Whistleblower Alleges NSO Offered To 'Drop Off Bags Of Cash' In Exchange To Access To US Cellular Networks

from the pay-to-play dept

The endless parade of bad news for Israeli malware merchant NSO Group continues. While it appears someone might be willing to bail out the beleaguered company, it still has to do business as the poster boy for the furtherance of human rights violations around the world. That the Israeli government may have played a significant part in NSO's sales to known human rights violators may ultimately be mitigating, but for now, NSO is stuck playing defense with each passing news cycle.

Late last month, the New York Times revealed some very interesting things about NSO Group. First, it revealed the company was able to undo its built-in ban on searching US phone numbers… provided it was asked to by a US government agency. The FBI took NSO's powerful Pegasus malware for a spin in 2019, but under an assumed name: Phantom. With the permission of NSO and the Israeli government, the malware was able to target US numbers, albeit ones linked to dummy phones purchased by the FBI.

The report noted the FBI liked what it saw, but found the zero-click exploit provided by NSO's bespoke "Phantom" (Pegasus, but able to target US numbers) might pose constitutional problems the agency couldn't surmount. So, it walked away from NSO. But not before running some attack attempts through US servers -- something that was inadvertently exposed by Facebook and WhatsApp in their lawsuit against NSO over the targeting of WhatsApp users. An exhibit declared NSO was using US servers to deliver malware, something that suggested NSO didn't care about its self-imposed restrictions on US targeting. In reality, it was the FBI and NSO running some tests on local applications of zero-click malware that happened to be caught by Facebook techies.

But there's more. Recent reports building on the NYT article contain statements that claim NSO approached service providers with (well, let's just say it) bribes to allow access to targets at a higher level that might mitigate some of the defensive efforts deployed by Facebook, Google, and Apple.

Here's what's been alleged in newer reports, like this one by Craig Timberg of the Washington Post:

The surveillance company NSO Group offered to give representatives of an American mobile-security firm “bags of cash” in exchange for access to global cellular networks, according to a whistleblower who has described the encounter in confidential disclosures to the Justice Department that have been reviewed by The Washington Post.

The mobile-phone security expert Gary Miller alleges that the offer came during a conference call in August 2017 between NSO Group officials and representatives of his employer at the time, Mobileum, a California-based company that provides security services to cellular companies worldwide. The NSO officials specifically were seeking access to what is called the SS7 network, which helps cellular companies route calls and services as their users roam the world, according to Miller.

Mobileum execs were (understandably) unsure how any of this was supposed to work in the unlikely event they were amenable to a foreign entity's requests for elevated access to US cellular networks. Fortunately, the NSO rep made it extremely clear how this was going to work, according to the whistleblower:

In Miller’s account to the Justice Department, when one of Mobileum’s representatives pointed out that security companies do not ordinarily offer services to surveillance companies and asked how such an arrangement would work, NSO co-founder Omri Lavie allegedly said, “We drop bags of cash at your office."

Simple enough. Except -- to quote C. Montgomery Burns -- at the end of the proposed transaction "the money and the very stupid man were still there." Mobileum execs say no such bribery took place -- not because NSO didn't offer it but because the company refused to accept the generous offer of extremely shady "bags of cash" from the Israeli malware maker.

NSO has its own explanation for these events, which is, basically: "It was a joke, probably."

In a statement through a spokesperson, Lavie said he did not believe he had made the remark. “No business was undertaken with Mobileum,” the statement said. “Mr Lavie has no recollection of using the phrase ‘bags of cash’, and believes he did not do so. However if those words were used they will have been entirely in jest.”

Hahahahahaaaa… here at the home of the zero-click exploit marketed to human rights violators we often joke about bribing tech companies to allow us more access to networks. Oh, our sides ache from the fun we have jesting about subverting networks to compromise targets of evil empires. Ell oh fucking ell.

