Facebook Blocks Seven Malware Purveyors, Deletes Hundreds Of Accounts, Notifies 50,000 Potential Hacking Targets

from the move-fast-and-break-oppressors dept

Thanks to the ongoing onslaught of negative press involving malware merchants like Israel's NSO Group, tech companies whose devices and platforms have been used to deploy exploits targeting journalists, activists, and religious leaders are punching back. You're a human rights abuser with high-dollar spyware at your disposal? Too bad. Ask for a refund, I guess.

Apple sued NSO Group for targeting iPhone users a few weeks ago. It also began notifying users who were targeted by NSO spyware, potentially nullifying further surveillance efforts by unfriendly nation-states.

But before Apple got in on the anti-NSO action, Facebook sued the company for using WhatsApp to deploy malware. Both lawsuits contain some troubling implications for the CFAA -- something that could pose future problems for researchers who scrape data and security researchers who search for security flaws. The unintended consequences of this litigation have yet to be seen, but it's enough to justify holding your applause until the lawsuits have run their course.

Denying state actors the fruits of their purchased spyware labor is now the name of the game, something that benefits everyone. Facebook (now Meta) has just thrown a decently-sized tech wrench into the malware works of an unknown number of entities.

Facebook has disrupted the operations of seven different spyware-making companies, blocking their Internet infrastructure, sending cease and desist letters, and banning them from its platform.

"As a result of our months-long investigation, we took action against seven different surveillance-for-hire entities to disrupt their ability to use their digital infrastructure to abuse social media platforms and enable surveillance of people across the internet," said Director of Threat Disruption David Agranovich and Head of Cyber Espionage Investigations Mike Dvilyanski.

"These surveillance providers are based in China, Israel, India, and North Macedonia. They targeted people in over 100 countries around the world on behalf of their clients."

Seven companies. 100 countries. 1,500 Facebook and Instagram accounts. 50,000 potential targets notified. That's going to hurt paying customers of companies like NSO Group and its competition, most of which have yet to obtain the international infamy NSO has.

The full report [PDF] from Meta lists the companies ejected in this surveillance-for-hire purge. And there's a common strain running through the list, one that's going to cause even more problems for a government already dealing with blowback for running interference for a company selling spy tools to a long list of human rights violators.

We removed about 200 accounts which were operated by Cobwebs [Technologies] and its customers worldwide. This firm was founded in Israel with offices in the United States and sells access to its platform that enables reconnaissance across the internet, including Facebook, Instagram, WhatsApp, Twitter, Flickr, public websites and “dark web” sites.

[...]

We removed about 100 accounts on Facebook and Instagram which were linked to Cognyte (formerly known as WebintPro) and its customers. This firm is based in Israel and sells access to its platform which enables managing fake accounts across social media platforms including Facebook, Instagram, Twitter, YouTube, and VKontakte (VK), and other websites to social-engineer people and collect data.

[...]

We removed about 300 Facebook and Instagram accounts linked to Black Cube, an Israeli-based firm with offices in the UK, Israel and Spain. It provides surveillance services that include social engineering and intelligence gathering.

[...]

We removed about 100 Facebook accounts linked to Bluehawk, a firm based in Israel with offices in the UK and the US. We collaborated on this investigation with The Daily Beast who had identified a subset of this activity leading us to uncover the full cluster and who’s behind it earlier this year.

[...]

We removed about 400 Facebook accounts, the vast majority of which were inactive for years, linked to BellTroX and used for reconnaissance, social engineering and to send malicious links. BellTroX is based in India and sells what’s known as “hacking for hire” services…

[...]

We removed about 300 accounts on Facebook and Instagram linked to Cytrox. This North Macedonian company develops exploits and sells surveillance tools and malware that enable its clients to compromise iOS and Android devices…

[...]

We removed about 100 Facebook and Instagram accounts linked to an unidentified entity in China responsible for developing surveillanceware for Android, iOS, Windows, and also Linux, Mac OS X, and Solaris operating systems. It also engaged in reconnaissance and social engineering activity before delivering malicious payload to its targets.

Four of the seven entities identified and blocked call Israel home. Cytrox also has links to Israel as both Citizen Lab and the Times of Israel have reported. Cytrox is now part of a spyware conglomerate that has been criminally charged for human rights violations.

Israel has a malware problem. And the government can't claim it was unaware of these companies and their selling of tools to authoritarians and human rights violators. The government was actively involved in brokering some of these deals.

The customers for these products, however, are far more varied. Cobwebs products were observed "frequently targeting" activists and opposition parties in Hong Kong and Mexico. But its customer base includes entities in Bangladesh, New Zealand, Poland, Saudi Arabia, and… the United States.

The list compiled by Meta shows malware firms are more than happy to sell to governments that like targeting critics and opponents, rather than criminals and terrorists. Serbia, Morocco, Mexico, China, Qatar, Saudi Arabia, Egypt, Oman, the Philippines, and Myanmar make this list.

But it's not just the blocking. It's the notification. And there's plenty of that.

We also alerted around 50,000 people who we believe were targeted by these malicious activities worldwide, using the alert system we launched in 2015. We recently updated it to provide people with more granular details about the types of targeting and the actor behind it so they can take steps to protect their accounts, depending on the phase of the surveillance attack chain we detect in each case.

That's a lot of disrupted surveillance efforts. State actors are paying good money for these exploits and now they're facing more resistance than ever from the private sector being used to transport malware to targets. That's a lot of money and a lot of surveillance being undone. Governments buying exploits won't be happy but so what. There's no reason to assume that just because it's a government agency doing the targeting there's any legitimacy to the hacking efforts. This is the way it should be -- platforms and device makers protecting customers and users against hacking attempts, no matter the origin of the attacks. The world needs more of this because authoritarians and human rights abusers deserve to have their oppressive efforts thwarted.

