Hacker News Reader

Comment by VWWHFSfQ | Hacker News Reader

>> Further validating our finding of targeting, our forensic analysis shows Kouloglou received multiple Apple threat notifications about targeting with mercenary spyware on three occasions: March 2, 2023, August 29, 2023, and April 10, 2024. It is important to note that threat notifications from Apple and other companies are not real-time alerts. They are typically sent to users in batches, often months or more after targeting takes place.

>> Kouloglou reports to us that he did not recall receiving the Apple notifications we observed.

Am I understanding this correctly that Apple sent him notifications that he was being monitored and he ignored them?

View on HN

"he did not recall receiving the Apple notifications" so he didn't notice them.

That is kind of surprising given he is on the comittee investigating pegasus. I'd assume someone on the comittee would be paying much more attention to this than a normal person.

I wonder what triggered him to suspect he was hacked then. Since presumably something triggered him to have his phone forensically investigated.

> That is kind of surprising

Have you seen notifications on iOS? There are even notifications for the notifications.

But this type of notification I believe is delivered via iMessage and email. So unless you’re actively using iMessage or your icloud email then chances are all this is practically invisible.

People seem to have this fiction that parliamentarians working on a committee actually have some expertise. This can happen but is actually rare. They are not elected for skill but for political reasons, and then the parties pawn them to different committees.

So in other words he probably speaks about security, whatever his staffers feed him, but most likely has no clue whatsoever what it's about.

Or that Apple could either run searches on the names of affected users against publicly known members of government or have close relationship with governments to flag exactly this.

If he knew he was compromised, and was okay with it for one reason or another (like money or other coercion), this is what his cleanup would look like.

Not saying this is likely. Just another possibility.

Could those have been intercepted or suppressed somehow?

It's possible, if the attacker controls the device enough. I don't think a big "you're being targeted" warning is something you don't notice, or forget.

Do they send them via notification infrastructure or email? Personally I almost never check the email associated with my Apple ID so I would miss those. But if all my Apple devices were notifying me and I had a badge in Settings.app, I’d notice.

Then again, you’d think that’s the kinda thing malware developers would spend some time learning to hide from the user.

Do we know how Apple sends these? Is it just a notification, or also email?

https://support.apple.com/en-us/102174

>A Threat Notification is displayed at the top of the page after the user signs into account.apple.com.

>Apple sends an email and iMessage notification to the email addresses and phone numbers associated with the user’s Apple Account.

You can see what it looks like in https://reddit.com/r/iphone/comments/1c10jai/i_have_received...

I wonder how they detect it, is it for known IOCs that they've already found elsewhere, or do they have heuristic detection that flags things that might need further investigation.

I could be wrong here, but I can’t see any way of viewing old notifications.

It isn’t hard to accidentally dismiss one then wonder what it was. Why there isn’t there an interface for looking back?

Edit: below it says there are emails and notices on web login.

If a notification is dismissed on iphone, there's indeed no central UI to see it again on the phone. That's a sad state of iphone. Many people have asked, but Apple just doesn't care enough to do it. Now I hope this kind of high-profile security incidents could nudge Apple towards taking action.

Any source for that “Apple just doesn’t care”, as opposed to thinking there are security/privacy tradeoffs or other considerations that cut against such a feature?

Ok, apple does not care, but gives “security/privacy” consideration as a public reason for not doing anything.

If Apple can store the sms/iMessage, and email history, and health/journal history, and my Wallet payment history, in a safe manner I would think Apple can store notification history in a safe manner. How would notifications be meaningfully different from these?

I think the proof of Apple’s level of care is in their lack of attention to this issue.

> How would notifications be meaningfully different from these?

Ephemeral transit layer owned by third-parties constantly,

cold storage of secrets your architecture owns from start to finish.

> Ephemeral transit layer owned by third-parties constantly

This is a good description of SMS and RCS.

and also a good description of Apple APN notifications being pushed to a Garmin watch,

or a car,

or your off-brand earbuds.

Which, again, is not meaningfully different. Yet it seems you insinuated so. Can you explain in detail?

