Germany's Constitutional Court Ponders Whether Government Users Of Zero-Day Surveillance Malware Have A Duty To Tell Software Developers About The Flaws

from the resolving-conflicting-aims dept

As Techdirt has reported previously, the use of malware to spy on suspects -- or even innocent citizens -- has long been regarded as legitimate by the German authorities. The recent leak of thousands of telephone numbers that may or may not be victims of the Pegasus spyware has suddenly brought this surveillance technique out of the shadows and into the limelight. People are finally starting to ask questions about the legitimacy of this approach when used by governments, given how easily the software can be -- and apparently has been -- abused. An interesting decision from Germany's constitutional court shows that even one of the biggest fans of legal malware is trying to work out how such programs based on zero-days can be deployed in a way that's compatible with fundamental rights. The court's press release explains:

The complainants [to the constitutional court] essentially assert that, by enacting the authorisation laid down in [the German Police Act], the Land Baden-Württemberg violated the guarantee of the confidentiality and integrity of information technology systems -- a guarantee arising from fundamental rights -- because under that provision, the authorities have no interest in notifying developers of any vulnerabilities that come to their attention since they can exploit these vulnerabilities to infiltrate IT systems for the purpose of source telecommunications surveillance, which is permitted under [the German Police Act]. Yet if the developers are not notified, these vulnerabilities and the associated dangers -- in particular the danger of third-party attacks on IT systems -- will continue to exist.

That is, the failure to notify developers about the vulnerabilities means the authorities are putting IT systems in Germany at risk, and should therefore be stopped. The complainants went on to argue that if the court nonetheless ruled that the use of such malware was not considered "inherently incompatible with the state’s duty of protection", at the very least administrative procedures should be be established for evaluating the seriousness of the threat that leaving them unpatched would represent, and then deciding on a case-by-case basis whether the relevant developers should be notified.

The German constitutional court dismissed the complaint, but on largely technical grounds. The judgment said that the complainants did not have standing, because they had failed to substantiate a breach of the government's duty of protection. Moreover, the top court said the question should first be considered exhaustively by the lower courts, before finally moving to the constitutional court if necessary. However, the judges did recognize that there was a tension between a desire to use zero-days to carry out surveillance, and the German government's duty to protect the country and its computer systems:

In the present case, the duty of protection encompasses the obligation for the legislator to set out how the police are to handle such IT security vulnerabilities. Under constitutional law, it is not inherently impermissible from the outset for source surveillance to be performed by exploiting unknown security vulnerabilities, although stricter requirements for the justification of such surveillance apply due to the dangers posed to the security of IT systems. Furthermore, fundamental rights do not give rise to a claim that authorities must notify developers about any IT security vulnerabilities immediately and in all circumstances. However, the duty of protection does necessitate a legal framework that governs how -- in a manner compatible with fundamental rights -- an authority is to resolve the conflicting aims of protecting IT systems against third-party attacks that exploit unknown IT security vulnerabilities on the one hand, and on the other hand keeping such vulnerabilities open so that source surveillance can be carried out for the purpose of maintaining public security.

It's not clear whether that call for a legal framework to regulate how the authorities can deploy malware, and when they must alert developers to the flaw it exploits, will be heeded any time soon in Germany. But in the light of the Pegasus leak, it seems likely that other countries around the world will start to ponder this same issue. That's particularly the case since such malware is arguably the only way that the authorities can reliably circumvent encrypted communications without mandating the flawed and unworkable backdoors they have been calling for. If more countries decide to follow Germany in deploying these programs, the need for a legal framework to regulate their use will become even more pressing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: germany, malware, surveillance, vulnerabilities, zero day

Governments Accused Of Spying On Journalists And Activists With NSO Group Malware Are Now Suing Journalists And Activists

from the all-hosted-by-a-country-that-really-knows-how-to-host-a-war-or-two dept

I don't think anyone foresaw the immense amount of fallout that would result from the revelation that Israeli malware purveyor NSO Group's Pegasus software is being used to target phones belonging to journalists, activists, religious leaders, and high-ranking government officials. After all, some of this was already common knowledge, thanks to investigations by Citizen Lab and others delving into the inner workings of this powerful spyware.