Filed Under: hacking, malware, surveillance
Companies: facebook

NSO Group Facing Even More Money Problems As Debt Manager Says Sayonara And State Of Oregon Seeks To Terminate Its Investment

from the [extremely-Seinfeld-gif-voice]-that's-a-shame dept

NSO Group spent years supplying some of the world's most untrustworthy governments with powerful spyware capable of completely compromising targeted devices. It managed to weather a few years of reports tying its malware to surveillance of journalists and activists, but all hell broke loose earlier this year, resulting in a steady stream of reports linking its tools to surveillance of government officials, journalists, dissidents, government critics, religious leaders, and, in one incredible case, the ex-wife of the king of Dubai.

It couldn't have come at a worse time for NSO. It has racked up an impressive amount of debt, something it likely assumed it would be able to manage as it continued to grow its market. That growth has stalled but the payments must still be made. NSO was downgraded by ratings firm Moodys, which warned that NSO was in danger of defaulting on its debts.

That, combined with Israel drastically reducing NSO's customer base and the blacklisting by the US Commerce Department, has resulted in the company considering shutting down its offensive spyware division (the one responsible for developing Pegasus) and putting its remaining assets up for sale.

It might not be that easy to divest, nor find a way back to solvency. Bloomberg reports that one of NSO's debt managers has decided it's no longer interested in providing these services to this particularly toxic asset.

Jefferies Financial Group Inc., one of Wall Street’s closest allies of spyware firm NSO Group, is resigning from a key administrative role for the Israeli company’s debt, according to a person with knowledge of the matter.

The investment bank privately notified the company’s lenders on Friday of its intention to step down as administrative agent, a role in which Jefferies handles debt payments for the company and other clerical tasks, said the person, who asked not to be identified because the information is private.

That seems like a pretty strong "no confidence" vote on NSO Group. Whether it's because Jefferies thinks NSO can't repay its debt or because of its reputation as the enabler of oppression all over the world was left unsaid.

But that's not the only demonstration of a lack of confidence. Keeping the malware purveyor at a minimum of arms length appears to be a popular move. A state government a couple of steps removed from NSO is looking to divest itself of its holdings.

Oregon's treasurer is exploring legal options with the state attorney general in the state's large investment in a smartphone spyware company — a firm that has been denounced by human rights groups, the U.S. government and tech giants.

In 2017, the Oregon Investment Council unanimously committed $233 million in the state employee retirement fund to a new private equity fund called Novalpina Capital, which later acquired a majority share of NSO Group, an Israeli company that produces smartphone spyware.

This move might be due to NSO's public image, which currently requires the use of a periscope to peer out of the gutter. But it also might be due to the equity fund's internal problems, which has led investors -- including the state of Oregon -- to strip the company of its control of the fund and hand it over to another company entirely.

But this statement from a state official indicates it has more to do with NSO's current PR problems than Novalpina's apparent inability to properly manage an equity fund.

Oregon State Treasurer Tobias Read “supports sanctioning global technology companies that facilitate human rights violations and the oppression of journalists by selling technology to authoritarian regimes," Read's spokeswoman, Amy Bates, said in a statement Thursday to The Associated Press.

It's currently unclear whether the state can get out of this without getting sued for breach of contract. But that's the direction the state would like to go. As for NSO, it continues to claim it's being unfairly punished for the actions of its customers, stating that it values "ethics over revenues" and only sells malware for the purpose of preventing terrorism and serious crime. But the facts say otherwise. And NSO has long since run out of excuses for its willingness to sell powerful spyware to countries with long histories of human rights violations and abuses of surveillance powers.

Filed Under: debt, malware, oregon, spyware
Companies: jefferies financial group, nso group

After Weeks Of Reports Of Misuse Of Its Exploits, NSO Group Considering Shutting Down Its Malware Service

from the if-you-can't-beat-'em,-quit dept

RIP NSO Group. Cause of death: investigative reporting.

It's probably too early to celebrate the demise of Israel's most infamous export, but it's looking like NSO is running out of options. The Israeli government recently (and drastically) reduced the number of approved governments NSO could sell its powerful Pegasus malware to, trimming down the permitted list from 102 countries to 37. That followed blacklisting by the US Commerce Department, which means American tech companies aren't permitted to sell exploits, hardware, or devices to NSO without securing a waiver they're unlikely to receive.

That followed weeks of revelations about how NSO customers were using its Pegasus spyware. According to multiple reports, governments and the occasional king were using NSO tools to target journalists, dissidents, government critics, religious leaders, US State Department employees, an ex-wife, an ex-wife's lawyer, and government officials.

I guess when it's no longer feasible to sell spyware to authoritarians and human rights violators, the only option is to default on your debts and shut down your most toxic product.

The NSO Group, the controversial technology company recently blacklisted by the United States over the illegal use of its spyware, is reportedly considering shutting down its Pegasus operation and selling the entire company to an American investment fund, Bloomberg reported on Monday.

The report, citing officials involved in the talks, said that there are two potential suitors for the embattled company, who have discussed a potential takeover and the shuttering of Pegasus unit, in exchange for a $200 million injection of capital and a pivot into strictly defensive cybersecurity services.

NSO needs the cash. It has millions in debt and whatever plans it had for paying it back have been severely curtailed with its blacklisting by the US government and its reduced customer base.

The U.S. restrictions put added pressure on NSO, which needs to pay back about $450 million in debt, just two years after a management buyout that valued the company at about $1 billion. Moody’s Investors Service said last month there’s an increasing risk the company will violate the terms of its loans.

The problem with ditching Pegasus is that it's NSO's most valuable product. This premium phone exploit accounts for half of NSO's business. Fifty percent of NSO is worth far less than the $200 million the company is hoping to obtain. Now that it's blacklisted, it can't purchase exploits or devices from the US, which means it will be extremely difficult to develop new hacking tools worth selling. There may be a market for defensive tech, but that's likely to be far less popular with foreign governments than zero-click exploits that can be deployed remotely.

