Poland’s PM says previous government illegally used Pegasus spyware | Hacker News Reader

Poland’s PM says previous government illegally used Pegasus spyware

apnews.com

242 pointsarkadiyt81 comments

Just bear in mind that this is the same Polish PM whose former government set World record making requests to Apple for data from 241 509 iPhones in 1H2015… (out of 300 thousand total request from the entire World)…

Quarter milion iPhones in 2015 in Poland was basically everyone who counts in public life.

https://www.apple.com/legal/transparency/pdf/requests-2015-H...

Making requests is one thing, because Apple can deny the request, while using Pegasus simply hacks the phone without oversight.

Thank God we have Apple to uphold civic society and due process in Poland

from your linked document:

*Poland: predominately requests from Customs and Revenue Authorities

KAS is under government control MoF, not an independent institution, right?

KAS has very specific mandate though and doesn't share with other institutions - they tend to go after very specific things that they do know how to get.

Not that it's a crystal clear institution, but everything will go around taxes and customs with them, even when it's something rotten.

1 Over 7000 licenses for Pegasus alone. Both opposition and own party surveilled.

2 Usage of Pegasus means all intercepts are on the servers in Israel. All Government secrets and potential kompromat transferred to foreign power.

>Usage of Pegasus means all intercepts are on the servers in Israel

Wait, seriously? Any sources on that? I find it hard to believe that any government would spend $$$ on a security tool that doesn't allow on-prem installation and instead beams all your surveillance to another country.

You have a lot to catch up on, then.

I’m curious about this statement too, seems there’s evidence that they don’t and the customer is the data handler: https://www.edps.europa.eu/system/files_en?file=2023-01/0221... top of page 4.

I guess this is all according to NSO claims. I’d like to see evidence otherwise!

Why would you trust anything a spyware company says? This is not a tongue-in-cheek question.

No honour among the thieves

It is a lot of money lost if it comes out that you lied to some of your biggest clients.

Not if your customers are reticent to even admit being a customer in the first place.

Your other customers will see every major headline that you lied and kept confidential documents.

That was one of the claims during parliamentary committee investigating it.

S(pyware)aaS

a) it's not a security tool but spyware b) this spyware is meant to spy on the government so this job is better outsourced to another government

this was meant to be used for spying terrorists and such, so should not be big deal

from what I heard about Pegasus: noone could get that malware for themselves to not compromise it, so it's you wanted to hijack some phone you would send them phone number so they could resend exploit again (spyware was not persistent across reboots, so you needed to rehack it every time)

NATO countries' governments and military use phones with encrypted communications to which the US has the keys. This fact was made available during investigation into the Polish government plane crash in Smolensk. The US authorities have access to the recordings of the calls made by the late president of Poland, but said they would not make them available.

source: https://www.money.pl/archiwum/wiadomosci/artykul/usa;nie;uja...

Indirectly, all software vulnerability tools that send source code and other artefacts to servers outside government's control give third parties access to information about potential attack vectors, software vulnerabilities, and infrastructure layout.

>NATO countries' governments and military use phones with encrypted communications to which the US has the keys.

What do these phones look like and who manufactures them?

3. And most importantly: all of that funded by the taxpayer, to satisfy one man's paranoia.

Even worse. Pegasus was all paid from the 'Justice Fund', which was intended to help crime victims.

https://www.funduszsprawiedliwosci.gov.pl

"The Justice Fund provides immediate and free emergency assistance to crime victims, witnesses and their closest relatives, including victims of armed aggression in Ukraine.

You can use the free:

legal aid, psychological help, material assistance"

Quite fitting considering previous corrupt regime was ran by PIS, which doesnt stand for piss but 'Prawo i Sprawiedliwosc' - Law and Justice.

best of all they spy on their own party members and some businessmen's which were rivals of some party members family

To absolutely no one's surprise.

What is surprising is that Poland was able to rescue itself from this catastrophe with democratic means. Unlike Hungary and Belarus.

