The gist is that the NSO group is a company that sells malware which they claim is only ever used to catch bad guys, but the podcast makes a pretty compelling case that they know that repressive governments and even companies use it to target journalists and activists.
No need to make a compelling case at this point, it is widely known. Israel has a large tech sector, much of which is directly or indirectly related to "security" and "defense", aka military and surveillance. Not much unlike the US either, but companies like NSO are at the top of their game and seem to have little restraint about whom their products are sold to.
The US could say “tighten controls on your defense contractors or lose our support” and then do that if they don’t listen. That’ll never happen though. I’m sure plenty of TLAs use NSO software.
In a way it doesn't really matter where this came from.
NSO, NSA, MI5... boys like their toys and can hardly help themselves.
And cyber-weapons - which are persistent, portable, infinitely
reprodicble at zero cost, reusable, indiscriminate and liable to
blowback - will always fall into the hands of assholes, common or
garden thugs and bullies. There is not even the merest possibility of
strategic limitation of such knowledge hazards.
So how about stop blaming the spooks. That's a distraction.
What does matter is that the entire ecosystem of "smartphone"
technology is compromised to the hilt. And it was built that way to
make few extra bucks. Our desperate, suicidal stampede to make
ourselves totally dependent on it is the problem.
Digital self defence starts with not sticking your dick in a
meat-grinder.
The much larger than understood cyber weapon world definitely enjoys how much of a PR loving extrovert Shalev Hulio (NSO founder) was. It takes the spotlight off them
NSO is just a commercial company buying and looking for 0-day exploits, 0-click or 1-click, it doesn't matter. There are probably hundreds of people with knowledge of said 0-days in the company who can turn around and start their own company the next day, or sell the 0-day instructions to 20 other companies
There are definitely many other players in this realm who no one talks about, using the same exact tools and exploits. Just not PR hungry like NSO is
A bit of a tangent but a quick search didn't find any references to this so I may as well post it here:
There's a big wiretapping scandal going on Greece since the beginning of August, accompanied by an equally big attempt to cover it up.
What happened is that a Greek MEP discovered that there was an attempt by someone to infect his phone with Predator. Later it was confirmed that he was also being spied upon by the Greek Intelligence Agency during a period that he was running for leader of the 3rd largest party of the country (which he won).
This came as an addition to reports from a journalist that he being targeted by the intelligence agency when they were investigating the scandalous legislation that gave the country's bankers immunity.
The PM had admitted the spying of the MEP stating that "it was lawful, but wrong" and he fired the director of the intelligence agency as well as his nephew that was the director of the PM's office.
It's worth pointing out that the the first piece of legislation passed by the current government was one that transferred the intelligence agency directly under the PM. They also legislated more laxed criteria for the position of the agency's director to fit the profile of a person the PM had already chosen. It's worth pointing out that the PM claims that he didn't know the reason the MEP was being targeted and that he it would be outrageous if he knew.
I'm not sure how you're coming to the conclusion that wearing an iron ring changes any sense of responsibility. I'm bound as a Canadian engineer to provincial legislation (law) regarding my responsibilities, that and my job contract. The (very optional) iron ring I'm wearing is symbolic and only a part of tradition.
I didn't know safe programming languages protect against logic bugs and side channel attacks. What good is Rust if the processor itself or RAM are leaking encryption keys?
The problem is NSO, not the tech stack, but I guess this is the tech equivalent of looking for lost keys under the street lamp because that's where the light is.
Health professionals swear the Hippocrates oath, and that hasn't stopped unethical practices. The iron ring is only a reminder that not doing your work well can cost lives directly imputable to you.
Pegasus seems deeply intertwined with Unit 8200. If former Unit 8200 members are involved, does it at some point involve the government of Israel directly?
A lot of the most successful tech startups in Israel are formed by ex 8200 members. Very hard to say about government involvement. Might compare it to American defence contractors who used to be in the armed service.
Even that comparison is a bit of a reach because the US does not have conscription, so the professional/education pipelines are just massively different.
I wonder where the non-NSO offensive companies' products end up going. Like, NSO is absolutely not the only player in this game by a long shot (they're hardly the largest even) and yet they have dozens of Citizenlab pieces on them. Was NSO just particularly shit at writing implants or something and thus they are the only ones getting caught? It's truly bizarre that they leave behind that much forensic evidence.
Maybe because the initial reporting got so much traffic, Citizenlab pushed far more resources into investigating NSO products? Maybe its political in nature? I can't imagine the reasoning is technical incompetence by NSO (have you read the FORCEDENTRY writeups? its insane). Maybe NSO's clients more haphazardly pursue targets, so there is a higher probability of recovering some forensic evidence?
Didn't the NSO also attempt a "sting operation" on Citizenlab? They don't particularly come off as sympathetic and/or competent (politically); especially after targeting American diplomats in Uganda.
Citizen Lab specializes in pulling information from databases present in an iPhone backup that they pull from an infected phone. Here's one (of several) blog posts that details a bit of their process in detecting an infection: https://citizenlab.ca/2021/11/palestinian-human-rights-defen...
https://darknetdiaries.com/episode/99/ https://darknetdiaries.com/episode/100/
The gist is that the NSO group is a company that sells malware which they claim is only ever used to catch bad guys, but the podcast makes a pretty compelling case that they know that repressive governments and even companies use it to target journalists and activists.