Hopefully it wasn’t you who flagged me after asking me to explain in detail…

I did not flag you, but I certainly see why someone might.

Go on.

Go on with what? Asking you again to answer what you repeatedly avoid to answer?

This is the opposite of avoiding answering you. https://news.ycombinator.com/item?id=48787084

With modern cryptography techniques, Apple could certainly do it if they cared enough. I guess the potential benefit doesn't justify the potential effort and cost related to the change, from Apple management point of view.

If they cared, they would give user triple confirm option to choose for example.

Oh wait this is apple, they always know whats best for the user and do the choices for them, even when wrong. So all is as expected

Or he lied about noticing them to avoid embarrassment.

I mean his device was pwnd completely. Its not a stretch that attempts to warn are suppressed.

That or he didn't notice or could have assumed the notice itself was one of many phishing attempts against large orgs.

If I saw a notification that my account was compromised by Pegasus I'd personally assume phishing.

Kouloglou is a famous investigative journalist, not you and me. Yes you and I might think we're being scammed, but someone who actually spent a lot of their life getting death threats probably would pay more attention.

Fairly sure that if anybody using a advanced piece of hacking software, they are also going to delete any messages that are related to detection of such hardware.

PC viruses used to do that stuff going back so many years ago. Suppressing any notification under Windows, by disabling the AV software, its notifications, windows notifications related to it.

So it will amaze me that this is not done by any modern espionage software. Especially as the notification methods are known. Given that his device is hacked, that means a lot of avenues are under control of the espionage software. Even mails etc ... So impersonating the end user, to confirm they read a warning, is extreme easy.

I find it rather odd that people are so fixated on the idea if Kouloglou read it or not.

Maybe the software can only exfiltrate information, rather than change it.

If i was going to write software on this level, that will be used by governments. There is no way, its going to be a nice little program that only extract information.

Its going to have every trick in the book (and outside it), to stay hidden. And it will have payloads to alter its behavior, updates, etc...

Nobody is going to pay you big fat money envelops for software that anybody can write in a afternoon. You want it to be as capable as ever, and you do not want it found!

I mean maybe the exploits they found weren't good enough to allow them to do whatever they want with the phone.

That seems to be the case, although he claims to have somehow missed them. Overall this is one of those stories that's obviously an outrage, except for the fact that every country on Earth spies on the rest, and quite a few private entities do as well. Still the way the game is played if you get caught you have to act ashamed, and the people catching you get to gloat.

It's silly, but it's a show the public never tires of.

In this case he was investigating misuse of Pegasus spyware specifically, and was targeted with it while doing so. That's obstruction of justice, morally speaking, and would feel very scary, in that it would make you feel that this company might be so powerful that investigating it is personally dangerous.

That's certainly the feeling the story is meant to engender yes.

Alternate spin: He now has a conflict of interest. He’s now too biased to work on the committee.

For who?

The US does not spy on Five Eyes government leadership or that of Israel. And perhaps more: in the wake of Snowden, which obliterated many diplomatic relationships the U.S. has with other countries, Obama issued a directive that the U.S. would not monitor heads of state and government of close friends and allies (even outside Five Eyes) unless there was a compelling national security reason. As far as we know that directive has remained in force with each successive administration as well.

They spy on most others though. Germany’s Merkel, successive French presidents etc all had their phones hacked by US there is widely reported news of.

US does spy on Five Eyes

https://en.wikipedia.org/wiki/United_States_espionage_in_Aus...

"In December 2010, leaked US diplomatic cables indicated senior New Zealand Defence Ministry officials had been spying for the United States, secretly briefing the United States embassy on Cabinet discussions about the Iraq War."

https://en.wikipedia.org/wiki/Foreign_espionage_in_New_Zeala...

That’s pre-Snowden

Nothing has changed post-Snowden, other than that the general public have gone back into a state of apathy on the subject of reigning in their out of control surveillance state.

I didn’t say anything has changed, the 2010 example he mentioned is pre Snowden.