This is what happens when democracy starts to dysfunction and the ruling party wants to cling to power any means necessary.

Is Pegasus still working, or OS manufacturers patched the vulnerabilities it was using?

Pegasus is only the malware that has the spying capabilities (file upload, download and command execution...etc).

it usually infects the intended target using an exploit (0-day) that doesnt have a fix, if you're asking if there are 0days that can hack modern iPhones, the answer is most likely yes, given the most recent hack against the iPhone of one of the executives of the russian cybersecurity company Kaspersky [1].

[1] https://www.youtube.com/watch?v=1f6YyH62jFE

Pegasus is in constant development, its not one off spyware

Fuck NSO Group.

The NSO is only supplying a product for which there is insatiable demand from every government. If they wouldn't build them, someone else will.

They're kind of like arms manufacturers. Do you blame them if your government shoots you?

> They're kind of like arms manufacturers.

More like hired hitmen.

If the arms manufacturer explicitly works with unethical and illegal uses of clients as main sales target, yes.

> The NSO is only supplying a product for which there is insatiable demand from every government.

There is also insatiable demand for nuclear weapons, but if a private company from the US started selling them to random dictatorships, yes, I would blame them.

Poland isn’t a dictatorship, it’s an EU member state and a member of NATO.

Also let’s not compare malware/spyware to nuclear weapons.

Poland can get their hands on any weapon or controlled technology they pretty much want.

Pegasus is notoriously sold to more than 40 countries worldwide, among them a fair share of dictatorships: Saudi Arabia, Belarus, Kazakhstan, Azerbaijan, (Hungary?), Bahrain, Russia...

You truly have some bias in your definition of dictatorship.

A bias towards democracy.

Like Canada, US ...

That would be an argument if we weren’t selling weapons to those countries all the fucking time.

It wasn’t sold to neither Russia or Belarus, and the rest are countries that we sell weapons too all the time.

And I find it laughable that you out Hungary as a dictatorship it’s an EU member and a NATO member.

Of course I do. Is your theory that manufacturing weapons of war is a morally neutral occupation?

Replace NSO group’s spyware with child sex slaves, reread what you wrote, and then revisit your moral compass

> If they wouldn't build them, someone else will.

Nobody thinks that we can prevent everyone from doing something. The point of regulating (or making it illegal) and then enforcing those laws is to increase friction, increase costs, and thus making the thing difficult enough to obtain that the problems it causes become manageable. If there are 3 vendors of this sort of thing, then shutting down one of them definitely will make it more difficult for would-be customers by increasing costs and risks. Something does not have to be perfect to be good.

> They're kind of like arms manufacturers. Do you blame them if your government shoots you?

When Iran sells weapons to the Russians we definitely blame them, yes. And the Russians for using them, as well.

And, more importantly, fuck the states that support them, and the people who are complicit with them at any level.

They are too many.

Why? It serves no purpose, if it wasn't them, it would be New NSO Group instead. So long as these vulnerabilities exist, they're going to be exploited. Every time they find an exploit it's a moment of pure genius. With every new baseband and every new OS update there's a good chance that they find they have no answer. I don't blame the hackers in the slightest. It's also not useful to blame governments.

More useful to blame the systemic issues that allow these things to take place: the one that pops to the front of my mind is that the FCC has such a high degree of standards with modems that it results in a severe lack of competition. Google and Apple choose to release phones without contractually demanding full source access to the entirety of it so that it can be audited by their security teams. Those are things that can and should change.

What? Pegasus is not enabled by modem vulnerabilities. The primary vulnerabilities used on iOS phones are in Apple designed and implemented components and the primary vulnerabilities used on Android phones are in Google designed and implemented components.

The problem is not that Google and Apple did not have the opportunity to secure the vulnerable components. The problem is that their best teams with thousands of people and billions of dollars are completely incapable of designing systems secure against moderately resourced attackers.

