Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit

Vendors need to make it easier to verify the integrity of persistent firmware, in an offline fashion. It will dramatically increase the cost of persistence, which is the best way to put these thugs out of business.

Everyone seems to be focusing on the "always" in your statement, so i'll ignore that and give you a straight answer.

Strong investment in STEM education, after school programming and computer security programs, mandatory military service where they get a chance to evaluate everyone and funnel the smart technical folks in to Unit 8200, and heavy investment into security startups.

Israel also benefits from everyone else depending on their tools. Not only do they get to see the intelligence being collected by other countries and gain insights into their espionage operations, they also would be able to piggy back into any networks that were of particular interest.

...Is ethis taught in any CS curriculum?

It sure wasn't in mine (but to be fair, that was in Switzerland).

----

[0] https://en.wikipedia.org/wiki/Unit_8200

[1] https://en.wikipedia.org/wiki/Unit_8200#Companies_founded_by...

A few years ago bluecoat systems was caught providing deep packet inspection gear to the Syrian government. But that wasn’t Israel so no biggie and you either never heard about it or didn’t pay much attention because it wasn’t Israel.

American and European companies do this all the time but it’s not sensationalized to the same degree. That’s just business as usual.

Personal opinion, but I think the mandatory army service in Israel seems to teach that everything is 'defense' and Israel is always 'defending itself', no matter what, this sort of thinking then bleeds into the private sector as these guys leave the military and use the skills they learned there to establish businesses.

Having interacted with the Palestinians during their army service as 'the enemy', the victims of NSO undoubtedly fall into the same category, thus not worth loosing their sleep over.

I had a former customer there _go out of business_ when the Barack Hussein Obama (mmm mmm mmm!) administration supportd an attempted putsch by (in my customer's words) "The Retarded F___ing Nazis who killed Sadat for making peace with the Jews."

Israel and the non-Brotherhood Arab countries face the burdensome situation that their most reliable "ally" is a country that depending on the politics is going to support the Brotherhood _and_ the large wannabe-hegemonic Russian satellite state trying to develop nuclear weapons. (Oh, and funded said state's reconquest of Syria in the process). Said schizophrenic state also has a massive surveillance system of its own.

My guess: they all don't look at this as a violation of civil rights or ethics, they look at this as a means for the little countries like them to get a leg up on some of the insane intelligence agencies of the large countries that are funding enemies both domestic and foreign.

* firstly, not many people outside the security world knows that bugs are a valuable commodity for attackers. Same thing with internal orgs diagrams which are something you can sell to economic intelligence firms.

* secondly, top-tier orgs like FAANG usually peppers a lot of telemetry around known bugs in production code in order to see if someone isn't exploiting them (or simply to better track down the root cause).

That being said, attackers are reaaaaaally interested in getting access to internal bug trackers : https://grahamcluley.com/microsoft-bug-tracking-hack/

Impossible to track in-person knowledge exchange, so code wouldn’t really be the culprit IMO.

If one were sufficiently motivated and planned ahead, you could almost consider it as a future "insurance policy" of sorts.

Assuming such applications existed, how would you install them on the "suspect" iPhone?

Assuming you were able to install such applications, you'd still not have any access to or control over the baseband (which I strongly suspect has plenty of issues of its own).

Assuming the malicious software avoided using Wi-Fi and used only the the cellular data connection for command and control, exfiltration, etc., it'd be damn near impossible to monitor the ("plain-text") data being sent and received (assuming such software would make use of private certificates -- or asymmetric encryption, in general -- to avoid being MITM'd itself, which seems like a reasonable assumption).

--

EDIT: This got me thinking, "what would be the most secure way to keep and use a mobile phone?" (assuming one could not simply avoid doing so).

My first thought is to use a mobile phone with the baseband radio(s) (verifiably) disabled/removed (if that is even possible?) or -- even better -- a Wi-Fi only device (similar in function as the old iPod Touch, for example) on which one used only SIP applications for calling (ideally via an "internal PBX" shared by all of one's correspondents) along with one's preferred E2E-encrypted messaging applications (e.g., Matrix, Signal, WhatsApp, etc.), all of which are used (importantly!) exclusively over an always-on VPN connection.

