Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The secret Uganda deal that has brought NSO to the brink of collapse

arstechnica.com

Post reply on HN
Print view View original

71–80 of 142 posts

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#71

Post by tptacek »

adventured wrote: post #65
motohagiography wrote: post #16

I commented previously that the Uganda case was the first truly legitimate application of NSO's tech and the first one that wasn't actually a scandal, as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders. It seems this particular NSO case is being used as bargaining leverage to discredit Israel's position in the Iran nuclear…

> as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders How do you intend to support your claim that the 11 US diplomats and employees from the US embassy are spies (and thus are supposedly legitimate targets in your view)? Nowhere does it say US spies were the targets. And no other story on this subject has presented evidence…

I think the general idea is that the USG doubtlessly conducts espionage on Uganda, thus making all formal employees of the USG fair game for espionage. Which makes a good deal of sense. The reason NSO spyware on State Department phones is upsetting isn't that it targets the State Department employees, but that it targets the USG.

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#72

Post by whizzter »

_jal wrote: post #56
fouc wrote: post #39

>when Google reverse-engineered the hack used against American diplomats in Uganda, they found an elegant, tiny piece of code that adapted software from 1990s Xerox machines to fit a so-called Turing machine — essentially a complete computer — into a single GIF file. LOL at describing PDFs as "adapted software from 1990s Xerox machines" https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

They were talking about JBIG2, not PDF. JBIG2 has been in the news periodically for a different sort of problem - you can't trust it to accurately represent what was scanned: https://www.theregister.com/2013/08/06/xerox_copier_flaw_mea...

The NSO exploit started by pretending to send a GIF, that was sent down to some decoder that did automatic file-type detection based on data rather than filetype and "correctly" detected an PDF, the Apple PDF decoder in turn supports JBIG2 images where the actual exploit lives.

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#73

Post by hervature »

bobthepanda wrote: post #44
hervature wrote: post #33

Earlier quoted context omitted.

Having a "caterer and friends" local dumbphone and an international phone for actual business doesn't seem unreasonable.

It's not unreasonable, but people get sloppy with cell phones. Like the whole business around US military bases and Strava.

To be fair, I think many (most?) people use Strava without a cellphone. At least in cycling. The problem there was everything being public by default as it is a social network of sorts.

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#74

Post by whizzter »

jprd wrote: post #49
Terry_Roll wrote: post #26

Earlier quoted context omitted.

I think NSO are scapegoats, because how hard is it for a country to setup up a honeypot device to analyse NSO'a attack vectors and then copy it for their own use whilst being able to blame it on NSO? I say this because I've had stuff done to my phones in the past, one strange incident with a "hacked" phone was selecting an AirBnB, which I believe directed me to a few of their "safe" houses. Other examples, include ba…

It is astounding to me that a state as paranoid as Israel has leaned so hard into the far-right that they would actively sell some of that highly sensitive tech to other states that not that long ago had a death wish for Israel as a main position of said state. A state born of hard-edged refugees escaping a world that had recently written them off to die, carried through several existential wars, and now they are EMP…

I don't doubt the Mossad/NSO link either but as for "empowering and giving away" I wouldn't reach that far.

Rather I suspect they were selling it as hacking-as-a-service and the clients they had never actually got their hands on the software or any physical servers (apart from possibly NSO relays), rather everything probably passed through their servers hosted in Israel where they could control that +1 and +972 numbers were never targeted.

The people they had as client only cared as long as they got into the iPhones,etc they wanted, I doubt they cared if they had control of the software or not.

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#75

Post by vmception »

> “We always knew this thing had an expiration date,” he told the friend

after $200mm in revenue, I love the cavalier nature of that. it humanizes the operation more than anything I've read

and NSO group is even at risk of defaulting on some loans, that it must have taken out for no reason aside from having extra totally fuckable capital to default on.

honestly, hope I run into this guy in Monaco and have a drink. just won't exchange contact information

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#76

Post by sophacles »

adventured wrote: post #65
motohagiography wrote: post #16

I commented previously that the Uganda case was the first truly legitimate application of NSO's tech and the first one that wasn't actually a scandal, as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders. It seems this particular NSO case is being used as bargaining leverage to discredit Israel's position in the Iran nuclear…

> as it was by a state without a mature domestic intelligence capability going to market to buy tools of one, to spy on actual spies in its borders How do you intend to support your claim that the 11 US diplomats and employees from the US embassy are spies (and thus are supposedly legitimate targets in your view)? Nowhere does it say US spies were the targets. And no other story on this subject has presented evidence…

US intelligence organizations openly state that a common way for them to operate in a country is to give their agents cover "jobs" at the state department. When state department employees or "employees" work at an embassy they are diplomats. Apparently this is common in the intelligence world.

Whether these particular people were spies, it seems like proper counter-intelligence to track all diplomats pretty closely because at least some of them are going to be intelligence operatives.

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#78

Post by trhway »

matthewdgreen wrote: post #20
vsareto wrote: post #10

Earlier quoted context omitted.

Naturally, NSO will be blamed instead of the US govt for thinking that was actually possible. Especially after the shadow brokers leak.

It is actually possible to not sell software that spies on US diplomats. Why, I achieve this goal every single day.

>It is actually possible to not sell software that spies on US diplomats. Why, I achieve this goal every single day.

it isn't that easy :) If you work on any major and/or popular software it is most probably used by State Dept (even if it is just an obscure part of some software stack that some State Dept LOB is using implicitly). Theoretically any software may have bugs/holes and thus be a part of such a spying.

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#79

Post by pzo »

profstasiak wrote: post #14

Right now we have mini crisis in Poland connected with this US/NSO war. One prosecutor, who is fighting for indepenend judiciary and against her political boss, head prosecutor Minister of Justice, smaller party Coalition member, got notification her iPhone has been hacked multiple time by Pegasus. She angried the rulling coalition, after she wanted to investigate illegal vote by mail election, that didnt take place…

There is such a polarization right now in Poland between society that let's maybe don't put politics here. I don't like both the opposition and the ruling party but I try to at least read both sides of the story. You are definitely presenting very biased point of view here

Re: The secret Uganda deal that has brought NSO to the brink of collapse

#80

Post by kshacker »

jprd wrote: post #46
kingcharles wrote: post #34

Earlier quoted context omitted.

You're absolutely right, and I don't think anyone else has made that point. The problem was the spies they tried to fuck with were American spies and American wasn't going to stand for that. As you say, NSO are now just a toy, and if they are destroyed thanks to this, no-one is going to give a fuck.

I cannot see a world in which use of NSO tech is legitimate. Get a court order to tap the phone line, etc. How can usage of a Mossad / IDF tool be considered legitimate? Just because the ruling party in a state decides so, doesn't mean this has any bearing on human rights or _legitimacy_. China is eradicating Uyghur culture and running for-profit concentration camps. These are legitimate uses of their Governmental po…

> I cannot see a world in which use of NSO tech is legitimate. Get a court order to tap the phone line, etc.

In general, I am against government overreach, so I agree with a lot of what you said.

However, let us say I have a court order to surveil person X - how am I ever going to get all the information when they could be communicating via a phone call, SMS, iMessage, whatsapp, gmail, facebook messenger, signal, telegram, discord and a myriad of other mechanisms with a myriad of identities. The easiest solution for me (the snooper) would be to surveil your entire phone, including click history and screenshots when feasible. No?

Once again, let us forget the person side for a minute. Let us talk about someone with genuine need to surveil. How will ever do it with today's technology? It aint easy.

Post reply on HN