Hacker News Reader

Comment by cs702 | Hacker News Reader

So, back then, countries were going to extremes like retrofitting electronic typewriters with spying devices, and secretly placing them inside the offices of their enemies, so they could spy on their enemies.

Nowadays, there's no need to do anything so extreme, because everyone everywhere is already carrying a supercomputer with a camera and a microphone, 24x7, and willingly agreeing to install and share a ridiculous amount of information with random apps!

View on HN

Nowadays, technology firms are going to the extremes like implementing virtual machines with a custom instruction set inside of PDF files [1], so they can sell exploits to governments who use them to spy on their enemies.

I think not much has changed. Highly sophisticated spying activities are still happening in today's world. The advanced techniques required are very valuable, and are thus only used in cases where the desired info is valuable enough, and cannot be obtained through simpler means.

Users voluntarily sharing "a ridiculous amount of information" are not the target group of today's sophisticated hacks, and were not the target group of the Selentric bug either.

[1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Users sharing "a ridiculous amount of information" are definitely not the target group, but it sure as hell is easier when your target is in that group.

Nowadays you don't need to bug a Selectric, you just need to pay some ops person half a world away a few thousand to send you all the info you need.

First of all, excellent link!

Virtual machines with custom instruction sets -- seem to be a broader problem -- that they can apparently exist within a PDF file is one specific instance of this broader problem...

A selected quote from the article linked:

>"Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense."

To the author of that article:

Well, "short of not using it", that is! <g>

https://itigic.com/minix-the-hidden-operating-system-in-inte...

> Nowadays, there's no need to do anything so extreme, because everyone everywhere is already carrying a supercomputer with a camera and a microphone, 24x7, and willingly agreeing to install and share a ridiculous amount of information with random apps!

i don't think that government employees who handle secrets are allowed to use commodity smartphones.

At some level, maybe not. But the majority of government employees and contractors with secret clearance do use commodity smartphones in their private lives. They might not be able to enter the workplace with them.

It's also not clear how well this is enforced. Don't forget Hillary Clinton was running her own email server as Secretary of State.

> It's also not clear how well this is enforced. Don't forget Hillary Clinton was running her own email server as Secretary of State.

as did bush jr (i think it was gwb2004.com or something.). maybe i have too much faith in the politicians, but i suspect that actually important secret things probably stayed on government equipment and that external email was used mostly for political strategy.

And, even a half-bad implementation of encryption is powerful enough to make people lose enough time trying to decrypt them.

This is why everyone is trying to ban cryptography on daily apps. Because it's getting really good.

Addendum: Don't forget Crypto AG shenanigans.

Why in the name of science is this being downvoted?

Reply on news.ycombinator.com