Apple alerts users in 92 nations to mercenary spyware attacks

Apple needs to work with authoritarian governments, or nobody is going to build our iPhones.

I would guess it’s obvious for everyone who gets the message that they are political targets. However it is also important to call out abuse of power, like is in the case of India, Spain, Poland, where the governing party is spying the opposition in order to find ways to get rid of them.

Best to refer to them as the “Ministry of Truth”. We’ve always been at war with Eurasia.

I wonder if someone has made a “De-bullshitify English” Chrome add on to replace phrases like “mercenary hacker” and “officer-involved shooting” with more semantically correct phrases.

So you're saying that non authoritarian governments do not sponsor or do themselves the spying / attacks?

The DMCA, in the US. Other statutes in other markets. Hacking computers is pretty prima facie criminal everywhere. It's true that there are inter-jurisdictional edge cases (cracking an iPhone in India via an attack from Israel probably isn't illegal in the USA,etc...) which allows NSO to operate more freely than we'd like. But no one seriously claims this is legal activity anywhere in particular, just that we can't catch them.

Basically the distinction is one of law enforcement authority, not legality.

I would describe this spyware's "illegal" status as colloquially true - despite the lack of a comprehensive, international, enforceable legal framework - at least in the USA [0]:

As part of this effort, the End-User Review Committee of the BIS decided to add four foreign entities, among them two Israeli companies, NSO Group and Candiru, to the Entity List. The U.S. Export Administration Regulations (‘EAR’) impose additional license requirements for exports to listed entities, and limits the exceptions for exports, reexports, and transfers to such entities.

But they continue:

The existing international and national frameworks regulating the export of sensitive spyware technologies lack the teeth necessary to deal with contemporary issues relating to the abuse of these technologies and the growing need for their enhanced supervision.

[0]: https://www.law.georgetown.edu/ctbl/blog/managing-risky-busi...

Aren’t its primary methods of deployment and utilization widely considered to violate domestic and international laws for unauthorized access to targets’ devices and/or data? I might be mistaken, I don’t know for sure how common such statutes are outside of the US, but I’m pretty sure it’s illegal in the United States, even for law enforcement (the likely unconstitutional extrajudicial activities of some unnamed alphabet agencies notwithstanding). If nothing else, there are documented cases where it’s been used to spy on journalists and activists in Saudi Arabia, including the widow of the assassinated American journalist Jamal Khashoggi.

NSO Group is sanctioned, so buying their spyware is probably illegal if you're an American. Furthermore, several tech companies have sued or are in the process of suing NSO Group for their hacking operations. Expect those lawsuits to involve every HN user's two least favorite laws: DMCA 1201 and CFAA.

ironically, DMCA does.

I'm not sure exactly what part of it you're trying to refute since your comment is kind of all over the place, but GP comment is correct.

The reason it's called that is literally because of the Indian government.

Apple's removal of the term "state-sponsored" from its description of threat notifications comes after it repeatedly faced pressure from the Indian government on linking such breaches to state actors, said a source with direct knowledge.

https://www.reuters.com/technology/cybersecurity/apple-warns...

Why? Mercenaries are most often hired by state actors.

The wording is technically correct since these attacks are often facilitated by private for-profit companies. It just glosses over who is paying them (state actors).

That was my first thought as well, though on further consideration I assumed that it was some kind of paid/for-profit criminal organization performing these attacks on behalf of a nation-state.

So apple/companies complying to US/EU laws is state-sponored attacks and not following local law?

Well dang I work in a research lab and I didn’t get an email.

I’m just going to assume my research is so interesting that they sent the real badasses after me, somebody that Apple can’t catch. The truth is too ego-shattering.

NSO was targeting something like 40k people just in mexico. It's entirely possible that this was an accidental targeting because they have a similar name or email to a target.

My next question would be "What do your immediate relatives and friends do, or what are they involved with?"

It could also be an accidental misidentification - maybe OP has the same name as someone they actually wanted to target, or their phone number or email address is very similar to someone they wanted to target.

Or, it could be an intentional misidentification - maybe OP has a friend who was picked up by whatever east european security services, and provided OPs name as some kind of co-conspirator in something OP's friend was into.

You'd be surprised. A college student in an interesting field is an interesting target. Doesn't mean he's done anything nefarious or even shady.

Industrial espionage is a thing.