Here's how it looks for NSO on the home front, as reported by Israeli newspaper Haaretz:

Defense officials think the sanctions could soon bring about the company’s collapse and a shutdown of its operations. The company depends upon constant innovation: It’s one Apple or Android cellphone update away from the failure of its products. If it doesn’t manage to hold onto the best personnel in the world, the kind who would continue to find vulnerabilities in the operating systems, they won’t have a product.

Senior officials have told Haaretz that the move by the United States has totally paralyzed the company’s future operations. “They’re not able to buy a pen at a Walmart store,” the officials quipped. If an American company wants to sell them products, it needs a special permit.

According to this report, the Israeli government believes its local tech companies are being unfairly targeted by US sanctions. The country is home to 19 companies developing offensive exploits, but so far the US has only blacklisted NSO Group and Candiru. The government appears to have been caught off guard by the sanctions handed down by the Biden Administration after having received much more support and cooperation from the previous president, Donald Trump.

The Israeli government may be reeling a bit from the last few months of negative press targeting NSO, but it really can't blame anyone else for the mess the company is in or the sanctions that have greeted the steady stream of reporting about misuse of its Pegasus spyware. It was directly involved with the sale of the malware to a number of known human rights abusers.

[I]n Israel it is acknowledged that oversight of contracts NSO entered into was too lax. The Netanyahu government gladly traded in spyware, with the Mossad reportedly assisting in the initial mediation of the transactions.

[...]

The company’s sales momentum over the past decade is closely linked to the diplomatic and intelligence-related steps that Netanyahu took, which improved relations with countries in various parts of the world, and where NSO’s technology often served as an asset that brought Israel to the table for the improvement of ties. In the past, Netanyahu ordered the defense establishment to advance offensive cybertechnology deals, and it appears he preferred that overly energetic oversight not be imposed on the deals or the parties to them.

Welp. The shitbirds have come home to roost, as the saying goes.

And if the Israeli government thinks the US Commerce Department overreacted, it won't be pleased with the latest demands from members of the federal government.

More than a dozen Democratic lawmakers have called on the Biden administration to sanction four cyber surveillance firms for "enabling human rights abuses" by "selling powerful surveillance technology to authoritarian governments."

The letter, led by Sen. Ron Wyden of Oregon and House Intelligence Chairman Adam Schiff of California, asks the Treasury Department to sanction Israeli spyware vendor NSO Group, Emirati cybersecurity firm DarkMatter and European surveillance firms Nexa Technologies and Trovicor -- as well as the firms' top executives.

This would go beyond the blacklisting already in place. The Global Magnitsky Human Rights Accountability Act allows the US president to sanction people and companies for human rights abuses. In this case, the abuses would have been aided and abetted by NSO, rather than participated in directly by NSO execs or employees. While it normally is used to sanction government officials, it has been used in the past to sanction private parties with ties to human rights abusers.

Whether or not sanctions ever arrive, it appears NSO's days are numbered. But there are still plenty of malware purveyors out there. And there are plenty of authoritarians willing to pay top dollar for spy tech that enables them to more efficiently oppress their countries' populations. The exploit market will remain lively. It just may be that one of the most recognizable names in the business will no longer be in business.

Filed Under: exploits, malware, pegasus, spyware, surveillance
Companies: nso group

Polish Prosecutor First Beneficiary Of Apple's 'You've Been Hacked By NSO Spyware' Notification Program

from the anything-that-screws-with-NSO-and-its-customers-is-fine-with-me dept

Concurrent with Apple's announcement that it was suing Israeli tech company NSO Group over its iPhone exploits was its announcement that it would be notifying customers of suspected hacking attempts utilizing NSO's extremely powerful Pegasus malware.

Apple is notifying the small number of users that it discovered may have been targeted by FORCEDENTRY. Any time Apple discovers activity consistent with a state-sponsored spyware attack, Apple will notify the affected users in accordance with industry best practices.

Unlike Apple's lawsuit -- which might nudge the CFAA towards a more expansive interpretation of "unauthorized access" that could adversely affect security research -- this notification practice is undeniably good. It undercuts the abusive acts of state actors by giving their targets a heads up about phone hacking attempts.

This won't pose much of a problem for Apple, as it's out of the legal reach of most of NSO's customers. Even if foreign surveillance agencies did obtain the equivalent of a warrant to hack phones and intercept communications, any accompanying gag orders would be useless. We'll see how this disclosure process works out if a US-based government agency utilizes NSO malware -- something that seems even less likely now that the Commerce Department has blacklisted NSO.

The notification program has already paid off for one Polish government employee, who was recently informed by Apple she was targeted by NSO spyware. (h/t 9to5Mac)

Ewa Wrzosek is a prosecutor, a member of the Association of Prosecutors "Lex Super Omnia". She exposed herself to the authorities on April 23, 2020, when she initiated an investigation into the so-called "Envelope elections". On the same day, however, the investigation was taken from her and discontinued, and disciplinary proceedings were initiated against Wrzoski. Since then, the prosecutor has repeatedly criticized the changes in the Polish judiciary after 2015.

Yesterday evening, Ewa Wrzosek announced on Twitter that she had received a notification from Apple about a possible attack by state services on her iPhone using Pegasus.

The "Envelope Elections" were a hasty and apparently unlawful attempt to hold an election during the first few months of the COVID pandemic. Last May, the failed presidential election managed to rack up a hefty tab to be settled by Poland residents, but didn't actually result in the election of anyone.

Poland’s abandoned presidential election, which was scheduled for 10 May but took place without any voting, still generated high costs. Private broadcaster TVN has revealed that invoices issued in connection with the preparations amounted to almost 70 million zloty of costs for the state postal service, Poczta Polska.

