Hacker News Reader

Comment by mtrovo | Hacker News Reader

> Robert Malley, a longtime American diplomat who was chief negotiator on the US-Iran deal, and who appears to have been selected as a person of interest by Morocco in 2019. NSO has said its government clients are prevented from deploying its software against US numbers because it has been made “technically impossible”.

Is there more info about why this is technically impossible or is it just their PR way of saying "sorry, the day we do this we're screwed as a company"?

View on HN

Unclear why it's "technically impossible" but from this Washington Post article [1] it sounds more like "prevented by business logic," at least according to their source:

> A person familiar with NSO operations who spoke on the condition of anonymity to discuss internal company matters said Sunday that +1 phones are safe from Pegasus no matter where they are in the world. The system is programmed to block efforts to hack them, the person said.

> The person also said Pegasus can determine where a phone is geographically and block any efforts to hack a foreign-registered phone while it is inside the United States.

> But there is no way to determine the nationality of the user of a phone registered to a foreign system.

  [1]: https://www.washingtonpost.com/national-security/2021/07/19/us-phone-numbers-nso/

This strikes me as a thing that applies "normally" but can be circumvented with a user privilege flag or so on.

There's no reason an exception to that business logic isn't part of the system (and we have no way to verify/prove one way or the other).

Or circumvented by overwriting a conditional jump with a nop, though that might be challenging in practice if it's really SaaS.

This sounds like the ransomware services which prevent installation when Cyrillic keyboards are detected.

https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

I would assume it‘s a deliberate „if number.startsWith("+1")" precisely so nobody ends up using it on a US politician or whatever who then goes on a rampage.

I like to imagine that some developer commented out that line to allow for spying on Canadian persons and left a "TODO: find better way to identify US numbers" that was never fixed.

That’s hilarious, although I suspect “don’t hack the US” means “don’t hack five eyes” in practice

While it would be funny, Canadian phone numbers are pretty easy to identify, generally. They have their own set of area codes. Granted, there are exceptions, though I guess it depends on your interpretation of what it means to be a "US phone number".

Until they release some sort of irrefutable proof, why give them the benefit of the doubt? Their track record warrants assuming dishonesty.

Everyone cares more about the optics of spying on US citizens than actually spying on US citizens. Like in this example, without the convenient excuse of "it's impossible" the headline likely would have been "Pegasus Project spies on US diplomat and French President."

The Israeli defense ministry has to approve sales contracts. I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating.

> states they depend on militarily/politically or that have the capability of retaliating

It's almost certainly closer to the former than to the latter.

Not that anyone sane would be likely to consider actual war over something like this, but while the French military may not be the force it once was it's still formidable and they are - theoretical willingness to engage notwithstanding - one of the declared nuclear powers.

> I'm assuming they'd like to avoid spying on citizens of states they depend on militarily/politically or that have the capability of retaliating.

It's an open secret that Israel has been conducting economic and military espionage against the US[0][1][2] and stealing civilian and military technology for decades. This "blocking +1 numbers" is rather a thin veneer to prevent third parties from endangering the "official" Israeli espionage program.

[0] https://www.businessinsider.com/israeli-spying-on-us-has-rea...

[1] https://www.politico.com/story/2019/09/12/israel-white-house...

[2] https://www.nytimes.com/2020/12/30/world/middleeast/jonathan...

NSO effectively operates a SaaS platform for target exploitation and collection. They can easily add a restriction that prevents specific phone numbers from being targeted.

My guess is that such a restriction is in place to meet contractual obligations. If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you.

>If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you.

If you weaponize an exploit against US - especially US government - targets you jeopardize the military and intelligence alliance that keeps your country alive, not to mention the standing FBI warrants if you have the misfortune to enter the country, nor the forfeiture of your ability to use the world banking system.

Well that’s probably something that hasn’t crossed their mind. Shitting on the US is not on the "avoid" list of Israelis.

They have claimed in the past that they have technical measures to prevent the wrong people being targeted. If my memory of the reporting around the lawsuit by Facebook against the NSO is correct, the claims were pretty much rubbish - like, the technical measure may be there, but it pretty clearly wasn't in use.

Reply on news.ycombinator.com