Mobileum, on the other hand, says it has never done business with NSO and reported this proposed cash drop to the FBI in 2017 but never heard anything back from the agency. Two years later, the FBI was experimenting with NSO malware and trying to gauge the political and constitutional fallout of deploying unregulated malware against US citizens.

Even if NSO is to be believed, there's nothing good awaiting it on the US side of things. The Commerce Department has already blacklisted the company, destroying its ability to purchase US tech for the purpose of compromising it. And the Department of Justice has opened its own investigation into NSO, adding to its list of US-related woes.

NSO could have avoided all of this international attention by being more selective about who it sold to, and stripping customers of their licenses at the first hint of malfeasance. It didn't. And the fact that it may have been pressed into service as a malware-laden extension of the Israeli government's Middle East charm offensive isn't going to save it. NSO has to save itself but it lacks the tools to do so. Whatever it claims in defense of every reported allegation is presumed to be suspect, if not completely false. The reputation it has now is mostly earned. It made millions helping sketchy governments inflict further misery on citizens, dissidents, journalists, and political opponents. The company's honor is no longer presumed if, indeed, it ever was.

Filed Under: bribes, malware, pegasus, phantom, phone networks, spyware, surveillance, whistleblower
Companies: nso group

AT&T Employees Took Bribes To Plant Malware On Company's Network

from the ill-communication dept

The DOJ this week announced that AT&T employees have been paid more than $1 million in bribes to unlock millions of smartphones, and to install malware and unauthorized hardware on the company's network. According to the full DOJ complaint (pdf), Muhammad Fahd, a 34-year-old man from Pakistan and a (presumed dead) co-conspirator, Ghulam Jiwani, paid off AT&T employees at the company's Mobility Customer Care call center in Bothell, Washington. In return, from April 2012 until September 2017, the two men unlocked iPhones so they could be used on another carrier's network.

Worse, the bribed employees happily installed malware and keyloggers providing broad access to the AT&T network. That includes keyloggers intended to gather data on AT&T's internal systems and processes:

The DOJ said Fahd and his co-conspirator then created a second malware strain that leveraged the information acquired through the first. This second malware used AT&T employee credentials to perform automated actions on AT&T's internal application to unlock phone's at Fahd's behest, without needing to interact with AT&T employees every time. In November 2014, as Fahd began having problems controlling this malware, the DOJ said he also bribed AT&T employees to install rogue wireless access points inside AT&T's Bothell call center. These devices helped Fahd with gaining access to AT&T internal apps and network, and continue the rogue phone unlocking scheme.

Carriers have had a bit of a problem with rogue employees being bribed. Similar tactics have been used by hackers engaged in "SIM hijacking," which involves posing as a wireless customer, then fooling a wireless carrier to port the victim's cell phone number right out from underneath them, letting the attacker then pose as the customer to potentially devastating effect. Both AT&T and T-Mobile have subsequently been sued after instances where SIM hijacking then lead to identity and cryptocurrency theft, though both companies have been busy trying to dodge culpability for failing to keep consumer data secure.

The DOJ notes that one AT&T employee received more than $428,500 in bribes over a five year period. And the operators of the scam appear to have been focused on running an illegal phone unlocking ring via a number of bogus companies including Endless Trading FZE, Endless Connections Inc., and iDevelopment. Fahd was arrested in Hong Kong in February 2018, and extradited to the US last week. AT&T, meanwhile, states that it lost upwards of $5 million in revenue annually as the result of the unlocking scheme. The DOJ does not detail the width and scope of the private data accessed via the malware planted by the duo.

Granted while the DOJ and government regulators were quick to run to AT&T's assistance in this instance, they've been far more hesitant to police AT&T's own, direct role in failing to secure customers' private data. No action has been taken (nor criticism levied) against AT&T for failing to police both SIM hijacking scams being run on its own customers, nor has any agency taken action against revelations that AT&T and other mobile carriers spent years selling private customer location data to a universe of shady middlemen.