The run-up to the planned election was fraught with chaos and controversy, as the Polish government pushed ahead with preparations for a fully postal vote before relevant legislation had been passed. Many local authorities refused to cooperate, on the basis that doing so without the law in place would be illegal.

Following this logistic and political failure (there was some speculation this process was fast tracked to give the incumbent president the best chance to win), Wrzosek began an investigation. That appears to have proven unpopular with the party controlling the Polish government. Given this history, it's not much of a leap to presume she's being targeted by her own government.

The twist is that the Polish government has never officially confirmed it has ever acquired NSO malware. But governments rarely discuss surveillance programs, especially their most controversial ones. However, there is a paper trail that suggests at least one government agency is in possession of NSO's most powerful surveillance tool.

For nine months, the Ministry of Finance has not been able to decide whether the Justice Fund, which is in the hands of the Minister of Justice Zbigniew Ziobro, had the right to transfer PLN 25 million to the CBA for the purchase of a modern surveillance system, tvn24.pl learned.

The fact that the Central Anticorruption Bureau received money from this fund and allocated it to the purchase of the most modern surveillance system for telephones and computers was revealed on tvn24.pl almost exactly a year ago.

Now, reporters of the "Black on White" program suspect that the system bought by the anti-corruption service is probably the Israeli Pegasus. - This system was created to prevent terrorist attacks, kidnappings, human trafficking and drug smuggling - journalists from "Black and White" explained.

If so, there's a good chance the targeted phone is compromised. Wrzosek has asked for answers from the Minister of Justice, but she's unlikely to receive any acknowledgements or apologies. If it is what it looks like, the prosecutor is being targeted in retaliation for her attempted investigation by the same government she works for.

As Apple continues to notify users targeted by NSO malware, hopefully those targeted will continue to inform the rest of the world how the company's "for bad guys and terrorists ONLY" exploits are actually being used.

Filed Under: ewa wrzosek, malware, pegasus, poland, spyware
Companies: apple, nso group

Apple Notifies More Victims Of NSO Malware Hacking Attempts

from the [extremely-1960s-Batman-splash]-THWART!!! dept

Apple's announcement that it was suing Israeli malware purveyor NSO Group for targeting iPhone users was coupled with another, equally dismaying (I mean, for NSO…) announcement: it would be informing targets of malware anytime it detected a suspected intrusion.

Actually, this may be more of a concern for NSO's customers. After all, they're still paying the same licensing fees even if their targets are being warned of hacking attempts. It can't make them happy and -- since it appears many of NSO's customers like to target non-terrorists and non-criminals -- there's really nothing they can do about it. Local entities may be sworn to secrecy with court orders (if those are even obtained) but there's nothing preventing Apple from alerting users that malware might be present on their phones.

Given the long list of seemingly inappropriate targets for NSO's Pegasus spyware -- which includes journalists, activists, dissidents, government critics, political figures, religious leaders, lawyers, ex-wives, etc. -- Apple's policy is the Right Thing To Do. NSO's customers agree to use the spyware to target terrorists and dangerous criminals. They clearly don't do that. If NSO won't stop them (and it won't [until very recently]), this is one way to mitigate the damage.

And so the disclosures have flowed. A Polish prosecutor who dared to offend the ruling party in that country was one of the first notified by Apple's new program. Since then, the floodgates have opened, potentially ruining the surveillance plans of several governments. Here's Carly Page for TechCrunch, rolling out the details on Apple's unwelcome mat.

Apple has sent threat notification alerts to victims of state-sponsored hackers in Thailand, El Salvador and Uganda, just hours after filing a lawsuit against Israeli spyware maker NSO Group.

At least six Thai activists and researchers who have been critical of the government have received the notification, according to Reuters, including Prajak Kongkirati, a political scientist at Bangkok’s Thammasat University, researcher Sarinee Achananuntakul and Thai activist Yingcheep Atchanont of the legal monitoring group iLaw. Citizen Lab, which tracks illegal hacking and surveillance, identified in 2018 a Pegasus spyware operator active within Thailand.

Also on the list: the president of the Democratic party in Uganda (the same nation where US State Dept. employees were targeted) and a dozen employees of El Salvador newspaper, El Faro, which has long been a critic of that country's government.

None of the people listed are legitimate targets for this powerful spyware. NSO has claimed for years its exploits only target the worst of the worst. And for roughly the same number of years, investigations and leaks have shown governments are using the spyware to target critics and political opponents who only pose a threat to their power, rather than public safety or national security.

Fortunately, there's another entity watching these people's backs. Prior to Apple's notification program, it took in-depth research by entities like Canada's Citizen Lab to discover the source of hacking and properly attribute it to NSO malware. Apple presumably can make these determinations much faster, heading off future interception and eavesdropping.

If NSO doesn't like it, it can suck it. It chose to sell to governments with long histories of targeting critics and violating human rights. Its customers can likewise suck it. They've given themselves an infinite amount of leash and NSO's exploits have let them take full advantage of this. Even a minimal amount of thwarting of nefarious doings is welcome in a world where the powerful go unpunished and unchecked far too often.

Filed Under: hacking, malware, pegasus, surveillance
Companies: apple, nso group

NSO Spyware Used To Snoop On US State Department Employees Stationed In Uganda

from the just-another-day-at-work-for-NSO-Group dept

Israeli exploit seller NSO Group has long past reached the limits of its non-denials and deflection attempts. There's only bad news on the horizon for the tech company, which would be a lot less disheartening for the company if it hadn't been preceded by months of bad news.

Already considered morally suspect due to its decision to sell powerful phone hacking tools to human rights violators, NSO has since proven to be pretty much amoral. Investigations uncovering abuse of its spyware to hack phones of journalists and activists began to surface three years ago before a leaked database of alleged spyware targets was given to investigators and journalists. Since then, NSO has waged a losing battle with a seemingly endless onslaught of revelations that put its hacking tools in the hands of bad actors and its powerful spyware (Pegasus) in the phones of journalists, activists, lawyers, diplomats, politicians, and religious leaders.

