Hacker News Reader

Comment by gataca | Hacker News Reader

Why doesn't Apple just buy NSO and use them as an internal defense group?

Assuming NSO would even allow itself to be purchased, various nations would get involved to prevent it. Too many national security issues on the line for them. If anything, Apple would be better off starting up a new office and try to hire individuals within the NSO Group.

Whether poached or acquired, NSO employees are almost certainly already under the influence of Israeli security agencies.

If your players in this hypothetical are Apple, NSO, Israel, and USG—each could probably have a pretty convincing list of arguments for and against. I could see it going either way.

If by "under the influence" you mean alumni of. They're similar to the staff of military contractors in the US, roving from company to company to use all the skills they learned on the inside for massive profits privately.

NSO has changed owners several times. They’re now owned by a UK firm called Novalpina Capital.

NSO seems to essentially be a front for Israel's Mossad intelligence agency. They get to wash their hands of whatever NSO does by saying "hey that wasn't a nation state spying, they're a private company and we'll punish them for you don't worry."

For a more public facing version of this from the CIA, look at their unofficial Venture Capital wing: https://www.iqt.org/about-iqt/

It's usually ex intelligence that work in such companies. That being said, that's not how the tools work. Data exfiltration wasn't tracked to the vendor.

You must remember the US' interest in spying and conquest is a rather unique trait. Most countries don't go looking for trouble worldwide.

Pegasus is legally considered a weapon in Israel and I doubt the government will allow it.

How could you make sure that you haven't just bought a very expensive Trojan Horse?

I don't even think NSO is designing these exploits. They are almost certainly buying them in. Apple just needs to outbid NSO.

> I don't even think NSO is designing these exploits.

That's interesting. Why do you think that?

NSO, while having the blessing of a nation state, is still a private company, but has access to some very high-end exploits that would almost certainly require a very large team to develop and to keep ahead of the fixes. It is just more likely they are going the cheaper route of buying the exploits and copy/pasting them into their system. This way they can outbid most others as they are reselling the exploits multiple times to many different nations - the other potential buyers, e.g. intelligence services are buying only for themselves and are limited in their budgets.

I suspect some are sold by disgruntled employees who are disturbed by the internal culture.

That's a serious accusation to make without evidence. Anyone doing this would rightly face significant jail time.

Because it makes no sense. NSO is just one of the many companies doing offensive netsec.

Not to mention, they're one of many public. One has to think that there are many more like NSO that don't have huge media publicity around them.

How would that benefit Apple?

They are already able to spy on their phone users if ordered by the right three letter agency, they don't need NSO/Pegasus for that.

And if they still do so, it would basically be official: "look a phone vendor that develop tools to spy on phone usage". Not a good marketing either.

Apple would presumably fix the vulnerabilities, rather than exploit them themselves.

And the people at that company who enjoy developing attacks more than they enjoy defending against attacks would just leave and form a new company, that would then sell its attacks to the highest bidder.

Red team still develops attacks. They just do it directly for the blue team that fixes them.

But some people might not decide that this is the career for them. You can't eliminate a threat to iPhone security by buying the company, because you can't enslave its employees.

Not really related to what I was saying

Having wads of cash doesn't mean you can buy any company without their agreement.

Having a few trillion dollars makes it a little harder to say no to, but yeah this would not make much sense for Apple.

Reply on news.ycombinator.com