top | item 21452625

Whatsapp Attributes Hack of 1,400 Users to NSO Group Technology

70 points| vuln | 6 years ago |citizenlab.ca | reply

13 comments

order
[+] ianhawes|6 years ago|reply
It will be interesting to see whether the DOJ indicts NSO Group executives in the same way that they went after the Chinese.

If I were an NSO Group employee, I would think twice before entering the United States, let alone venturing outside of Israel.

[+] stefan_|6 years ago|reply
The principal problem here is if the US government or one of its agencies were to find a code execution bug in WhatsApp, their first reaction would be to turn that into into a weaponized exploit and never tell Facebook.

(And then, from history: the exploit is promptly stolen from them by about 11 different adversaries, but it's only fixed when some government contractors antivirus uploads their zero day because it matched some sort of heuristic. Occasionally, before this last step happens, the exploits are uploaded to GitHub when a ransom demand runs out.)

[+] paganel|6 years ago|reply
> It will be interesting to see whether the DOJ indicts NSO Group executives in the same way that they went after the Chinese.

They most probably won’t.

[+] dogma1138|6 years ago|reply
Israeli Arms Export are aligned to the US ever since the Phalcon deal with China that the US overruled.

The NSO needs to get an export permit for every sale, if you think the US doesn’t have oversight over this you are fooling yourself.

This won’t lead to anything because it would set a horrible precedence which US defense contractors would not ever allow.

[+] _1qd4|6 years ago|reply
Are you serious? Israel has the US Government by the balls. The first thing the Republicans did when Trump got elected was to move the US embassy to Jerusalem. They didn't even skip a beat, it was one of the first things they did (Speaking of that, we just had a federal election in Canada, where one of the primary election promises from our right-wing party was to move the Canadian embassy to Jerusalem... strange... Thankfully they didn't get elected).

I fully expect that NSO will be allowed to act with impunity. If anyone in the US government tries to stop them, AIPAC would pull all their campaign funding from the Repubs or Dems (whichever party's lackey did it) and they'd never get elected again.

[+] doesanyonecare|6 years ago|reply
In the case of India, it is clear that its government used it to spy & also implant false evidence on dalit activists[0] i.e. low caste people who are still made to human waste on their heads in certain parts of the country.

If any NSO/NSA employee is reading, is this the kind of oppression you want your talents to aid? Pimping your mom, sister or wife to your country's leaders could be a better job.

[0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...

[+] Scapeghost|6 years ago|reply
Sometimes I wonder if all these hacks are a scapegoat for companies who were giving away your data anyway.
[+] brenden2|6 years ago|reply
Seems like Facebook's strategy for dealing with their PR problem is to blame someone else for the flaws in their product as a diversion tactic.

It's not a good sign when FB is unwilling to take responsibility for the mess they've made. How can anyone trust this company ever again?

Unfortunately, I think if they can win the PR war then they'll probably be fine. At this point the only thing that matters is public perception, and the one thing FB has going for it is that many people don't even realize that Facebook, WhatsApp, and Instagram are all the same company.

[+] vkou|6 years ago|reply
So, hold on.

Facebook shipped a product with a security bug. There's nothing unusual about this. Every software with non-trivial functionality has, or has had at some point in the past, many security bugs.

What exactly is the scandal, here? Why are you holding Facebook to a standard that no other company, or open source project is able to meet?