NSO was sued by WhatsApp and Facebook in 2019 for using the messaging app to send malware to targets. It was sued by Apple just a couple of weeks ago for targeting iPhone users. It is facing investigations in a handful of countries, including its home base. It has been blacklisted by the US Commerce Department and its list of governments it can sell to has been drastically trimmed by the Israeli government, from 102 to 37.

The question now is: does NSO Group even feel it when news breaks about additional misuse of its spyware? Or does it just prompt an exasperated "what now?!" from its execs as it tries to figure out how to remain viable in the future? Whatever the case is, this latest revelation isn't going to get its Commerce Department blacklisting lifted any time soon.

iPhones of at least nine U.S. State Department employees were hacked by an unknown assailant using sophisticated spyware developed by the Israel-based NSO Group, according to four people familiar with the matter.

The hacks, which took place in the last several months, hit U.S. officials either based in Uganda or focused on matters concerning the East African country, two of the sources said.

The intrusions, first reported here, represent the widest known hacks of U.S. officials through NSO technology.

The Reuters report says the source of the hacking hasn't been identified. But one can assume it was entities opposed to whatever aims the US State Department hopes to achieve in Uganda, which apparently includes simply trying to meet with opposition leaders. People don't spy on people whose aims are allied with theirs. And attribution has limited worth. Entities willing to abuse spyware to hack the phones of political opponents -- especially those operating under diplomatic immunity -- aren't really going to care if their wrongdoing is exposed.

And NSO only has to care now because it has spent years claiming it does everything it can to prevent misuse of its powerful malware -- only to have that assertion exposed as a lie with six months of uninterrupted news releases showing its hacking tools have been misused multiple times by multiple entities. Accompanying this steady drip of news reports has been zero evidence of NSO's asserted oversight or willingness to terminate contracts with entities who've abused its malware.

NSO's response to this report is no different than its response to several others: it will do something about this now that it has made international headlines.

"If our investigation shall show these actions indeed happened with NSO's tools, such customer will be terminated permanently and legal actions will take place..."

That's meaningless. NSO claims it has no visibility into its customers' actions and, if this is true, it has no way of investigating these claims. It's all just noise, something almost less substantial than a "no comment." The State Department's response means more: it simply pointed to NSO's blacklisting by the federal government. And that's pretty much all that needs to be said by witnesses and victims of these hacking attempts. NSO is running out of bridges to burn. There will always be a market for easily abused malware. But it's becoming much more difficult to keep these abuses secret and that's what has harmed NSO the most.

Filed Under: malware, pegasus, spyware, state department, surveillance
Companies: nso group

After Months Of Troubling News, Israel's Government Finally Limits Who NSO Group Can Sell To

from the tough-to-stay-solvent-using-a-'scorch-your-own-earth'-policy dept

Well, it's been yet another hilarious couple of days for Israel's NSO Group. I mean, not so much for NSO, which is currently sitting at the center of a raging dumpster fire of its own creation. But just because NSO isn't laughing doesn't mean it's not funny.

For years, it sold spyware to whoever wanted it. Those customers used the powerful phone exploits to target journalists, activists, dissidents, and high-ranking government officials.

Some of this had already been exposed by security researchers like Canada's Citizen Lab before the bombshell dropped: a list of 50,000 alleged NSO malware targets. NSO denied having anything to do with the list, but report after report tied its spyware to abuse by government agencies and quasi-political leaders like kings and princes in the United Arab Emirates, one who used the malware to hack the phone of his ex-wife and her lawyer.

France's President, Emmanuel Macron, was one of those on the target list obtained by journalists. This prompted the President (and other French government officials) to acquire new phones. Because of this, the French government has decided it won't be requiring the services of NSO in the future.

At the exact same time, MIT Technology Review has learned, French government officials were in the final stages of contract negotiations to purchase Pegasus hacking tools from NSO. The French were on the verge of buying the tool—in the type of deal that is typically worth millions of dollars—despite years of allegations that it was regularly being used to surveil and harass dissidents, journalists, and human rights activists worldwide.

But sources familiar with the deal say that the process fell apart after the accusations that French politicians potentially were among those targeted, and negotiations were broken off just a few days before the sale was set to take place. After publication, France’s Ministry of Foreign Affairs denied it was in the process of purchasing NSO Group tools.

That takes one customer off the list for NSO. The Israeli government -- after years of ignoring NSO's sales to human rights violators -- has further limited the company's market base, removing nearly two-thirds of the countries on its approved purchasers list.

The Defense Ministry has dramatically scaled back the number of countries to which Israeli companies can sell cyber technologies amid global fallout over Israeli spyware firm NSO Group, according to a report Thursday.

The updated November list consists of 37 countries, down from 102, according to the Calcalist business news daily.

Countries with questionable human rights records, including Israel’s new allies Morocco and the UAE, have been removed, the report said.

Much like everything related to the fallout from the NSO target list obtained in July, this could have been prevented if NSO had decided not to sell to governments known to routinely violate human rights or -- if it just couldn't help itself -- its government had forbidden sales of powerful malware to these countries.

Having fewer customers isn't going to help NSO climb back out of the hole it dug for itself. This trimming of its potential user base follows blacklisting by the US Commerce Department -- something that had an almost-immediate effect on the company's credit rating.

According to Bloomberg, Moody’s dropped NSO’s credit rating by two levels, asserting that the company’s risk of defaulting on its debts had increased and noting that the company has been losing money since 2020.

Not that NSO was in great financial shape to begin with. This was the second downgrade by Moody's, the first of which came a month before the July release of the alleged NSO spyware target list.