The malware maker had already weathered plenty of negative press, thanks to its customers' questionable use of its products, as well as NSO Group's willingness to sell powerful exploits to enemies of Israel with long human rights abuse rap sheets.

The company is now trying to regain control of the narrative, but its statements and responses have raised more questions than they've answered. NSO claims it has nothing to do with the list of 50,000 potential target phone numbers seen by journalists (a list that contains nearly 200 journalists' phone numbers). It also says it has "no visibility" on customers' use of its malware, which undermines the strength of this denial. NSO also claims it cuts off governments who abuse the product to target journalists, religious leaders, and government officials, but [taps statement above] if NSO doesn't know what customers are doing with the malware, it seems highly unlikely the company is in any position to start cutting customers off.

It's not just NSO Group that's angry. Entire governments are now pissed off by these revelations. Not everyone is angry for the same reason, though.

In France, the revelation that President Emmanuel Macron's phone was on the list of NSO-linked numbers has resulted in Macron and 14 other French ministers acquiring new phones and numbers. The French government has also opened an investigation into the Moroccan government's use of NSO's Pegasus software, which is seemingly where the targeting of French officials originated.

Over in Morocco, the government is angry that it's been named as one of the main perpetrators of questionable targeting.

Morocco has filed defamation claims against Amnesty International and a French NGO who claim its intelligence services used the Pegasus mobile phone spyware against dozens of French journalists, lawyers for the government said Thursday.

"The Moroccan state ... wants all possible light cast on these false allegations from these two organisations, who make claims without any concrete or demonstrative evidence whatsoever," the lawyer, Olivier Baratelli, said in a statement.

Somewhat awkwardly, this defamation action is being pursued in France, where Moroccan government activities are now facing scrutiny from French investigators.

But even Moroccan government officials weren't exempt from the government's alleged spying efforts.

On Tuesday, Radio France claims the country’s monarch was on the list, as well as “a large number” of Moroccan royals.

The list is said to include the king’s wife Lalla Salma Bennani; his cousin Prince Moulay Hicham Alaoui, nicknamed the “red prince” for his progressive views; a former son-in-law of the late King Hassan II; entrepreneur Fouad Filali; and Hassan II’s former bodyguard, Mohamed Mediouri, who is the current king’s stepfather.

“But what is most surprising, when you look closely at this list, is that the sovereign himself is among those whose numbers were selected as potential Pegasus targets,” the report says.

And the government has placed journalists under surveillance in the past, undermining its new claims that it has never used the software nor purchased exploits from NSO Group.

[Amnesty International] found that [Moroccan journalist] Omar Radi’s phone was subjected to multiple attacks using a sophisticated new technique that silently installed NSO Group’s notorious Pegasus spyware. The attacks occurred over a period when Radi was being repeatedly harassed by the Moroccan authorities, with one attack taking place just days after NSO pledged to stop its products being used in human rights abuses and continued until at least January 2020.

So, there's a lot to unpack and hopefully the court will start doing that when it begins handling the Moroccan government's defamation claim. If there's any truth to the allegations, one would expect the lawsuit to be dropped if the Moroccan government is ordered to turn over information on its surveillance tech and spying activities.

Morocco isn't the only aggrieved national government, though. More litigation is in the works, courtesy of the Algerian government, which says it was falsely accused of utilizing the spyware to snoop on targets. This legal action will also be taking place in France.

Algeria said on Friday that it had filed a defamation claim against media watchdog Reporters Without Borders (RSF) after it back-pedalled accusations that the North African country had possessed Israeli-made Pegasus spyware.

Algeria's embassy in France said the complaint related to declarations the France-based organisation published on its website on July 19.

RSF had initially identified Algeria as among the countries possessing the spyware, developed by Israeli firm NSO Group, but on Friday it issued a correction.

RSF has since apologized for the error, but that isn't stopping the Algerian government from making a whole bunch of noise about the mistake.