It doesn't take much to be a target. CIA spy maybe not, but the net is wide when it comes to surveillance. Infrastructure providers, higher education, research labs are all common targets.

Or maybe have a bigger blast radius so that it is difficult to know the exact targets. Drown the detection algos in the noise.

Well the they might be just a college student, but they could have a relationship with the actual target in some way.

People who are "just" college students often are the sons and daughters of people who could be targeted. Not to mention people in their social circles.

If you want to get someone to click a link or open a photo/video having it sent to them by their nanny for example would seem pretty effective.

what activists are running sshd?

College students are a traditional target of oppressive or authoritarian regimes. Teaching young adults to view the world through different lenses and systems is an important part of most college programs, as is a significant amount of self-discovery, and both lend themselves very well to activism, especially since young adults are rarely so jaded as to feel like they "can't do anything about it"

Having wrote an article on XZ, I was half expecting to have this text popup, especially as I'm fairly certain i was targeted by a misinformation campaign already

There's some significant geopolitical intrigue surrounding Cyprus -- probably the most obvious are its partition between between Turkey and Greece and its use as a tax haven by Russian oligarchs.

Uh, no?

I do not believe the android Messages application is open source. I believe AOSP contains something very barebones. It has been a lot of years, am I incorrect?

you changed my mind successfully thank you

but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this

Apple specifically acknowledges this and has Lockdown Mode to address it. If you care about security you should enable it. Of course you’ll not be able to watch YouTube videos, but you’ll be safer.

Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

That variability is a double-edged sword. Manufacturer-added Android bundleware is notorious for being shoddily built and could easily represent added points of ingress.

Which is why I wish it were practical to replace OEM Android versions with GrapheneOS/CalyxOS or similar on the latest devices, similar to how a cutting edge PC can run one’s choice of Linux. As long as more secure or at least more standardized Android distributions can only run on devices with some age on them, their popularity will be limited even among the technically inclined.

Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day.

A random Internet search gives iOS 30% market share to Android's 70% [1], which could also explain the higher price.

[1] https://www.statista.com/statistics/272698/global-market-sha...

I've read (I have no sources) that while the "zerodium still pays more for an android 0-day" thing can be true, the conditions on the "top" payout are pretty strict, due to the same aforementioned variability between vendors. To get that payout you'd have to find something exploitable on nearly all vendors version of android along with working on 2-3 versions. In reality an iMessage exploit is going to pay out a lot more because it would be exploitable on nearly all iPhones running x version of iOS, for example. Finding an exploit in say "Samsung messenger" (I don't know if that even exists) would pay less than an equivalent iMessage one.

Or if you are adjacent to a high profile target, working in the same company as a high profile target, working at a company that is contracted to a high profile target, friend of a friend of a high profile target.... And so on.

Sure, the average person probably doesn't need this (although as another comment pointed out, HN isn't quite representative of the average)... But the net is a hell of a lot wider than just journalists.

Why is it hard to see that while he may not be a target for any sort of state sponsored attack, it’s a bellwether of apples stance on security.

I really, really don’t think he meant he was switching to Apple because he’s a CIA spy stationed in Moscow.

Right it’s unthinkable you’d find high profile targets on hacker news.

All you’ll find here are founders of highly funded startups and software developers at boring companies such as Google, Microsoft and Apple.

No point getting into these people’s phones if you’re a state actor for sure /shrug

You don't need to be a journalist. I think many tech workers are oblivious to how juicy and obvious a target we are. Most of us publish a detailed target on our own back via LinkedIn, or our company's website About Us and Clients pages.

Long ago, I co-founded a tiny startup. We had some high profile clients. I was dumb enough to put those clients on our site. I also used to be dumb enough to have a public social media profile, in my name.

I was already somewhat security aware, but one day I almost fell for a spear phishing email. Someone created a gmail account 1 character different from my gf's gmail. They sent me a well worded, but simple email along the lines of "Hey baby, check this out!" and URL shortened link. She happened to be next to me, and I said to her "Hey, what's this?" "What? I didn't send that!" I then opened it in a VM and saw that it resolved to something.ru.

It was a combo of identifying the juicy client of ours, seeing my name as co-founder, finding me on FB, finding my gf in my profile, getting her email, etc.

I then got to learn fun new terms like threat modeling.