Moody’s said in June that it downgraded the company’s rating from B2 to B3, adding that its outlook remains negative. The report said most of the debt is supposed to be repaid in March 2025.

NSO has been offering up nonsensical and contradictory defenses of its actions for several months. Now, it's just flailing. It now wants people to believe its current woes are the end result of an anti-Israel conspiracy.

In a letter, [NSO] argued that the U.S. blacklisting arose from "an orchestrated campaign by anti-Israel organizations" that would result in hundreds of employees losing their job, according to Israeli news site Walla.

That's a ridiculous assertion. NSO would be toxic no matter where it was located. And it has had years to head off this sort of worldwide reckoning but chose to reap the profits, rather than control use of its powerful phone hacking tools. Investigations attributing phone hacks of journalists and human rights activists to NSO malware have been public knowledge for a few years now, and the company's response (until now) has been to do nothing.

By waiting this long to finally start addressing these allegations, NSO has limited its options to making nonsensical defensive statements and, presumably, starting to figure out how much its office furniture might go for at auction.

The same can be said for the Israeli government, which has been aware of these troubling allegations about NSO for just as long, but instead chose to urge on sales to human rights abusers, rather than discourage NSO from pursuing business relationships with governments that were always going to end up abusing the powerful malware. Due to this close relationship, NSO's problems are also Israel's problems, which is likely why even the Israeli government is trying to distance itself from the country's most toxic asset.

Filed Under: israel, malware, pegasus, spyware, surveillance
Companies: nso group

Apple Sues NSO Group For Targeting IPhone Users With Powerful Exploits

from the [applauds-super-cautiously] dept

NSO Group's year from hell continues. Apple is now suing the Israeli exploit hawker for hacking its customers' iPhones -- customers who include not only the supposed terrorists and dangerous criminals NSO claims its customers target with malware, but also journalists, activists, lawyers, ex-wives, religious leaders, US citizens, and government officials NSO claims its customers don't target.

Apple isn't the first major tech company to sue NSO over its malware. Facebook and WhatsApp sued NSO in 2019, alleging that the use of WhatsApp to deploy powerful exploits violated WhatsApp's terms of use. While this is almost certainly true (deploying malware via WhatsApp is definitely not allowed), WhatsApp appears to want a ruling that would expand the definition of "unauthorized access" under the CFAA (Computer Fraud and Abuse Act) that's already been stretched several times by DOJ prosecutors.

On one hand, it would be undeniably enjoyable see NSO get slapped with an order denying it access to WhatsApp and its users, on the other, it wouldn't be helpful at all to turn research (security and otherwise) that violates sites' terms of use into a federal crime.

Unfortunately, Apple's lawsuit [PDF] appears to be asking for something along the same lines. It also stretches the definition of legal standing, alleging it has the right to sue on the behalf of its users because reacting to the deployment of NSO malware has caused it to spend a bit of its billions closing security holes.

That being said, Apple's legal reps sure know how to open a lawsuit. Here's the first paragraph of the suit's introduction:

Defendants are notorious hackers—amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse. They design, develop, sell, deliver, deploy, operate, and maintain offensive and destructive malware and spyware products and services that have been used to target, attack, and harm Apple users, Apple products, and Apple. For their own commercial gain, they enable their customers to abuse those products and services to target individuals including government officials, journalists, businesspeople, activists, academics, and even U.S. citizens.

Welp. That's not going to help NSO's presumably permanently damaged SEO. The next paragraph builds on NSO's "amoral mercenary" reputation by pointing to the US Commerce Department's recent blacklisting of the company -- an act that almost never targets companies operating in countries the US considers to be close allies.

It follows these accusations with NSO's own admissions of malfeasance.

NSO admits that its destructive products have led to violations of “fundamental human rights,” which have been widely recognized and condemned by human rights groups and governments, including the U.S. Government. To ensure that their products can be used by others to maximum effect, NSO reportedly provides ongoing technical support and other services to their clients as they deploy NSO’s spyware against Apple’s products and users, including journalists, human rights activists, dissidents, public officials, and others. Most recently, the Guardian reported that six Palestinian human rights defenders—one of whom is also a U.S. citizen—were attacked and surveilled using NSO’s spyware. Although NSO claims that its spyware “cannot be used to conduct cybersurveillance within the United States,” U.S. citizens have been surveilled by NSO’s spyware on mobile devices that can and do cross international borders.

Then it starts talking about the damage Apple itself has suffered as a result of NSO customers targeting iPhone users.

Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades.

These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial.

That's the amount of damages needed to keep a lawsuit in federal court. But further into the lawsuit, Apple specifically cites the law amended by the CFAA and quotes a much lower price for actual monetary damages.

Defendants’ actions caused Apple to incur a loss as defined by 18 U.S.C. § 1030(e)(11), in an amount in excess of $5,000 during a one-year period, including the expenditure of resources to investigate and remediate Defendants’ conduct.

That puts the CFAA in play as Apple advocates on behalf of its users and its own defensive efforts. But standing is a tricky thing, as is attempting to hold NSO directly responsible for the activities of its customers.

Apple attempts to show standing by claiming end users are only borrowing the software it creates, so iPhone users targeted by NSO malware are, in effect, having their rented homes damaged by home invaders. Apple is the landlord, so to speak, so it believes it is due direct compensation for something that happened to its tenants. This is a dangerous argument to make, considering its the same one the DOJ deployed when it was trying to force Apple to break encryption on the San Bernardino shooter's iPhone.

Defendants violated and attempted to violate 18 U.S.C. § 1030(a)(2) because they intentionally accessed and attempted to access the iOS operating system on Apple’s users’ devices without authorization and, on information and belief, obtained information from Apple’s users’ devices.

Defendants violated 18 U.S.C. § 1030(a)(4) because they knowingly and with the intent to defraud accessed the operating system on Apple’s users’ devices without authorization using information from Apple’s servers and then installed highly invasive spyware on those Apple users’ devices, and by means of such conduct furthered the intended fraud and obtained something of value.