> The US does not spy on Five Eyes government leadership or that of Israel.

Doubt.

> unless there was a compelling national security reason

There always is.

Absolutely, and there's the same compelling reason for them to spy on the on the US in turn. I can't emphasize this enough, everyone is spying on everyone else. Close alliances give the impression that they don't because they tend to handle scandals in-house, it's for everyone's benefit to do so in most cases. Snowden's disclosure was a very unusual event and put everyone in a position of needing to act shocked, appalled, and put on a big show for the public; sweeping it under the rug was impossible. For all that many here would wish otherwise, Snowden wasn't a watershed though, it was a blip.

> Doubt

Can you substantiate your doubt with even one piece of hard evidence?

Sure. The NSA exists, and it routinely violates the rights of the USA's own citizens, the ones that actually have constitutional rights. The idea that it would suddenly draw the line on foreigners is just absurd.

It violates everyones’ human rights - not just the US’ own citizens - because human rights are universal whether some American thinks it or not.

You can probably share specific evidence of NSA violating U.S. citizen rights. But can you share specific evidence if NSA spying on a five eyes nation or Israel post-Snowden?

Yes, the US has an intelligence agency called the NSA, which works with intelligence agencies in the five eyes. There is something called the five eyes agreement that does draw that line.

> There is something called the five eyes agreement that does draw that line.

Believe such nonsense at your own peril.

https://en.wikipedia.org/wiki/Israeli_espionage_in_the_Unite...

> In 1951, Mossad and the Central Intelligence Agency agreed not to spy on each other and US and Israeli services cooperated closely since then.

> Nevertheless, there were strong indications afterwards of ongoing Israeli espionage against the United States, confirmed by the 1985 arrest of Israeli spy Jonathan Pollard, one of the most damaging security leaks in US history.

> Israeli espionage reached a high-profile peak in the mid-1980s, shattering assumptions that allies "do not spy on each other".

I'm curious what peril your cynicism about the five eyes agreement has saved you from.

The peril of sleeping easy at night, comfortable in the fantasy where no one would ever spy on me just because they pinky promised not to. Not keen on believing evil bits either.

1. I think burden of proof is on the opposite side. (Previous legislations/directives were circumvented without problem)

2.Asking for hard evidence of top spies secretly spying on heads of other states is … (not sure if there is a word for it; some blend between: unrealistic, unreasonable and oxymoron’ish. If they do their job well, you will not find it out, also it might be illegal or punishable to present such evidence)

Can you substantiate your certainty with anything other than the public statements of people whose job is to lie about things like that?

> As far as we know that directive has remained in force with each successive administration as well.

People can state a lot, as long as your not caught.

Nothing prevent you from having the UK spy on the Germans, and feeding that intel back. Or Israel, or ... Hey, the US did not spy on a EU ally. Well, not directly and it neatly bypassed any official statements.

They might have simply gone to one of those secret court hearings and have it bypassed with a gag order in place. Officially its not done, unofficially, its been approved.

The whole "as long as you do not tell me your doing it" approach, and the politicians involve maintain deniability (even if they had the wink).

And you do not need to specific target the head off state. Plenty of side routes to still get information on meetings, that involve those heads of states. Even if your not "directly" spying on them.

So no, its a naïve way of thinking. Maybe in 20 years from now we find out, that they did spy on EU leaders. Maybe directly, maybe indirectly ... even with that directive in place. I will be amazed if they did not. Its the US we are talking about.

> unless there was a compelling national security reason

But there never is a lack of compelling national security reasons.

There is some directive (not law, not constitution - not that those are untouchable now) and we expect current us government to adhere to it, just because it would be nice?

Color me extremely sceptical.

> every country on Earth spies on the rest,

It's entirely possible an EU country did this; they're only vaguely guessing Belarus or whoever. In most countries, it's a big deal if the spies are caught spying on the domestic government.

> quite a few private entities do as well.

It's a risky game, doing that. You don't get any of the professional courtesies, and you're not usually eligible for the prisoner exchanges.

Reply on news.ycombinator.com