"As well as their defamatory and false nature, these unacceptable allegations pertain to the manipulation of RSF, which is known for its relentlessness towards Algeria," the embassy said.

That's pretty mild compared to the doth-protest-too-much blustering of Morocco's Foreign Minister Nasser Bourita, who must be getting paid by the word to issue responses.

Morocco has also chosen to trust justice, at home and internationally, added Bourita, who denounced a “smokescreen”, and a “fabricated bluff (…) without any proof”, calling for “shedding light on the facts, far from controversy and slander.”

However, “this is what neither Forbidden Stories nor Amnesty International do. They base their stories solely on pure speculation”, Bourita said, noting that certain papers that are under the banner of Forbidden Stories “serve agendas that are well known for their primary hostility towards Morocco” and are ulcerated by the Kingdom’s successes under the leadership of King Mohammed VI.

This is mere hostility. This is not journalism. It is large-scale sabotage, he said.

And so it goes for several paragraphs, punctuated by the occasional even-hotter take.

“Is this a campaign? Yes! Is it denigration? Certainly! Is it orchestrated? It could not be otherwise! By whom? Time will tell,” he said.

Ah, "time will tell." Or will it? Sometimes it doesn't. Sometimes no one learns anything because the secrecy surrounding national security efforts meshes with NDAs signed by surveillance tech customers and, before anything gets really interesting, lawsuits get dropped and verbose rants are replaced with "requests for comment were not returned."

Whatever the provenance of The List, it has become a Pandora's Box for NSO Group. Never mind the fact NSO didn't actually open the box itself. It's open and NSO will have to start dealing with the mess it's created.

Filed Under: defamation, france, malware, morocco, surveillance
Companies: nso group

NSO Group Attempting To Distance Itself From Damaging Leak By Offering Up Contradictory Statements And 'Nothing To Fear' Platitudes

from the not-so-fun-when-you're-the-one-being-scrutinized-by-outsiders dept

This truly is a pleasure to observe. Israeli malware merchant NSO Group -- the purveyor of powerful spyware capable of turning a target's phone into a spy agency's plaything -- is playing a whole lot of defense after leaked data seen by a number of journalists and activists appears to confirm that NSO's customers are targeting… activists and journalists. (And world leaders, religious leaders, NGO employees, and friends and relatives of all of the above…)

While the origin of this data remains unclear, it appears to be related to NSO and its customers. And although NSO claims to be very selective about who it sells this powerful spyware to, its customers include governments of questionable character, including Saudi Arabia, United Arab Emirates, Mexico, Kazakhstan, and Uzbekistan.

This has thrust Shalev Hulio, the CEO and co-founder of NSO Group, into the limelight. He's clearly unprepared to be there. His statements and responses to questions are, at best, contradictory. At worst, they're nothing more than deflections that aren't going to persuade anyone that the allegations made by several news agencies and rights groups are false.

Here's Hulio's attempt (in an interview with Calcalist) to explain that the list of 50,000 phone numbers couldn't possibly have anything to do with NSO Group:

According to Hulio, "the average for our clients is 100 targets a year. If you take NSO's entire history, you won't reach 50,000 Pegasus targets since the company was founded. Pegasus has 45 clients, with around 100 targets per client a year. In addition, this list includes countries that aren't even our clients and NSO doesn't even have any list that includes all Pegasus targets - simply because the company itself doesn't know in real-time how its clients are using the system."

So, Hulio claims agencies only target a few people every year and that he knows this because "the company itself doesn't know in real-time how its clients are using the system." If the company doesn't know what customers are doing, it's pretty tough to claim definitively that they aren't targeting more phones than NSO thinks they are or that they aren't violating their agreements with NSO by pursuing "off-limits" targets like journalists and heads of state.

It is possible NSO knows how many targets each customer has, but this information suggests it's pretty easy to exceed the "100 clients a year" Hulio insists governments aren't exceeding.