[...]

Apple retains ownership of its operating-system software pursuant to its Software License Agreements.

We'll see whose stretching works better. Apple wants to be able to represent users who've been targeted, citing its licensing and its own (apparently minimal) expenses related to patching security holes. NSO, on the other hand, will want out of this suit and has deployed some creative arguments of its own defending itself against WhatsApp's litigation.

It remains to be seen whether its argument that it can't be sued directly for the actions of its customers will convince the court WhatsApp's lawsuit should be dismissed. But it has already seen another of its defenses shot down at the appellate level, which refused to extend sovereign immunity to the private company that sold exploits to government agencies. The Ninth Circuit refused to buy the argument that selling stuff to government agencies makes one an extension of that government agency for immunity purposes.

We'll see what the court makes of this one. We already know at least one of NSO's defenses is foreclosed by precedent. But we shouldn't necessarily cheer Apple on just because the target of its suit is reprehensible. A ruling in favor of Apple's CFAA allegations could prove disastrous for researchers and others who bypass terms of service restrictions for far less malignant reasons.

On the bright side, Apple is handing out a lot of money to researchers who've exposed plenty of malfeasance by NSO Group's customers.

Apple commends groups like the Citizen Lab and Amnesty Tech for their groundbreaking work to identify cybersurveillance abuses and help protect victims. To further strengthen efforts like these, Apple will be contributing $10 million, as well as any damages from the lawsuit, to organizations pursuing cybersurveillance research and advocacy.

Apple will also support the accomplished researchers at the Citizen Lab with pro-bono technical, threat intelligence, and engineering assistance to aid their independent research mission, and where appropriate, will offer the same assistance to other organizations doing critical work in this space.

On top of this, Apple will continue notifying users it believes have been targeted by NSO malware, which is only going to result in more negative press for the malware purveyor. If NSO wanted to be perceived as a skilled warrior in the fight against international crime and terrorism, it blew that chance when it decided to sell to notorious human rights abusers and engage in zero oversight of the use of its products. It earned the reputation it now has and will carry with it forever, no matter how this lawsuit plays out.

Filed Under: cfaa, exploits, iphones, license, malware, ownership, research, spyware
Companies: apple, nso group

NSO Made Millions Selling Phone Hacking Tools To The Princes And Kings Of The United Arab Emirates

from the handing-more-power-to-the-unassailably-powerful dept

NSO Group can't get a break. Too bad. It really doesn't deserve one. The inability of the Israeli exploit purveyor to escape this endlessly negative news cycle is entirely its own fault. And each passing day seems to uncover something new and nasty about the tech company, which has built its business by seemingly selling to whoever wants to buy, no matter how morally repugnant.

The company's malware has been deployed by a variety of repeat human rights offenders to target journalists, critics, dissidents, religious leaders, opposition parties, and the occasional heads of state of their allies. To its own critics, NSO has issued contradictions: it is not responsible for how its customers use its products and that it does everything it can to prevent misuse of its products. The contradiction is baked in: NSO says it pulls access for misuse while claiming it has no "visibility" into its customers' activities.

It also says it does not sell its powerful malware to private entities. But the fine line between public and private entities is never finer than in the United Arab Emirates, where the allied rulers of the area are also private citizens -- kings and princes with access to a whole lot of wealth and a whole lot of power.

A prince can claim to be a government official and still behave like a private citizen. Take Sheikh Mohammed bin Rashid al-Maktoum of Dubai. He's the king of Dubai. He's also in the middle of an extremely messy, somewhat public divorce from Princess Haya bint al-Hussein. His access to NSO's most popular phone exploit (Pegasus) allowed him to hack phones belonging to his ex, along with phones belonging to her legal reps.

But he's not the only UAE figurehead with NSO contracts. Israeli news agency Haaretz reports NSO has sold to other kings and princes who control parts of UAE: men who have plenty of private business that could benefit from a bit of phone hackery using tools obtained under the auspices of Official Government Business.

The Israeli cyber firm NSO sold its Pegasus mobile-phone hacking software to two different leaders of the United Arab Emirates – Abu Dhabi ruler Mohammed Bin Zayed and Dubai ruler Sheikh Mohammed Bin Rashid al-Makhtoum.

TheMarker has learned that the price each of these clients paid in dollars is a seven- to eight-figure number.

It's not that UAE doesn't have national security and law enforcement agencies that would make better homes for phone hacking tools. (I mean comparatively…) The UAE has a federal police force and a joint national security agency that's supposed to handle the sorts of things (serious crime, terrorist activity) NSO swears up and down its customers are using its exploits to combat.

So, why sell the princes and kings, who have few obligations to the people they rule over… you know, since they're rulers rather than elected officials? Apparently, the answer is because they have millions to spend on phone hacking tools and a company willing to exchange goods and services for money while pretending to hold its nose, cover its eyes and ears, and act all defensive when people ask the why in the almighty fuck are they selling exploits to the United Arab Emirates, much less its literal ruling class?

NSO says publicly (and a lot more frequently in recent months) that it takes a hard line on the abuse of its products to violate human rights. But it says that after years of selling to rulers with long histories of extremely severe human rights violations. Both things can't be true. And a cursory Google search would give NSO all the due diligence it needs to refuse to sell to rulers (and government agencies) located in places like Dubai and Abu Dhabi. (Not to mention others with the same cavalier attitude towards life and liberty.)

Recent revelations are forcing NSO to put its money where its mouth is. With every new report of violations and use by human rights violators, the company is now obligated to yank access and cancel contracts. I cannot imagine how uncomfortable it will be for the company to approach rulers who preside over areas where executions and disappearances of critics are commonplace. But suck it up, NSO. The best way to avoid having to tell brutal rulers their business is no longer welcome is to never welcome it in the first place.