In instances where Wi-Fi was unavailable and/or one had no other options, a "mobile hotspot" or another ("real") mobile phone acting as one could potentially be used.

I'm interested in hearing thoughts on this idea (including any reasons why this is a bad idea that didn't occur to me during my two minute thought experiment), any other similar ideas that others have had, or any actual practices that are actually being used.

https://blokada.org/

China is the only authoritarian country with enough leverage over Apple to force them to do that sort of thing. There it's not just an enormous market, but also an utterly critical part of Apple's supply chains. Every other authoritarian country is small fry in comparison, and if they demanded such a thing Apple would tell them to get stuffed. Apple has not just commercial reasons, but political ones as well. While Trump is enamored with authoritarians, the incoming Biden Administration is not, nor is much of Congress or the general public. The EU would also like to at least pretend to care overall. Particularly right now at a time of scrutiny, Apple has every reason to not merely deny such a demand but to do so loudly and publicly.

And seriously, it's not like authoritarians are all stupid (unfortunately) and need to "wake up". They're all aware what China has demanded and gotten away with. If they thought they could too, they would. But they wouldn't, so they don't.

Statically linking a binary to not require libc or muscl or any other libraries isn't hard. This is the easiest part of exploit writing. All linux distros run ELF binaries just fine.

People who are trying to package things in a correct way, where the user can list the installed program, uninstall it, have configuration stored in standardized locations, etc... that's actually a harder problem. But just because writing a "correct" package varies a bit by distro doesn't mean an exploit, which doesn't have to follow packaging guidelines, has the same difficulty.

In addition, you're trying to compare it to the difficulty of writing an exploit for iOS. It's not comparable. There's documentation about every step of compiling and packaging software for linux distros. There's no documentation for elevating privileges and breaking iOS's sandbox because it's not intended to be possible.

Considering the recent iOS exploits, you're likely to be a little bit safer on a Google phone and common sense at the moment - but I'm 100% sure that a player like NSO will have an exploit for your phone as well.

Might have more luck with a dedicated "locked down" phone from a security company, there's some players that have entire custom android distributions with enhanced process/app isolation in the kernel and various stuff on top that prevents accidental leaks from "important" apps - also won't be 100% safe there but you can't even get that on iOS.

Saying that theres plenty of Android exploits but they tend to get less press for some reason. https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

This will just continue to get worse. More journalists and human rights activists will die because some delusional maniacs feelings were hurt, some ex IDF techs want to make some money and a President wants to keep jobs at Lockheed Martin.

Maybe the BDS list should include more countries. Maybe tech as a whole should replace lip service and instead redirect (and/or reject) major funds to fight injustice on a geopolitical level. Maybe VC funds shouldn't "techwash" despot dollars.

The tech industry has a lot of power in itself and can push the needle without the need to rely on 'America' to do something.

As long as US and Israel are fundamentally aligned on long-term foreign policy objectives, aid will continue to be provided no matter what. Dirty work has to be done by someone.

I suspect the reason that does not happen is because NSO does the US's dirty work for it, otherwise the US would have stopped it already. After all, the US directly supports those same governments NSO works with. It's probably not too upset its dependents are getting support from a different actor.

I'm not holding my breath on America ever making the right decisions with respect to foreign policy.

At the risk of sounding pessimistic, there's no value in changing anything if the current course of action aligns with the long term interest of US policymakers and their stakeholders.

For an attack like this you need to chain an iMessage exploit with an LPE, and the LPE can be launched from any other app.

They’ve also never devoted enough care, resources, or money to network architecture and how important availability is (with fairness, they have improved in this area in the last couple of years due to the major iCloud outages they had).

Apple doesn’t hire mainstream IT people and cybersecurity people from the enterprise realms. There is a vast amount of talented people and knowledge they simply ignore because the Apple culture is too hip and cool for that.

Steve Jobs is primarily the blame for all the above. He treated the departments and any person that cared about enterprise like dirt. Steve Jobs always said Apple is a consumer company. This philosophy has obviously carried on.