don't leave a digital trail that can be traced back to you. Just assume everyone (especially journalists on national security or human…

Yes! In our newsroom (which isn't perfect by any means) - I have been testing using Qubes for really sensitive/untrusted documents. We also open un-trusted documents (from e.g. FOIA responses) on a machine live-booting from a CD.

However, it adds enough friction (especially with remote work) that it's hard to get it right 100% of the time.

If you want to share really sensitive documents, one way to ensure proper handling of your documents is to use a service like SecureDrop [0] which for e.g. only accepts submissions over Tor and requires the use of a secure viewing station [1] (air-gapped machine live-booting Tails w coreboot rom + webcam/networking card physically removed) to decrypt/access leaks.

That being said, I don't think there's a perfect tech-only solution because nothing is stopping folks handling it carelessly after they access the file.

[0] https://securedrop.org/directory/center-public-integrity/

[1] https://docs.securedrop.org/en/stable/set_up_svs.html

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#69

Post by wolverine876 »

hugh-avherald wrote: post #38

An intelligence agency cannot have the following properties simultaneously: (1) The ability to detect espionage from China and Russia (2) The inability to access journalists' phones If you want an intel agency to be able to thwart Chinese intelligence activities, you can't also publicly state you won't be looking closely into members of a profession who act a lot like spies.

In fact, in (most/many) advanced democratic countries intelligence agencies can and do exactly that.

Re: iMessage, Apple Music used by NSO Pegasus to attack journalist iPhones

#70

Post by smoldesu »

gjsman-1000 wrote: post #7
sneak wrote: post #5

Earlier quoted context omitted.

Neither of those has a vibrate motor to let me know about notifications. They also can't be used to pair to an Apple Watch. I know this because I used to carry an iPad Mini in my pants pocket.

Then buy an iPhone, and turn off iCloud Backup in Settings, it's not hard to do. Then your iMessages are fully E2E Encrypted.

...or I could just use a truly-secure option that doesn't destroy my personal security model. Owning an iDevice presents a considerable security risk to my current setup.
Post reply on HN