Filed Under: bribes, doj, ghulam jiwani, muhammad fahd, security
Companies: at&t

Net Censors Arrested In China For Taking Bribes To Delete Unflattering Posts As Well As The 'Harmful' Ones

from the gaming-the-system dept

Techdirt has run a number of stories about China's increasingly pervasive Net censorship, which operates both domestically and further afield. According to this story in Index on Censorship, China seems to think its system still needs bolstering:

The Chinese government has revealed it is expanding their censorship of the internet with a new training programme for the estimated two million "opinion monitors" Beijing organised last year.

...

Once trained, monitors will "supervise" the posting of social media messages, deleting those that are deemed harmful. Beijing claims to have deployed "advanced filtering technology" to identify problematic posts, and will need to "rapidly filter out false, harmful, incorrect, or even reactionary information," according to Xinhua.

Internet monitoring in China is an intensive process. Censored search terms are often placed on the list and then removed as a situation develops.

That fluid situation and the huge numbers of people involved mean that it's hard to monitor the monitors -- generally a problem with censorship. So it was probably inevitable that some Net censors would start taking advantage of their power to earn a little extra money:

Beijing police have detained at least 10 people, including employees at Baidu, the leading Chinese-language Internet search provider, over allegations of abusing their positions to delete online posts in return for money, the Beijing News reports.

The idea was simple, as the China News post quoted above explains:

staff searched for unfavorable posts about enterprises and government departments, then charged hundreds of yuan to delete the posts.

...

The posts covered a wide range of issues, including forced demolitions, pollution problems, extramarital affairs and bribery by officials, as well as product quality and companies in financial crises

Combined with the millions who will be censoring a changing list of forbidden topics, this will make it even harder for Chinese citizens to find out what's going on from the mainstream Internet sites. That might encourage users to explore less well-known services in an effort to avoid such massive censorship, causing the Chinese authorities to recruit even more "opinion monitors."

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bribes, censorship, china, corruption, free speech, great firewall

SEC Investigating Hollywood Studios For Alleged Bribes To China

from the open-markets dept

When the MPAA came out with its annual report about the movie market worldwide, it showed that China was a huge growth market. However, now it appears that perhaps some of that growth was the result of Hollywood studios bribing Chinese officials. For years, China has limited how many Western movies can be released in the country. While Hollywood loves to decry all of the "piracy" in China, much of it is due to the fact that the movies can't be released there under the law. That's a situation where the problem is not piracy, nor the MPAA itself (even as it whines about Chinese piracy), but local laws. However, there has been a loosening of those restrictions lately -- and the SEC is exploring whether or not that came about due to bribes from the studios:

The Securities and Exchange Commission has sent letters of inquiry to at least five movie studios in the past two months, including News Corp's 20th Century Fox, Disney, and DreamWorks Animation, a person familiar with the matter said.

The letters ask for information about potential inappropriate payments and how the companies dealt with certain government officials in China, said the person, who was not authorized to speak publicly about the letters.

That said, there is an interesting tidbit in the Reuters article about all of this, that really serves to highlight how ridiculous the MPAA's fight against "piracy" is. It shows that despite the fact that piracy is rampant for Hollywood movies -- once the MPAA was able to get legit movies into the country, people flocked to the theaters. In other words, despite the cheaper pirated options -- or even free options -- people have no problem paying for the legit product when it's offered in a quality fashion:

China's booming middle class is increasingly willing to pay tickets prices for a cinema experience, forgoing cheap pirated DVDs and free internet downloads.

Once again, this seems to demonstrate why the problem is not piracy. If consumers are offered what they want in a reasonable manner, they are more than willing to pay -- and the Hollywood studios seem to recognize this implicitly (which is why they may have bribed Chinese officials to release authorized versions in that market, even with "piracy" being so common).

Filed Under: bribes, china, hollywood, mpaa, sec
Companies: 20th century fox, disney, dreamworks, news corp

Reporter Claims TSA Agent Would Speed People Through Security For $10

from the feeling-safer dept

Phil Mushnick at the NYPost has an article telling about his own recent experience flying out of Newark, in which a TSA agent appeared to let people cut to the front of the security line for a "tip" of around $10. The actual amount wasn't entirely clear, other than that she got quite upset -- publicly -- when only given $5. Basically, she walked around offering people a wheelchair, which she would use to bring them to the front of the line, the whole time letting them know that she expected something in return.