Worse, the country NSO calls home may be partly to blame.

In some cases, including the sale of two systems to two separate rulers in the UAE, the Pegasus system was only sold following heavy pressure from the Israeli government, as part of the diplomatic warming between Israel and the UAE. Yet the system’s irregular use embarrassed NSO and caused the third bout of bad publicity the company has sustained since being blacklisted by the U.S. last week.

So, if the Israeli government feels any complicity in the current state of NSO affairs, it probably should send a couple of diplomats along to ensure the revocation of hacking power by NSO not only actually happens, but happens without part of the NSO sales force being disappeared for having the audacity to tell these half-patriarchy/half-oligarchy rulers to take their business elsewhere.

Filed Under: dubai, israel, malware, pegasus, spyware, surveillance, uae
Companies: nso group

NSO Pegasus Malware Deployed To Spy On Palestinian Human Rights Activists

from the now-who-would-want-to-do-a-thing-like-that? dept

Another day, another revelation about the abuse of NSO malware by its customers. The latest report shows NSO Group's powerful Pegasus malware was used to target Palestinian human rights activists. Citizen Lab is again on the case, providing the forensic examination of the detected malware and coming to this conclusion:

In October 2021, the human rights non-governmental organization (NGO) Front Line Defenders (FLD) began collecting data on the suspected hacking of the devices of several Palestinians working for civil society organizations based in the West Bank. FLD shared the data they collected with the Citizen Lab and Amnesty International’s Security Lab for separate independent peer review of their initial findings. FLD’s analysis indicated that six devices belonging to six Palestinian human rights defenders were hacked with Pegasus, a spyware developed by the cyber-surveillance company NSO Group. Both the Citizen Lab and Amnesty International’s Security Lab independently confirmed these findings.

Given the targets of the hacking, one would suspect the Israeli government was involved in this targeting of Palestinian activists. Citizen Lab and Amnesty International have made no allegations as to the source of these attacks, but there are some details that suggest Israel's government is involved.

One of those details comes from the Citizen Lab report:

Of interest is the fact that four hacked phones exclusively used SIMs issued by Israeli telecoms companies with Israeli (+972) phone numbers. NSO Group has said that exported versions of Pegasus cannot be used to hack Israeli phone numbers.

If exportation is key to this restriction on targeting Israeli phones numbers, deploying it from home presumably bypasses this protection.

Adding to the perception that the Israeli government might be behind these hacks is the timeline of the attacks and the publication of these findings. The attacks were apparently carried out in July 2020. The three entities investigating the hackings published their findings November 8, 2021. Shortly before these publications, the Israeli government declared the organizations these targets worked for as "terrorist organizations."

Israel on Friday effectively outlawed six prominent Palestinian human rights groups by declaring them terrorist organizations, a major escalation of its decades-long crackdown on political activism in the occupied territories.

The declaration appeared to pave the way for Israel to raid their offices, seize assets, arrest staff and criminalize any public expressions of support for the groups. Most of the targeted organizations document alleged human rights violations by Israel as well as the Palestinian Authority, both of which routinely detain Palestinian activists.

That happened on October 22. On November 6, the dossier that supposedly justified the designation was leaked. And it didn't appear to have much in it to support Israel's unilateral declaration that these rights groups were actually terrorist groups.

A confidential Israeli dossier detailing alleged links between Palestinian human rights groups and an internationally designated terrorist organization contains little concrete evidence and failed to convince European countries to stop funding the groups.

The 74-page document appears to have been prepared by Israel’s Shin Bet internal security service and shared with European governments in May. The Associated Press obtained the document from the online +972 Magazine, which was the first to report on it, along with the Hebrew-language Local Call.

Here's why this matters: it turns the targets from activists to terrorists, which gives the Israeli government permission (albeit in arrears) to engage in malicious hacking of devices. Protections and rights tend to evaporate pretty quickly once a government -- any government -- decides you're a terrorist. Given the lack of solid intel in the dossier, this almost looks like the laundering of previously illegal surveillance activities. It also gives the government permission to do more of the same in the future.

No one's made any accusations (other than noting NSO customers love targeting opposition leaders and activists), but the defensive statements have been delivered anyway. At best, this is some really lazy deflection by the Israeli government and more of the same "hey, we just sell the stuff" excuses from NSO Group.

The Israeli prime minister’s office and the Defense Ministry denied that Pegasus had been used to hack the Palestinians’ phones. An NSO spokeswoman said that the company would not say who used the software and that it did not have access to information about whom the program was used against.

Well, the Citizen Lab report says otherwise. And this non-denial doesn't say the government didn't hack the phones. All it says is that these two government reps are on record denying something that can't actually be denied while refusing to confirm anything about the activists' targeting by the Israeli government.

This all looks pretty shady. And it's unlikely to persuade the US government to drop NSO from its export regulation blacklist, despite NSO's protestations that its largely-unregulated sales to human rights violators contributes to the overall security and well-being of the entire planet.

And there's this postscript, which suggests NSO is now so toxic even one of its principals wants nothing more to do with it. (Google Translated from the original Hebrew.)

Itzik Benvenisti leaves NSO less than two weeks after being appointed CEO. In August, Benvenisti was appointed co-president of the company.

Calcalist has learned that Benvenisti informed the chairman of the NSO board of directors, Asher Levy, on Tuesday that in light of the special circumstances created in the company, he decided that he would not be able to enter the position of CEO.

The "special circumstances?" Apparently it's the ongoing PR nightmare NSO is battling along with its blacklisting by the US government. According to the Calcalist article, Benvenisti said it was not possible to carry out his plans for the company while being blacklisted. One presumes Benvenisti is well aware that remaining with the company would make his name just as toxic as NSO's since there's no reason to believe this is the last negative press the company will generate.

Filed Under: activists, human rights, israel, malware, palestinian, spyware, surveillance