Hacker News Reader

Comment by boomboomsubban | Hacker News Reader

>In a public response, NSO has said its technology helps stop terrorism and that they've installed controls to curb spying against innocent targets. For example, NSO says its intrusion system cannot work on phones with U.S. numbers beginning with the country code +1.

So the point is to stop terrorism and to do that they've immediately ruled that all Americans aren't terrorists. That doesn't seem like a good metric of determining if someone is a terrorist, and makes me doubt their other controls are any better.

View on HN

So I just have to buy a US phone to evade detection from NSO? And why didn't that logic work for US State Dept phones?

I'm honestly of the opinion there is nothing that NSO can say that isn't outright lying. This isn't a normal company in anyway.

I remember reading that some Russian (private sector) computer viruses did not attack computers whose language and locale were set to Russia. It's never about ethics. It's always about making as much money as possible without pissing off powerful people and entities.

Yep, Krebs on Security wrote "Try This One Weird Trick Russian Hackers Hate" -- https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Crudely, we would say "don't shit where you eat". I've heard from the early (as in, 80's) hacking days some of the people in the US would never hit targets in their own state, as there wasn't good federal-level enforcement nor inter-state collaboration. Of course that would backfire today because you're immediately commiting crimes across state lines...

I had this with a Chinese app. Works well on a Chinese language phone, downloads an extra package if not.

>And why didn't that logic work for US State Dept phones

They had Ugandan numbers, as they lived in Uganda.

Phone hardware is not tied to any particular number.

So you just need a SIM with a US number and use that for all your evasion needs.

Yeah, this.

They started off with the arrogance of a liar who thought they were immune from consequences. Now they're looking more like the kid who is actually in trouble only now realizing nobody trusts them to identify the sky color, let alone defend themselves.

Anything and anyone coming out of that shop is tainted.

* A US Phone will route your call via NSA servers[1], so yeah thats OK from the US governments side

* Publicly at least, NSO acknowledges there are state level agreements, the latest one with France, to block entire country codes from Pegasus (in return, France has stopped all legal action against NSO)

* According to Israeli Channel 12 reporting on this tonight, the official NSO response also includes the statement that the accused numbers in the report were not +1 numbers. Their so called "customers" were targeting US government employees using African area codes. NSO claim they have completely disconnected said customers from the system

[1] https://en.wikipedia.org/wiki/Room_641A

> And why didn't that logic work for US State Dept phones?

These were Foreign Service officers stationed in Uganda, so their phones had local Ugandan phone numbers. Some of them were working out of DC but - given the nature of the State Department (which is like America's foreign affairs department) - probably traveled very frequently and so maintained a Ugandan phone number as well, to save on roaming fees when making calls in Uganda (saving money for the taxpayer) and also so Ugandan officials can contact them easily.

This is not unlike Apple hardware engineers who travel frequently to China and have a Chinese number in addition to their main US number, so people in the factory can communicate with them easily.

> So I just have to buy a US phone [number] to evade detection from NSO?

This is NSO's claim. Presumably because they want to make it difficult for anyone to sue them in a US court. It's plausible but I don't necessarily believe them either.

I want this company bankrupted out of existence, personally. Apple's lawsuit against them may well result in that outcome.

Funny enough this reminds me of the ransomware that doesn't work if a cyrillic keyboard is installed. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Someone else linked that one, it's hilarious and unsurprising really. Lots of people purposefully avoid certain OSes (mostly linux distros) as well out of respect NOT because of population/userbase of the OS. Lots of discussion on worm/trojan development forums over the years.

If you are a Russian hacker, you probably don't want to piss off a Russian mobster who has the capability to take you out, and the contacts within Russian intelligence to identify you.

Reminds me of how some ransomware looks for if your default keyboard language is Russian. If so then it exits, doing nothing.

OK, so the best way to protect privacy is to get US-based phone number and install Russian keyboard as a default.

And it should have a list of sites blocked by Chinese regime downloaded as discovered by Lithuania [0], for even grater privacy.

0: https://news.ycombinator.com/item?id=28616683

> the point is to stop terrorism and to do that they've immediately ruled that all Americans aren't terrorists

The alleged point is to sell software that stops terrorism. Pissing off America is a good way to stop being able to sell your software.

NSO has repeatedly shown that their statements are pretty much worthless. It's just damage control. I wouldn't put any stock in the "we avoid +1 numbers" to even be real.

Seriously, they're pretty much the Mark Zuckerberg of their industry.

That is not fair to Mark Zuckerberg.

They're pretty much the General Butt Naked of their industry.

I‘d rather compare Zuckerberg to the Sackler family who knew how addictive and harmful their painkiller Oxycotin was, yet ignoring all evicence, making billions of dollars. Zuckerberg knows how bad Facebook and Instagram is, how harmful to individuals and society alike, yet ignoring that and making billions.

Edit: Replaced „social media“ with „Facebook and Instagram“

Why did you feel the need for the edit? I would agree with the blanket use of social media. Twitter is no better. Do we know enough about the inner working of TikTok to know they aren't doing similar?

> I wouldn't put any stock in the "we avoid +1 numbers" to even be real.

That part I believed. Setting up their software to not target the US seems like the kind of move they'd make. Claiming it's so they don't target innocent people is bullshit.

As an obvious statement: I think this should be interpreted similarly to some ransomware not infecting devices with RU keyboards: it's just about avoiding difficult regulatory environments.

The analogy, of course, goes further. Though unlike most ransomware companies, NSO has British and American VC funding.

Most people don't know that the first bit of an area code is the evil bit. https://en.wikipedia.org/wiki/Evil_bit

NSO has a deal with US Telecom to grow its market share throughout the world and hence the +1 statement. /s

Maybe NSA wants every important call goes through USA network (and hence a deal with NSO) - makes the job easier for three letter agencies.

These people are in for a world of hurt, the State Department tells the CIA what to do.

> State Department tells the CIA what to do

Your broader point is correct, but no, it doesn't. The CIA is an independent agency [1]. It reports to the DNI [2].

[1] https://en.wikipedia.org/wiki/Independent_agencies_of_the_Un...

[2] https://en.wikipedia.org/wiki/Director_of_National_Intellige...

Yes, but who dictates where and how they can play overseas?

> who dictates where and how they can play overseas?

The Director and Deputy Director of the CIA.

I'll simply disagree.

Heh, that showdown sounds like it would make for a hell of a book decades later.

"We promise we don't work on numbers with +1" :wink: :wink:

Reply on news.ycombinator.com