Is it possible that someone might think that you have ssh access to a server on an interesting network? You are a target.

i changed my mind after somebody reminded me Android is more secure and harder to hack due to diversity in hardware

https://dictionary.cambridge.org/dictionary/english/probably

On the Apple Support page here:

https://support.apple.com/en-in/102174

In the screenshot it says the threat notification was sent "via email and iMessage", so it would not be displayed in any different way on your phone, which I also find surprising. I definitely wouldn't expect to receive something like this as an Email, and I have turned off iMessage.

This is, I think, a valuable heuristic. Anything but the most complex and long-term scam always includes some call to action, nearly always URGENT and IMMEDIATE (so as not to give you a chance to think about it or research it).

A notification that is ONLY a notification about something is very unlikely to be malicious (though could certainly be erroneous). My bank will send me a concerning email or SMS about suspicious activity that needs to be reviewed or confirmed, but because they know it's a vector for attack their specifically ask you to call them at their published number listed on your card.

To be fair, somebody will always decide what you wrote was a warning and they should fear it, even if you specifically intended a utopia, just as people insist on rooting for and even imitating the bad guys from stories because they misunderstood "cool" as "good".

Example: Some people think San Junipero, the one positive Black Mirror episode with an actual Happily Ever After romantic ending is a dystopian vision.

Some people think the Primer, the technological device at the heart of Diamond Age, is the problem, not the Neo-Victorian aristocrats like Elizabeth's parents with their pseudo-colonial control over part of China, not the huge corporations whose greed is tearing the world apart and their engineers like Fiona's father, nor the Cyberpunks left over from a previous era like Nell's father - no the problem is the machine.

In the Tweet framing it's easy, it's named a Torment Nexus and the book is literally titled "Don't Create The Torment Nexus" but what about the Horseless Carriage? The Novel? The Television? Are we creating the Urban Sprawl, the Wasted Youth, are we helping to Manufacture Consent ? Or maybe these are Freedom and Art for the Masses ? Framing.

Same goes for certain types of lead characters in things like American Psycho, Fight Club, Mad Men and Wolf of Wall St. These are seen as aspirational instead of cautionary tales.

The tech company is right since this appears to be a reference to the Total Perspective Vortex from Hitchhiker's Guide, which notably didn't do anything bad when it was turned on.

Android is more secure, especially in recent history. You can even see it in 0 day bounties.

Don't pay attention to Samsung though, that company is probably the Apple equivalent of android.

It’s “true” if you, as the GP seems to intend to, define “country” to be “state that is sovereign in the sense of a principal subject of international law”.

This is, to say the least, not the only definition of a “country” (and is also among the definitions of “nation”.)

There are many more nations than there are countries, especially within the US.

I took this to include things like first nations and reservations which are themselves "sovereign".

Pet peeve: Not enough pedantry with language use in publications.

Nation and country are not interchangeable. Words have meaning. Good journalist choose their words deliberately and have a deeper understand of language than the average person.

The comment doesn't really say anything and the commenter is not saying they edited the comment to make it just non-substantive rather than non-substantive and inflammatory.

Is there a modern smartphone or cellphone the fbi, cia, nsa any nation state can not hack ?

I can guarantee you the fbi can also hack a $130 motorolla.

I doubt a 6 year old phone with outdated OS will be more secure than an up to date iPhone

The 2018 crack that one can foil by picking a decent passphrase instead of a 4-digit number?

"In other words" doesn't make sense here.

Right. That's a "turn it off and turn it on again" tech support answer.

why do you think devices out of support date got any message at all?

That's the message they got in summer 2023 when iOS 16.6 was the most recent one.

But that's the thing. This is basically public knowledge at this point. I realize that almost every regional or super power has or tries to have this type of corporation for their own usage, but in this case it's public knowledge and it also openly targets Israel's allies. A good example is how France's president was targeted.

I'm not sure the US wouldn't at least pretend to shut down/restrain a corporation that's helping Israel's ennemies spy on Netanyahu for example.

If you were the hacker operating a remote command and control for such a targeted attack, you would immediately know if Apple or some other mechanism silently blocked your exploit kill chain. This notification to users tells you nothing new. If something doesn't work, you move on to the next exploit available to you. It's not likely that they would shut shop and go away just because apple notified users. Only thing this does is Apple gets more users to turn on their protection mechanisms like lockdown mode which makes it more valuable to find vulnerabilities in that (as that is the new baseline now). And so goes the tale. It's a never ending escalatory game.