In 2016, The New York Times reported that NSO Group charged $500,000 to set a client up with the Pegasus system, and then charged an additional fee to actually infiltrate people’s phones. At the time, the costs were reportedly $650,000 to hack 10 iPhone or Android users, or $500,000 to infiltrate five BlackBerry users. Clients could then pay more to target additional users, saving as they spy with bulk discounts: $800,000 for an additional 100 phones, $500,000 for an extra 50 phones, and so on.

Here's another seemingly-contradictory statement from NSO, as provided to Forbidden Stories, which was instrumental in breaking news of this data leak:

NSO does not have insight into the specific intelligence activities of its customers, but even a rudimentary, common sense understanding of intelligence leads to the clear conclusion that these types of systems are used mostly for purposes other than surveillance.

There's some word salad towards the end that means a whole lot of nothing, but pay attention to the opening of this statement: "NSO does not have insight into the specific intelligence activities of its customers." If this is true, there's no way NSO can definitively claim the leaked phone number list has nothing to do with its customers. And it also can't seriously claim that it cuts off customers who abuse the product to target individuals that aren't terrorists or criminal suspects.

This isn't the end of the flailing. Shalev Huilo also has conspiracy theories about the origin of the list currently in the news.

"I believe that in the end it's either Qatar or BDS or both," he said. "In the end it's always the same entities. I don't want to sound cynical now, but there are those who don't want [Israel] to import ice cream or export technologies."

Hulio is referring to Ben and Jerry's recent decision not to sell its ice cream in Israeli-occupied territories following years of BDS campaigns. Hulio also said that he doesn't think it's a coincidence that the investigation about his company dropped around the same time that another Israeli surveillance company, Cellebrite, is being challenged by digital rights group while attempting to go public, and the publication of an investigation about Candiru, yet another Israeli surveillance company.

"It's just illogical that this is all happening at once," he said.

Most of the time, coincidences are just that: coincidences. Far more rarely than people claim, coincidences aren't coincidences, but rather evidence of a conspiracy. In this case it's the former, an actual coincidence. And Hulio knows that because even he can't connect enough dots to narrow this down to a single perpetrator.

And the flailingest thing of all is this statement by Hulio, which echoes the statements made by government spy agencies when they're caught with their surveillance pants down:

“The people that are not criminals, not the Bin Ladens of the world—there’s nothing to be afraid of. They can absolutely trust on the security and privacy of their Google and Apple devices.”

Oh really? Then all these journalists and activists who have been targeted by NSO spyware are the "Bin Ladens of the world?" That's a bullshit response, especially when Hulio admits it can't control or even monitor its customers' use of the malware it sells them. Given the number of human rights violators it sells to, people who are not criminals or Bin Laden-alikes still have plenty to be afraid of.

Filed Under: malware, shalev hulio, surveillance
Companies: nso group

Leaked Data Shows NSO Group's Malware Was Used To Target Journalists, Activists, And World Leaders

from the not-your-usual-bad-guys dept

A massive data leak has confirmed what's been suspected (and reported by security researchers like Citizen Lab) for a long time: Israeli malware developer NSO Group's powerful cellphone snooping tools have been used to target journalists, activists, and dissidents all over the world.

The Guardian and 16 other media outlets have dug into the data leak and uncovered some pretty disturbing info about NSO's Pegasus malware, which allows those deploying the spyware to extract messages, record phone calls, and surreptitiously activate microphones.

Who's in the list of phone numbers seen by the Guardian? Lots and lots and lots of journalists.

The leak contains a list of more than 50,000 phone numbers that, it is believed, have been identified as those of people of interest by clients of NSO since 2016.

[...]

The disclosures begin on Sunday, with the revelation that the numbers of more than 180 journalists are listed in the data, including reporters, editors and executives at the Financial Times, CNN, the New York Times, France 24, the Economist, Associated Press and Reuters.

Here's who's included in this first revelation by the Guardian:

[J]ournalists who were selected as possible candidates for surveillance by NSO’s clients work for some of the world’s most prestigious media organisations. They include the Wall Street Journal, CNN, the New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America.

