Brainstorming:
- Sue them, aggressively.
- Looks for exploits in their own systems and publish their code, making it worthless.
- Publish lists of their owners and employees and/or ban them from Google/Microsoft services.
I'm sure folks here could think of more/better ideas.
OK.
But it's in Apple's interest to work with them. Because the alternative is that the 0-day exploits get sold to companies or countries that aren't Apple.
No such synergistic relationship exists between Apple and spyware vendors.
How can you ban an individual from using Google or Microsoft services? Will you require id. cards, pictures and the like in order to register your Gmail account? Well, that would be great as it would stop many other people from using those services.
Also, what you seem to suggest (a "black list" exposing people working at X) is wrong at so many levels. Should we also expose people from the military, CIA, FBI, etc? Rest assured that those orgs cause so much more harm that companies writing exploits for your browser.
Because they operate in the same manner. If a spyware maker is convicted in US, the gate might be open to convict also Google, Facebook, Microsoft, Apple on the same grounds.
Disclosure: I work at Google.
Title says spyware.
On what grounds?
> - Looks for exploits in their own systems and publish their code, making it worthless.
Are you saying Google should publish exploits of Variston's systems? There's kind of a "two wrongs" problem there; such information would likely require illegal hacking ("accessing a computer system without permission") to discover.
> - Publish lists of their owners and employees
I'm sure they do as much as they can in that regard, but I'm sure such companies do much to hide their ownership and employees, and at any rate it could be seen as encouraging illegal harassment of said employees.
> ban them from Google/Microsoft services.
To the extent possible I'm sure they do this, but Google can't really stop someone from using Chrome, or always reliably detect when someone representing a malicious company is using their services.
> On what grounds?
Love it or (more likely) hate it, the DMCA has anti-circumvention provisions in it, and breaking out of a sandbox sounds like it matches that.
> Are you saying Google should publish exploits of Variston's systems? There's kind of a "two wrongs" problem there; such information would likely require illegal hacking ("accessing a computer system without permission") to discover.
I don't think there's actually any problems here, as long as the "publish" portion is adhered to. Making sure they don't break the law in finding those exploits would be the hard part though, as you note.
> On what grounds?
A breach of the Terms and Services that all publishers are required to abide by, to have a relationship with Google and/or Apple. They have a list of security provisions and list of things you can and cannot do.
It'd be an interesting escalation. I think it would work, It's a big part of the digital ecosystem you'd essentially be blacklisting bad actors from. Though there'd be scope creep eventually. So maybe it'd be dead on arrival as a technique to pressure them.
I feel sorry for you if you live in a country like that, but fortunately, in the country this company operates there are laws and regulations preventing that you can be punished or discriminated based on what your parents do or done.
Preventing the state from doing the punishment, yes. But AFAIK there’s no de jure rule on private entities doing this. It may go against the spirit of our systems and societal norms, but it would not be against the letter.
It may, however, spur new legislation to subsequently ban the practice.
Here we have schools using all this crap from Microsoft or Google for education. I don't see how a company, with our actual laws, can prevent a kid from studying just because his parents did something.
The described scope is already horrible enough that I don't know how you could possibly acknowledge that it'd get even worse and still advocate for it.
Is it really their responsibility to tackle international cyber crime orgs?
General goodwill, good publicity, and mid-to-long-term, strengthening the market they operate in and reducing their own expenditures.
The question is interesting because they seem to also be the best players for it: they're affected, have the right skill sets, and more than enough spare money to afford it.
> We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with.