Slashdot Mirror
NSO Has Been Selling a Smartphone-Surveilling Malware For Six Years (nytimes.com)
The New York Times continues their coverage of the commercial spytech industry, noting its services "are in higher demand now that companies like Apple, Facebook and Google are using stronger encryption to protect data in their systems, in the process making it harder for government agencies to track suspects... For the last six years, the NSO Group's main product, a tracking system called Pegasus, has been used by a growing number of government agencies to target a range of smartphones -- including iPhones, Androids, and BlackBerry and Symbian systems -- without leaving a trace...to extract text messages, contact lists, calendar records, emails, instant messages and GPS locations." Slashdot reader turkeydance quotes their article:
That will cost you $650,000, plus a $500,000 setup fee with an Israeli outfit called the NSO Group. You can spy on more people if you would like -- just check out the company's price list. The NSO Group is one of a number of companies that sell surveillance tools that can capture all the activity on a smartphone, like a user's location and personal contacts. These tools can even turn the phone into a secret recording device...
The company is one of dozens of digital spying outfits that track everything a target does on a smartphone. They aggressively market their services to governments and law enforcement agencies around the world. The industry argues that this spying is necessary to track terrorists, kidnappers and drug lords. The NSO Group's corporate mission statement is "Make the world a safe place"... An ethics committee made up of employees and external counsel vets potential customers based on human rights rankings set by the World Bank and other global bodies....
One of the services offered by the NSO group is "over the air stealth installation," though they can also install their spying software through Wi-Fi hot spots. One critic argues "They can say they're trying to make the world a safer place, but they are also making the world a more surveilled place."
The company is one of dozens of digital spying outfits that track everything a target does on a smartphone. They aggressively market their services to governments and law enforcement agencies around the world. The industry argues that this spying is necessary to track terrorists, kidnappers and drug lords. The NSO Group's corporate mission statement is "Make the world a safe place"... An ethics committee made up of employees and external counsel vets potential customers based on human rights rankings set by the World Bank and other global bodies....
One of the services offered by the NSO group is "over the air stealth installation," though they can also install their spying software through Wi-Fi hot spots. One critic argues "They can say they're trying to make the world a safer place, but they are also making the world a more surveilled place."
I can sell you a 99 cent app that can do all that. No one checks permissions on apps.
Haha... now those folk who mock me for having a $9 "dumb" phone will realise exactly why I've not moved my life onto an Android or iPhone device!
to cover identity, use the well tested fact that western media/'security researchers' are always willing to 'fall' for any and all obvious cyrillic clues left behind, to blame russians on all occasion.
but don't forget to leave small amount of korean script too. very good for free publicity.
How is using this software not illegal under the CFAA?
The real "Libtards" are the Libertarians!
"The industry argues that this spying is necessary to track terrorists, kidnappers and drug lords"
what about pedophiles? And Jason Bourne?
Pain is merely failure leaving the body
Windows Phone users are protected from vulnerability in the same way Santa Claus is protected from vulnerabilities. Neither exist.
I feel like I exist. Feel me and see if I exist. And so does my WinPhone. Security through obscurity.
Oh man. I haven't laughed that hard in ages. My sides hurt.
"Want to invisibly spy on 10 iPhone owners .. That will cost you $650,000, plus a $500,000 setup fee with an Israeli outfit called the NSO Group .. Since it is privately held, not much is known about the NSO Group’s finances"
In other words a front group for the Israeli Security Service, the same people that have full control of all telephone records in the continental United States.
NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender
This software is $500,000 setup plus $650,000 per target. So $1.15 million dollars.
Bounty hunters track down bail jumpers for $250 (if they're easy and for $5,000 if they're hard. ($50-$100/hour isn't bad for someone without a degree).
If someone is willing to spend over a million dollars tracking you, you'll be tracked. A million dollars will hire ten private investigators for a year.
I suspect that's because of the relative difficulty in breaking iOS. There are a lot of flaws in it, but it's very hard to exploit in a way that's repeatable and without user interaction. Which is why iOS exploits cost a lot of money. If you're using this for Android, you're really wasting a lot of money (Android flaws are practically a dime a dozen).
Apple's $200,000 bug bounty is probably 1/10th of what people are willing to pay for iOS exploits, which they re-sell at high prices for services like this.
And to be honest, you are probably right - it's cheaper to just do gumshoe tracking of an iPhone user than to actually hack into an iPhone to track said user.
I'm not sure if you're a fan saying "best team ever", a troll, or just very misinformed.
If you're a big fan of Apple, that's cool. Your quarterback is the best ever. Steve Jobs was a genius. Beat the hell outta Microsoft! Stop reading here if you're a big Apple fan.
If you're trolling, you're late. Try getting in right when the story is posted for best results.
Lastly, I've been doing network security full time for nearly 20 years. Apple's iOS doesn't -completely- suck for some aspects of security. Convenience is of utmost importance with Apple iOS, though, and there are always compromises between convenience and security. Apple's iOS is not even the most secure iOS. Cisco iOS is safer. Cisco iOS basically runs the entire internet, that's how much it's trusted. (But even it isn't perfect.) If we wanted to expand to operating systems not called iOS, many are more secure.
It's "malware", not "a malware".
Let's see... If I was a terrorist, I'd have a pool of 100 or so smartphones ready to be cloned from a virgin image. When one needs to use a phone for a mission, I'd pull one randomly from the pool, install the image, and a never-used, new SIM card, and give it to the operative. When they are done with a mission, I'd wipe the phone, and return it to the pool.
I'm the guy who keeps saying: "So-called 'smartphones' have more holes in their security than a swisscheese or a colander, why the hell would I ever want one!?" and then I get called a 'Luddite' and any number of other names for not adopting such shitty technology -- regardless of the fact that practically every single day I read about yet another exploit someone discovered that can be used to take total and complete control of any smartphone. Then there's this story, which just confirms everything I've been seeing and saying all this time, and puts the final nail in the 'smartphone' coffin; why the ACTUAL FUCK would I want one of these gods-be-damned things, when it apparently is childs' play for any large corporation or government to slip a total spyware package into the gods-be-damned thing, and not only access everything on the phone, but watch and listen to every damned thing I do and track every single step I take, 24/7/365?
Oh, HELL NO.
I will never, never, EVER own a gods-be-damned 'smartphone', now or ever. I'd rather have NO cellphone and go back to using a landline and an answering machine, before carrying around something that's only one step removed from the monitoring anklet the cops put on people under house arrest.
Seriously, people: WHY DO YOU STILL HAVE ONE? Get rid of it. You don't NEED it. Get the cheapest dumb phone and leave it at that!
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
By me: http://pdfernhout.net/why-encr... ..."
"I believe decentralized knowledge sharing is important, especially for disaster preparedness. I also believe encryption is important in practice, the same way as many people have locks on their doors. Such things do affect a balance between state power and individual power, which is important in a democracy, and they also make it harder for vandals and criminals to operate. So, a project like Briar that supports decentralized communications and encryption is important for those and other reasons. Still, as my father (a machinist among other things) used to say, "Locks only keep honest people honest." Here is a partial list of all the ways a tool like Briar can fail when being used by activists engaged in controversial political actions.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.