Also found on the list was the number of Mexican reporter Cecilio Pineda Birto, who was murdered while waiting for his pickup to finish being cleaned at a local car wash. This followed weeks of death threats that began after his reporting accused state police and local government officials of colluding with crime lords.

It's not just journalists being targeted by NSO's powerful malware. The list also includes numbers linked to religious figures, executives of private companies, union officials, high-ranking government officials, and NGO employees.

NSO, for its part, continues to insist it's not the bad guy here. It says it only sells the software to a "select group" of "vetted" government agencies. Unfortunately, that list of approved governments includes notorious human rights violators like the Saudi government (which killed Washington Post reporter Jamal Khashoggi) and agencies in the UAE, Bahrain, and Kazakhstan.

The government of Mexico is one of NSO's most enthusiastic users. It "selected" 15,000 of the 50,000 numbers recovered in the data leak. This doesn't mean 15,000 successful deployments but it does mean the Mexican government -- which has no shortage of local criminals to target -- also apparently tried to infect phones owned by journalists.

NSO's hands are far from clean. Its list of clients isn't as selective as it likes to pretend. And while it may tell purchasers the spyware should only be used to target criminals and terrorists, it doesn't yank licenses from governments that choose to target journalists, academics, religious figures, and others.

Filed Under: activists, governments, journalists, malware, snooping tools, spyware, surveillance
Companies: nso group

Scammers Use The Public's Fear Of Copyright Culture To Trick People Into Installing Malware

from the look-what-you've-done dept

It isn't some novel revelation that scammers and malware purveyors have used the public's fear and lack of knowledge about copyright laws and processes to pull off their nefarious deeds. For more than a decade, bad actors have looked at the shady methods of copyright trolls and noticed that those tactics are perfectly suited to convince the public to download malware or fraudulently extract money from people's wallets. None of this is new or surprising. What should be surprising, however, is that absolutely nothing has been done about any of this. Never has a hard look been taken as to why copyright enforcement so resembles these illegal activities, nor has any serious consideration been given to what this culture of permission and fear has done to so well prepare the public to be susceptible to these scams.

As a result, these bad acts continue to the present. TorrentFreak has a post about how scammers are currently using fake notices sent to the public, made to look like copyright threats or warnings, all in an effort to get them to click links and download malware.

Just a few weeks ago, we reported how pirates are lured into downloading malware and trojans. However, people who want to avoid copyright troubles are facing similar risks. As it turns out, fake copyright warnings and takedown notices are commonly used by scammers as well.

These scammers cleverly use the threat that copyright infringement claims pose to recipients. Many website operators fear legal repercussions and are eager to resolve these matters swiftly. Social media users, who risk losing their accounts, are equally concerned.

This happens in a variety of ways. Those hosting or running websites get notices that their sites will be taken down if they don't click the links and respond to a general accusation of copyright infringement. But the scammers are also going after random social media accounts as well, with the same push via threats of account termination to click links. Those links are typically used to steal account credentials, just like a typical phishing email scam. Some, however, actually deploy a payload of malware instead.

Careful readers will notice that there are several mistakes in the notice. However, in their panic, some people may simply read over these errors. Instead, they will click on the Google link where they can download a “Copyright Infringement Evidence” package.

Needless to say, downloading and running these files will infect people’s computers with all kinds of nastiness. Google takes these links down when they are reported and we couldn’t find a live one. However, Techlicious linked one package to a Ransomware trojan.

Why does this work so well? Well, as I mentioned above, it starts to get really tough to tell apart the notices coming from copyright trolls and the scammers. While the end goal is somewhat different, the overall tactic is the same: use threatening language about copyright infringement to scare the shit out of the target in order to get them to hastily do what you want. In the case of copyright trolls, that means so-called "settlement" payments. For the other scammers, this can also mean handing over money, or clicking a link to steal credentials or deliver malware.

It used to be said that only pirates had to worry about copyright culture creating security risks for those infringing copyright. Now, thanks to the expansion of that copyright culture, unsuspecting and innocent members of the public are at risk as well.