Of course, the TSA at Newark has a bit of a history of problems. In just the past two years, a TSA agent was arrested for avoiding security. A TSA supervisor was arrested for working with another TSA agent to steal money from passengers, and just a few months after that, another TSA agent was arrested for stealing $500 from a wheelchair-bound passenger.

All of this makes you wonder if the TSA is really making us safer... or exactly the opposite. If TSA agents are looking for the next opportunity to make or steal a dollar, rather than keeping people and planes safe, it would suggest that we've got a problem.

Filed Under: bribes, security, tsa

Economist Explains Why Paying Certain Bribes Should Be Legal

from the taking-them?-not-so-much... dept

With a big bribery scandal continuing to unfold in India, it's a bit interesting to see Kaushik Basu, the chief economic advisor to India's Ministry of Finance, make the argument that paying bribes should be perfectly legal. Before you jump to conclusions, you have to realize he's just saying that paying bribes should be legal. Accepting them should remain against the law. As it stands now, both the bribee and the briber are guilty of a crime, and he thinks that's a mistake.

Under current Indian law, Basu writes,

once a bribe is given, the bribe giver and the bribe taker become partners in crime. It is in their joint interest to keep this fact hidden from the authorities and to be fugitives from the law, because, if caught, both expect to be punished.

But if the law were changed as Basu suggests,

once a bribe is given and the bribe giver collects whatever she is trying to acquire by giving the money, the interests of the bribe taker and bribe giver become completely orthogonal to each other.

... In other words, the interests of the bribe taker and the bribe giver are no longer aligned.

The argument is that this way, there's less incentive to actually have bribery, because if someone demands a bribe, you can pay it, but then you can report it and get the person in trouble:

In Basu's world, you pay the bribe and get your refund. Then you go to the authorities and report the clerk who collected the bribe. If the clerk is convicted of taking the bribe, he has to pay you back, and faces additional penalties. You get your money back, and you face no charges.

Of course, the clerk knows that you have this incentive to report him. So, Basu argues, he'll be less likely to demand the bribe in the first place. These kinds of bribes, which Basu says are currently "rampant" in India, will become much less common.

Of course, the link above, to the Planet Money discussion about this, notes that there would be some unintended consequences. Certainly, it wouldn't remove all bribery, as many people willingly pay bribes to try to get favors, and in such cases, this would make the power of those bribes even stronger, since they'd have something to hold over the bribe-taker. To deal with this Basu is suggesting that this idea of making it "legal" should only apply to bribes people are pressured to pay to get something they're legally entitled to receive -- and not for things like a company paying off the government to get a contract. Still, another unintended consequence is that it could increase false accusations of bribery. So it's not a perfect solution by any means, but it is interesting to think about.

Filed Under: bribes, economics, kaushik basu

Microsoft Discovers That Bribing People To Use Its Search Engine Didn't Work

from the money-isn't-everything dept

We recently had a discussion about the role of money as an incentive and how it often doesn't work the way people think it should (i.e., money often provides negative incentive -- the opposite of what you would think). I'm actually working on another post about that topic that I'll hopefully finish later today, but here's a quick one demonstrating that point in action.

Way back in 2005, Bill Gates suggested that in the end, Microsoft would be able to beat Google because it had a secret weapon: it could bribe users to use Microsoft instead of Google, by offering them a cut of the advertising revenue. It took a few years, but Microsoft finally turned on that "feature" on a limited basis in 2008, offering cashback for people who bought certain products after searching for them via Microsoft's search engine. Later that year, it expanded the program to regular search. What happened? Not that many people cared enough. Microsoft kept upping the ante, but most people didn't care. They were happy with their Google searches, and even if Microsoft was paying them to use its search engine, it wasn't enough. Well, except for people who figured out how to game the system. But that's not who Microsoft was targeting.

