New Pegasus spyware abuses identified in Mexico | Hacker News Reader

New Pegasus spyware abuses identified in Mexico

citizenlab.ca

215 pointsstefan_30 comments

I just recently listened to 2 great of Darknet Diaries covered Citizenlab, NSO, and Pegasus.

https://darknetdiaries.com/episode/99/ https://darknetdiaries.com/episode/100/

The gist is that the NSO group is a company that sells malware which they claim is only ever used to catch bad guys, but the podcast makes a pretty compelling case that they know that repressive governments and even companies use it to target journalists and activists.

No need to make a compelling case at this point, it is widely known. Israel has a large tech sector, much of which is directly or indirectly related to "security" and "defense", aka military and surveillance. Not much unlike the US either, but companies like NSO are at the top of their game and seem to have little restraint about whom their products are sold to.

The Computer Fraud and Abuse Act of 1986 doesn't apply to NSO because fuck logic.

If you are NSO, you can openly commit computer fraud/abuse and even sell it as a product/service.

Is NSO affiliated with The Israel Lobby? That may explain it.

Well, the CFAA can only be enforced against territories under United States jurisdiction.

The US could say “tighten controls on your defense contractors or lose our support” and then do that if they don’t listen. That’ll never happen though. I’m sure plenty of TLAs use NSO software.

That doesn’t stop the DoJ from extraditing foreign nationals who never set foot on US soil before.

> compelling case that they know that repressive governments and even companies use it to target journalists and activists.

Poland's "Law and Justice" regime has apparently used Pegasus to spy on opposition senator Krzysztof Brejza[1] and other opposition politicians[2]

[1] https://news.yahoo.com/ap-exclusive-polish-opposition-senato...

https://techcrunch.com/2022/03/11/europe-pegasus-investigati...

https://www.theverge.com/2021/12/27/22855390/poland-pegasus-...

[2] https://www.theguardian.com/world/2022/feb/17/more-polish-op...

https://democratic-europe.eu/2022/01/18/citizen-lab-there-is...

In a way it doesn't really matter where this came from.

NSO, NSA, MI5... boys like their toys and can hardly help themselves.

And cyber-weapons - which are persistent, portable, infinitely reprodicble at zero cost, reusable, indiscriminate and liable to blowback - will always fall into the hands of assholes, common or garden thugs and bullies. There is not even the merest possibility of strategic limitation of such knowledge hazards.

So how about stop blaming the spooks. That's a distraction.

What does matter is that the entire ecosystem of "smartphone" technology is compromised to the hilt. And it was built that way to make few extra bucks. Our desperate, suicidal stampede to make ourselves totally dependent on it is the problem.

Digital self defence starts with not sticking your dick in a meat-grinder.

Good comment. Could have been better without the sexist undertones. Only "boys" lack self control?

I'm a boy and I don't see it as sexist. It's just a snarky remark, not a political statement about the male biology.

The much larger than understood cyber weapon world definitely enjoys how much of a PR loving extrovert Shalev Hulio (NSO founder) was. It takes the spotlight off them

NSO is just a commercial company buying and looking for 0-day exploits, 0-click or 1-click, it doesn't matter. There are probably hundreds of people with knowledge of said 0-days in the company who can turn around and start their own company the next day, or sell the 0-day instructions to 20 other companies

There are definitely many other players in this realm who no one talks about, using the same exact tools and exploits. Just not PR hungry like NSO is

https://citizenlab.ca/2022/04/catalangate-extensive-mercenar...

^ The article links to this Catalangate rundown, which has more details on the various exploits involved.

A bit of a tangent but a quick search didn't find any references to this so I may as well post it here:

There's a big wiretapping scandal going on Greece since the beginning of August, accompanied by an equally big attempt to cover it up.

What happened is that a Greek MEP discovered that there was an attempt by someone to infect his phone with Predator. Later it was confirmed that he was also being spied upon by the Greek Intelligence Agency during a period that he was running for leader of the 3rd largest party of the country (which he won).

This came as an addition to reports from a journalist that he being targeted by the intelligence agency when they were investigating the scandalous legislation that gave the country's bankers immunity.

The PM had admitted the spying of the MEP stating that "it was lawful, but wrong" and he fired the director of the intelligence agency as well as his nephew that was the director of the PM's office.

It's worth pointing out that the the first piece of legislation passed by the current government was one that transferred the intelligence agency directly under the PM. They also legislated more laxed criteria for the position of the agency's director to fit the profile of a person the PM had already chosen. It's worth pointing out that the PM claims that he didn't know the reason the MEP was being targeted and that he it would be outrageous if he knew.

Relevant news articles:

https://www.bbc.co.uk/news/world-europe-62822366

https://www.nytimes.com/2022/07/27/world/europe/eu-spyware-p...

https://www.theguardian.com/world/2022/aug/07/greek-pm-kyria...

https://www.theguardian.com/world/2022/aug/08/greek-pm-denie...

Software engineers should receive iron ring, so they can deny writing critical software in unsafe langs like c cpp, so journalists arent in danger

https://en.wikipedia.org/wiki/Iron_Ring

I'm not sure how you're coming to the conclusion that wearing an iron ring changes any sense of responsibility. I'm bound as a Canadian engineer to provincial legislation (law) regarding my responsibilities, that and my job contract. The (very optional) iron ring I'm wearing is symbolic and only a part of tradition.

I didn't know safe programming languages protect against logic bugs and side channel attacks. What good is Rust if the processor itself or RAM are leaking encryption keys?

The problem is NSO, not the tech stack, but I guess this is the tech equivalent of looking for lost keys under the street lamp because that's where the light is.

Health professionals swear the Hippocrates oath, and that hasn't stopped unethical practices. The iron ring is only a reminder that not doing your work well can cost lives directly imputable to you.

Pegasus seems deeply intertwined with Unit 8200. If former Unit 8200 members are involved, does it at some point involve the government of Israel directly?

A lot of the most successful tech startups in Israel are formed by ex 8200 members. Very hard to say about government involvement. Might compare it to American defence contractors who used to be in the armed service.

Even that comparison is a bit of a reach because the US does not have conscription, so the professional/education pipelines are just massively different.

I wonder where the non-NSO offensive companies' products end up going. Like, NSO is absolutely not the only player in this game by a long shot (they're hardly the largest even) and yet they have dozens of Citizenlab pieces on them. Was NSO just particularly shit at writing implants or something and thus they are the only ones getting caught? It's truly bizarre that they leave behind that much forensic evidence.

Maybe because the initial reporting got so much traffic, Citizenlab pushed far more resources into investigating NSO products? Maybe its political in nature? I can't imagine the reasoning is technical incompetence by NSO (have you read the FORCEDENTRY writeups? its insane). Maybe NSO's clients more haphazardly pursue targets, so there is a higher probability of recovering some forensic evidence?

Didn't the NSO also attempt a "sting operation" on Citizenlab? They don't particularly come off as sympathetic and/or competent (politically); especially after targeting American diplomats in Uganda.

Anyone know how a Pegasus infection is detected? I never see detection advise in these articles.

Citizen Lab specializes in pulling information from databases present in an iPhone backup that they pull from an infected phone. Here's one (of several) blog posts that details a bit of their process in detecting an infection: https://citizenlab.ca/2021/11/palestinian-human-rights-defen...

There is the MVT project on GitHub. caveat emptor, it comes with apt warnings but the documentation helps.

https://github.com/mvt-project/mvt

it's not "uses", it's called "abuses" now?

The distinction is clearly not relevant for NSO, but for most other people it still is.

The government is not meant to use it that way, it's against its own law. Abuse is apt.

Reply on news.ycombinator.com