Filed Under: copyright, malware, phishing

Israel's NSO Group Exploits And Malware Again Being Used To Target Journalists In The Middle East

from the are-we-the-baddies-asked-no-one-at-NSO-ever dept

You'd think the government of a land surrounded by enemies would do more to regulate malware distribution by local companies. It's one thing to hold your enemies close. It's quite another to provide them with the tools to ensure your own downfall.

One would think malware purveyors like the Israel's NSO Group would post photos of countries like Saudi Arabia on its "DO NOT ACCEPT CHECKS FROM THESE GOVERNMENTS" wall at its HQ. But it doesn't care. It sells to whoever will buy, even if that means subjecting Israeli citizens to surveillance programs run by Israel's enemies.

This has been part of NSO's far from illustrious history for years. When not being sued by American companies for leveraging their messaging services to deliver malware, NSO Group has allowed a variety of authoritarian governments to spy on activists, journalists, and dissidents with its toolkit of exploits and scalable attacks.

The latest expose on NSO's unsavory tactics comes from Citizen Lab, which has been exposing the nastiness of malware purveyors for years. Citizen Lab says NSO is still allowing Israel's enemies to target critics, making it far more dangerous for them to engage in activities that expose heinous government actions. Unsurprisingly, it's longtime human rights violators making the most of whatever NSO Group will sell them.

In July and August 2020, government operatives used NSO Group’s Pegasus spyware to hack 36 personal phones belonging to journalists, producers, anchors, and executives at Al Jazeera. The personal phone of a journalist at London-based Al Araby TV was also hacked.

The phones were compromised using an exploit chain that we call KISMET, which appears to involve an invisible zero-click exploit in iMessage. In July 2020, KISMET was a zero-day against at least iOS 13.5.1 and could hack Apple’s then-latest iPhone 11.

Based on logs from compromised phones, we believe that NSO Group customers also successfully deployed KISMET or a related zero-click, zero-day exploit between October and December 2019.

The journalists were hacked by four Pegasus operators, including one operator MONARCHY that we attribute to Saudi Arabia, and one operator SNEAKY KESTREL that we attribute to the United Arab Emirates.

Al Jazeera is one of the only independent news outlets covering Middle East issues. That makes it a popular target for governments that would prefer their own narratives dominate news coverage. NSO's tools make it easier to undercut competing narratives by compromising independent reporting and intimidating journalists who won't act as stenographers for government talking heads.

Citizen Lab's investigation uncovered attacks on journalists' phones, resulting in exfiltration of data and communications. In addition, it saw evidence of capabilities that are present in NSO's malware, even if they aren't being exploited yet. These include taking control of mics on devices to surreptitiously record in-person conversations, as well as accessing audio of encrypted phone conversations. In addition, the malware has the ability to track users' locations and access their stored credentials.

These are powerful tools. And like all powerful tools, they shouldn't be allowed to fall into the wrong hands. But NSO Group not only allows them to fall into the wrong hands, it makes its own countrymen and allies targets by actively placing them in the wrong hands. Then it stands back and says it has no control over its customers' actions, even if it knows certain customers are definitely not going to use these powers for good.

Filed Under: exploits, journalists, malware, surveillance, zero day
Companies: al jazeera, nso group

Former NSO Employees Says The Company Impersonated Facebook To Deploy Malware

from the so-much-for-the-innocent-middleman-theory dept

As Facebook's lawsuit against Israeli malware purveyor, NSO Group, continues, more facts are coming to light that undercut the spyware vendor's claims that it's just a simple software developer that can't be blamed for the malicious acts of its customers.

NSO Group argued in court that the sovereign immunity that insulates the governments it sells to (including such abusive regimes as the United Arab Emirates and Saudi Arabia) similarly shields it from Facebook's desire to prevent it from using WhatsApp to deploy malware. Facebook has since pointed out NSO uses US servers that it owns or rents to deploy the malware it claims it has no involvement in deploying.

More information has come to light, thanks to a whistleblower of sorts who spoke to Joseph Cox of Motherboard. The statements made by a former NSO employee further implicate the company in the dirty doings of its customers (who have targeted journalists, activists, and lawyers).