Microsoft has now admitted the program was a failure and is shutting it down. In a blog post about the decision, Microsoft admits that people just weren't that interested:

In lots of ways, this was a great feature -- we had over a thousand merchant partners delivering great offers to customers and seeing great ROI on their campaigns, and we were taking some of the advertising revenue and giving it back to customers. But after a couple of years of trying, we did not see the broad adoption that we had hoped for.

Microsoft admission is quite open and honest, which is actually pretty cool. They don't sugarcoat it. They thought this was something people would like -- as the basic belief that monetary rewards drives activity would suggest -- but found that, in practice, it does not work at all.

Filed Under: bribes, search
Companies: google, microsoft

Microsoft Tries To Silence Revelation Of Bing Cashback Flaws; Leads To Revelation Of Other Problems

from the touchy-microsoft dept

I'd been meaning to write this up for about a week, but finally got it around to it, just in time to add some additional info. First up, though, comes the news that Microsoft's legal department demanded a blogger remove a blog post about flaws in Bing's Cashback offer (Microsoft's attempt to bribe users to search via Bing instead of Google). One of the methods for the cashback offer involved pixel tracking, and blogger Samir Meghani noted that this was easily gamed to post fake transactions to your account. He also noted problems with the way Microsoft used sequential IDs, allowing potential scammers to "deny cashback rebates to legitimate users by using up available order ID numbers." Instead of dealing with these flaws, Microsoft lawyers sent a cease-and-desist and forced the blog post offline. I'm actually quite surprised this hasn't received a lot more attention.

In the legal nastygram, Microsoft's lawyers claimed that because Meghani had tested the flaws out himself, he was likely guilty of violating "various laws relating to computer intrusion, unauthorized access and unauthorized use of information," while suggesting that his actions could result in criminal charges. That's ridiculous, of course. He didn't actually scam the company -- he was just exposing a flaw. This is legal bullying to silence someone for pointing out a rather basic security flaw in Microsoft's program.

But, of course, even though Meghani was silenced on that issue, it doesn't mean he has to be silent on all of the flaws in Bing's Cashback program, so his latest (found via Slashdot) is that various retailers that offer "cashback" via Bing purchases are showing higher prices if you search via Bing. In fact, the price people can pay if they do certain searches on Bing is higher than if they'd gone direct:

So, if I go directly to butterflyphoto.com, I pay $699 with 0% cashback. If I use Bing Cashback, I pay $758 with 2% cashback, or $742.84. Using Bing cashback has actually cost me $43.84, giving an effective cashback rate of -6.27%. Yes, negative cashback! Is this legal? False advertising? I don't know, but it's pretty sketchy.

The problem doesn't end there. Using Bing has tainted my web browser. Butterfly Photo set a three month cookie on my computer to indicate that I came from Bing. Any product I look at for the next three months may show a different price than I'd get by going there directly. Just clicking a Bing link means three months of potentially negative cashback, without me ever realizing it. I'm actually afraid to use their service even just to write this, because it may cost me money in the future. If you've been thinking about trying out Bing Cashback, you may want to rethink that.

Microsoft responded and called this "an isolated instance" that it had missed with its tools that try to prevent merchants from gaming the system this way. Still, perhaps rather than sending out legal nastygrams and PR pablum to people discussing these things, Microsoft should focus on actually making sure that Bing's Cashback bribery program actually works correctly and safely.

Filed Under: bing, bribes, cashback, cease and desist, flaws, security
Companies: microsoft

Dear Rupert: You Don't Succeed By Making Life More Difficult For Users

from the this-will-not-work dept

Well, look at that. Last week it was just a silly suggestion from some netheads, and now come reports that Rupert Murdoch is at least in the early stages of considering opting out of Google, with Microsoft paying it to be "exclusive" on Bing. Apparently, Microsoft has actually approached a few publications about doing similar deals. It's no surprise that Microsoft and Murdoch would explore this. Microsoft has experimented for years with programs to bribe people to use its search engine over Google's -- but it hasn't done much to help. Meanwhile, Murdoch continues to not actually understand how the internet or copyright law works, and has some oddly misplaced dislike for Google (despite the fact that Google alone is pretty much what kept Murdoch-owned MySpace alive for years, and Murdoch owns a bunch of sites that aggregate info just like Google).