They openly admit that their systems are defenseless against attackers with resources. Every single time their security is completely invalidated they make press releases like: "It was a unprecedented attack using never-before-seen techniques by highly sophisticated attackers." implying that they can not be blamed because look, they were "highly sophisticated" and it was "unprecedented" there is no way we could stop that. Even though every single attack is described that way.

You would be hard pressed to find a single technically competent security developer in any of these organizations which would claim their systems could stop their systems being totally and utterly compromised and their security completely invalidated by a single, individual, lone competent hacker with a year to work on attacks. A team of 3, forget about it. That is only in the low millions of dollars to completely invalidate their entire security story for all hundreds of millions to billions of systems worldwide.

No, the problem is not a lack of accessibility, effort, resources, or focus. The problem is that all of these large companies have failed for literal decades to develop systems secure against competent attackers. And the entire time they have been intentionally deceiving the public into thinking they can even though they know and admit they can not.

The solution is to stop believing these perennial incompetents and liars until they present solid, auditable proof. At least then they can not suck all of the air out of the room from people who actually know what they are doing.

> The problem is that all of these large companies have failed for literal decades to develop systems secure against competent attackers.

I don't think they tried. One of their main customer is a 3 letter agency which has no interest that the bugs get fixed.

NSO is just a strawman for the government of Israel. Surveillance technology is a very successful soft power tool, as the dictators crave its capabilities to stay in power. Pegasus is world class technology, so Israel could score a lot of brownie points by allowing these sales. Too bad they got too greedy and sloppy and allowed the phones of some US officials in Africa to be infected. Coincidentally there was a leak of 50000 phone numbers and NSO goes boom. Israeli "security diplomacy" rebuilt NSO and is still going strong, surprised i am not :-(

Yep. One could also say "fuck state surveillance", but it doesn't have quite the same ring to it (and coincidentally implicates Apple and the NSA).

Why not target the NSO group headquarters with a drone?

Because that must be helluva drone!

"and illegally" is strangely missing from the title

God knows what dystopian regulations/powers they created for themselves.

That's no doubt an artifact of HN's 80 char title limit, which required the submitter to shorten the title.

Edit: I've changed it now.

Is 80 still the hard limit? I see it warns if too long when typing in a new submission. However, HN guidelines don't provide guidance in what to do if the title is too long.

80 is the hard limit with a few weird exceptions like you can have 6 extra chars for " [pdf]".

> However, HN guidelines don't provide guidance in what to do if the title is too long

We can't get to that level of detail in the guidelines—it would make them so long that no one would read them! Except maybe to look for loopholes.

“Poland and the demon in democracy” https://theupheaval.substack.com/p/poland-and-the-demon-in-d...

Politicians committing crimes end up in courts and then in prison, plain and simple. And this is plain propaganda, repeating many talking points of the PiS party (the party previously in power, who illegally used Pegasus).

iT's poLitICal PerSeCutiOn!

Is anyone fooled by this drivel? Honest question. Because some things are pernicious: misleading but in a subtle way, sly and devious. This is just so in-your-face laughable.

About 40% of American voters appear to be falling for it.

The author seems to contradict themselves in many places… maybe they just really want it to be true. For example, “allegedly” and “convicted” in this case:

> He was convicted during Tusk’s previous regime (2007-2014) for allegedly abusing his power while pursuing government corruption with “excessive zeal,” but was officially pardoned by then-new President Andrzej Duda in 2015 – a long-standing point of displeasure for the Polish left.

> The former top European Union official’s party only won 30% of the vote compared to the 36% of his incumbent conservative, EU-skeptical rivals, the Law and Justice (PiS) party, but was nonetheless able to assemble a coalition of leftists to take power.

Just one party in this coalition is from the left. The rest is decidedly centre to centre-right.

Hard to treat this piece seriously.

Doesn’t even matter, coalition governments are a central feature of parliamentary democracies with roughly proportional elections.

Anyone who can form a coalition can rightfully govern. Those who get the most votes don’t automatically get to govern.

I didn't even pay attention to that part, but indeed it's equally absurd.

It feels surreal to hear this crap translated into English

Reply on news.ycombinator.com