Infamous Israeli surveillance firm NSO Group created a web domain that looked as if it belonged to Facebook's security team to entice targets to click on links that would install the company's powerful cell phone hacking technology, according to data analyzed by Motherboard.

"Pegasus" is the name of the malware deployed via WhatsApp -- the preferred tool of governments the company sells to. (It's branded as "Phantom" when NSO pitches to US law enforcement agencies.) Once successfully deployed, the malware grants government agencies almost complete access to phone data, communications, and functions. Messages can be intercepted, making encryption irrelevant and the phone's mic and camera can be surreptitiously accessed to record conversations and take pictures.

It's easier to get targets to activate the malware if it looks like it came from a legitimate source. That's where the impersonation comes in.

The IP address provided to Motherboard related to a 1-click installation of Pegasus, the former employee said. Motherboard reviewed multiple databases of so-called passive DNS records from cybersecurity services DomainTools and RiskIQ, which show what web domain an IP address related to at different points in time. Throughout 2015 and 2016, the IP address resolved to 10 domains. Some of these seem to have been designed to appear innocuous, such as a link a person could click on to unsubscribe themselves from emails or text messages. Others impersonated Facebook's security team and package tracking links from FedEx.

The IP address impersonating Facebook is no longer under NSO's control. Infamous IP protection firm MarkMonitor apparently took control of the domain in late 2016, handing control of it to Facebook to prevent further misuse.

Facebook is also suing domain registrars for allowing customers to purchase domains that appear to be associated with the social media service. This isn't an unusual move, but it does appear to indicate most purchasers of Facebook-adjacent domains are using them for malicious purposes. Until now, no one's linked any of these domains to a malware vendor. This is only going to further harm NSO's assertions that its involvement in malware deployment begins and ends at the point of sale.

Filed Under: impersonation, malware, spyware, surveillance
Companies: facebook, nso group, whatsapp

NSO Fires Back At Facebook, Says It's Not Responsible For Malware Deployments By Foreign Governments

from the fair-point-but-doesn't-really-make-NSO-Group-look-any-better dept

NSO Group has finally decided to engage in the lawsuit Facebook filed against it late last year. The Israeli surveillance tech company has shown itself to be pretty cavalier about its market expansion plans. Despite being located in a country surrounded by unfriendly governments, NSO is more than willing to give Israel's enemies something to use against it. Its client list includes Saudi Arabia, United Arab Emirates, Bahrain, and Kazakhstan.

Facebook's lawsuit is questionable and if it wins, it would cause a lot of damage. Facebook is unhappy NSO software uses WhatsApp to deliver malware payloads to targets. But seeking precedent that would criminalize terms of service violations isn't going to help anyone, much less stop NSO from using encrypted messaging apps as attack vectors.

NSO is now firing back. And it makes a point that's true, if not all that sympathetic. It is not its customers. Much like the gun dealer who sells the gun eventually used in a mass shooting, NSO's sales of malware to governments that use them in questionable ways isn't really NSO's fault. It may have provided the surveillance tech, but it is not telling governments who to target or participating in the surveillance directly.

In its first substantive legal filing in the case, filed last week, NSO hit back at WhatsApp and its parent company, Facebook, which it said were seen by governments as “safe spaces for terrorists and other criminals” who – without NSO’s services – could operate “without fear of detection by law enforcement”.

NSO Group also argued that WhatsApp had “conflated” NSO Group’s actions with the actions of NSO’s “sovereign customers”. While NSO Group licenses its signature spying technology, Pegasus, to government law enforcement and intelligence agencies and assists with “training, setup, and installation”, it said it did not operate the technology.

This is NSO arguing it cannot be held responsible for the actions of others. If Facebook doesn't like what these governments are doing with NSO's tech, it's welcome to sue those governments directly. Not that those lawsuits would succeed. We're not the only nation that extends sovereign immunity to government agencies. That's standard operating procedure around the world. This is what NSO is hoping will convince the court to toss the suit.