Still, if this does go forward, it will signal incredibly short-sighted thinking on the parts of everyone who participates. The initial reaction would be significantly less traffic to any site that agrees to participate, considering that Google still drives a ton of traffic to most major sites. Simply giving that up for a chunk of cash is a very risky proposition. Second, in factionalizing the web, it harms everyone. No one wants to have to think about which sites are included in which search engine, and if the battle begins in earnest, then you have a situation where you end up in an inevitable stalemate, with certain sites in Google's search engine, but not in Microsoft's, and others in just Microsoft's but not Google's -- and no one wins. Third, the cost of this program to a company like Microsoft to make it meaningful is huge. It's much bigger than the numbers that were being tossed out before. Finally, all this would really do is open up new opportunities for one of three things (or a combination) to happen (1) a new meta search engine shows up that aggregates both Microsoft and Google results (2) technology hacks that will allow you to combine the two results in one or (3) Google realizes that it has copyright law fair use on its site and keeps indexing sites anyways. I'm not sure Google would take that last step, but if things go nuclear, it might make the most sense.

But the key thing is that none of this does anything to help users. And that's the problem. It's not adding even the tiniest sliver of additional benefit to users. And these days, that's a strategic error. If your business is focused on making life more difficult for a competitor, rather than adding more value to users, you're doing the wrong thing. Microsoft and News Corp. should be trying to provide more value to users, and instead, they seem to be plotting ways to make consumers' lives more annoying and more difficult. They may think that's smart, but in the long term, such strategies always backfire.

Filed Under: bribes, search
Companies: microsoft, news corp.

Would Top Sites Really Opt-Out Of Google Based On A Microsoft Bribe?

from the doubtful dept

Every so often, internet pontificators try to come up with ways to "kill Google." It's a silly game, but in an oddly timed move, three people (who have all put forth "how to kill Google" ideas in the past) all suddenly published similar ideas, yet again. Jason Calacanis, Mark Cuban and Tom Foremski all posted similar ideas about how certain sites (such as the top sites in the top search results) could all choose to opt-out of Google and, say, join another search engine like Bing. It's one of those ideas that sounds good for about 5 seconds. And then you actually think about it. First, the numbers being tossed around concerning how much it would cost, say, Microsoft, to convince most of these sites to opt-out of their number one driver of traffic is significantly higher than what's being mentioned in these articles. Many of these sites rely on Google traffic to make a ton of money, and they're not going to throw that away easily. At least in Calacanis' plan he suggests Microsoft offer "50% more than they make in Google referrals" which certainly beats Cuban's idea that many sites would opt-out of Google for $1,000.

Here's the thing, though. Most of those sites worked hard to get to the top of Google for a very good reason: they understand the value of being easily findable. As such, they also recognize that it makes little sense to make themselves less findable at almost any price. Getting anyone to opt-out first (other than suicidal sites like Rupert Murdoch's News Corp.) is going to be nearly impossible. Who would want to risk that? Because the instant they opt-out, someone else would take their place. Quickly. And decisively.

There's value in being found these days, and to be found you need to be easily findable from anywhere if someone's looking for you. Not only would traffic decrease, but so would basic reputation. Even if Microsoft pays you a ton to drop out of Google, people are going to search for your business in Google and when they can't find it, they're not going to care how much Microsoft paid, they're going to think you're a small-time nobody. The best strategy these days, as most web site operators know, is to be as widely available as possible. Opt-ing out of Google because someone pays you some money is a lot more costly than just the lack of traffic.

Filed Under: bribes, news, opt-out, search
Companies: google, microsoft