“For that reason,” the company said in the filing, “permitting this litigation to proceed would infringe critical national security and foreign policy concerns of sovereign governments”.

NSO is also fighting back with a little dirt of its own. Long before it was sued by Facebook, it spent a little time discussing its spyware with the company.

In October 2017, NSO was approached by two Facebook representatives who asked to purchase the right to use certain capabilities of Pegasus, the same NSO software discussed in Plaintiffs' Complaint.

The Facebook representatives stated that Facebook was concerned that its method for gathering user data through Onavo Protect was less effective on Apple devices than on Android devices. The Facebook representatives also stated that Facebook wanted to use purported capabilities of Pegasus to monitor users on Apple devices and were willing to pay for the ability to monitor Onavo Protect users. Facebook proposed to pay NSO a monthly fee for each Onavo Protect user.

Onavo was Facebook's VPN -- one that had little to do with offering privacy to its users. It may have shielded them from others attempting to take a look at their web traffic, but it didn't do anything to prevent Facebook from collecting tons of data on users, which included a whole lot of minors. It was booted from Apple's App Store in 2018 for hoovering up too much sensitive data. Roughly six months later, Facebook killed the faux VPN for good.

Facebook claims this is an "inaccurate" portrayal of its meeting with NSO, but it's not like Facebook has much credibility on the privacy front. Its thirst for data has been unquenchable and its mitigation attempts have been provoked by Congressional inquiries and years of work by privacy activists. It hasn't suddenly become altruistic.

Facebook is right to be concerned about the use of WhatsApp to spread malware. But this lawsuit that attempts to use the already badly-abused CFAA to cover things Facebook doesn't like other people doing is going to cause collateral damage to researchers and journalists, rather than prevent NSO from selling WhatsApp-exploiting malware to government agencies.

Filed Under: cfaa, governments, hacking, liability, malware, privacy
Companies: facebook, nso, whatsapp

Researchers Say Kids' Android Apps Are Still Riddled With Malware

from the all-fun-and-games-until-somebody-gets-hurt dept

While numerous vendors and tech giants have cooked up lower-cost Android phones with marketing focused on helping the poor, a recent study by advocacy group Privacy International found that the privacy trade offs of these devices are... potent. Not only do they usually come with outdated OS' opening the door to hackers, the phones have locked down user control to such a degree they're unable to remove apps that may also pose security risks. In this way, the researchers argued, we've made privacy a luxury option that's only available to those who can actually afford it.

But the poor aren't the only ones harmed by our continually lax treatment of consumer privacy and security. In a new blog post, researchers from Checkpoint Software say that a huge number of kids-oriented Android apps are also privacy and security nightmares. The researchers recently identified a new malware family found in 56 applications that were collectively downloaded some 1 million times globally. Motivated by advertising fraud, the "Tekya" malware imitates the user’s actions in order to click ads and banners from agencies like Google’s AdMob, AppLovin’, Facebook, and Unity, Checkpoint found.

Most-malware infected apps compromise the end users' data, credentials, emails, text messages, and geographical location. Twenty four of those apps were aimed at children, the researchers noted:

"During this research, the Tekya malware family went undetected by VirusTotal and Google Play Protect. Ultimately, it was available for download in 56 applications downloadable on Google Play.

This campaign cloned legitimate popular applications to gain an audience, mostly with children, as most application covers for the Tekya malware are children’s games. The good news is, these infected applications have all been removed from Google Play."

While these apps have been removed and Google has ramped up its security practices in recent years, it's not a problem that's generally going away anytime soon:

"This highlights once again that the Google Play Store can still host malicious apps. There are nearly 3 million apps available from the store, with hundreds of new apps being uploaded daily – making it difficult to check that every single app is safe. Thus, users cannot rely on Google Play’s security measures alone to ensure their devices are protected."

In short, anybody trusting the integrity and safety of the Google Play store is making a significant error. And folks who aren't taking an active role in protecting their kids' privacy and security are being negligent. The Checkpoint blog has a good list of the latest apps you should be aware of.

Filed Under: android, apps, malware
Companies: google