8 ms·

Dozens of Al Jazeera journalists allegedly hacked using NSO Group spyware

111 points by aleksei 6y ago

joemazerino 6y ago
Journalists can't seem to keep up with the latest threat model material. I'm wondering if a resource for journalist training is a good idea considering the resources stacked against them.
- 0_____0 6y ago
  More of a failing of AJ's IT dept than anything else. Not sure if they were using AJ issued devices but they should be on managed devices that get updated on schedule, which may have mitigated this attack. Journos aren't necessarily deeply technical folks, that's really not their core competency.
  - fakedang 6y ago
    When you work in a sensitive environment such as the middle east as a journalist, one really needs to go overboard and keep an insulated protection layer - separate devices, clean contacts, Tor and VPN, the whole gamut. It is the journalist's responsibility in such environments to ensure their survival and make sure that they don't engage in something stupid. I presume AJ, just like the others, tends to use a lot of freelancers - in fact, they pay out some of the highest commissions to freelancers. Most freelancers are responsible for their own lives.
    - Throwaway1771 6y ago
      Everyone is.
  - filmgirlcw 6y ago
    Read the details on this attack. They were running the latest software. I wouldn’t be surprised if the devices were managed in some way too. It doesn’t matter. This highly-targeted attack couldn’t be mitigated and that’s exactly the point.
    - 0_____0 6y ago
      ??? From TFA? > Researchers at Citizen Lab said the apparent malicious code they discovered, which they claim is used by clients of Israel’s NSO Group, made “almost all” iPhone devices vulnerable if users were using an operating system that pre-dated Apple’s iOS 14 system, which appears to have fixed the vulnerability. Edit: and that's almost not relevant to my point - what I'm saying is that journalists aren't inherently technical people, and that the work of reading reports on the latest exploits and vulnerabilities and developing countermeasures should probably go to someone else in their org
      - filmgirlcw 6y ago
        And my point is that with this attack, that wouldn’t matter. The exploit was state-sponsored and specifically targeted and was going after even up to date (at the time) devices. Citizen Lab was only able to glean as much information as it was in one case because the journalist reached out 7 months before he was hacked and they gave him a VPN they could use to monitor his traffic logs. The journalist was a key part of figuring this out, which goes against your entire point that the IT department would have caught this. They wouldn’t have and they didn’t. This isn’t a scenario where you can blame lack of information or talk about who is or is not inherently technical. It was state-sponsored targeted hacking.
    - deleted 6y ago
      [deleted]
- filmgirlcw 6y ago
  Many journalists who are frequently engaging in conversations that would be deemed highly sensitive are keeping up with the latest thread model material and following best security practice, moreover, the circumstances we know in this case make me question if any individual outside of the most security paranoid, could have prevented being hacked in this way. This was an iOS 0-day that appears to have targeted iMessage [1] and worked via zero-click, meaning user interaction wasn’t necessary. CitizenLabs says that in one case, the initial vector appears to be Apple’s own servers. So you’ve got people with modern (if not the latest) phones running the latest software on what is considered to be the most secure mobile operating system and you have highly-targeted attacks that appear to be state-sponsored, with high precision, going after these individuals. What could education do to help in this case? Literally every single person I know, and this includes some extremely sophisticated security experts, would have been victims here too. In the abstract, I agree with more training — though I’ll offer that these resources are widely available already in many newsrooms — but in this case, it would have done nothing. [1]: https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...
dessant 6y ago
Why are companies that stockpile zero-days for resale legal? Aren't they also a threat to the countries that host them, even if some or all of the intelligence is shared? And why aren't countries that host these companies sanctioned?
- fortran77 6y ago
  NSO is owned by a European company Novalpina Capital with headquarters in London.
  - dessant 6y ago
    My original comment asked if we should assume that the NSO Group arsenal is shared with the Israeli Intelligence Community, given that we've talking about an Israeli company. That's a valid question, because hosting such a company is a major diplomatic liability. Why would you consider this question, as you said, a slander?
    - fortran77 6y ago
      But they are not an "Israeli Company". They are owned by a European Private Equity group, with HQ in London, despite what the Guardian's "reporter" "Jassar Al-Tahat" says. Should we assume that comments and logs for Hacker News are all shared with the UK Intelligence Community because Paul Graham was born in Weymouth, UK?
      - av3csr 6y ago
        Technically the joint venture between Novalpina Capital and two of the original founders have a majority stake on the company. Is ARM a Japanese company because it's (currently) owned by SoftBank? Will it be American when Nvidia takes over? Or are they a British company because they are based in the UK?
      - dessant 6y ago
        > But they are not an "Israeli Company". They are owned by a European Private Equity group, with HQ in London, despite what the Guardian's "reporter" "Jassar Al-Tahat" says. Yes, Novalpina Capital purchased a majority stake in NSO Group in February 2019. NSO Group was and still is an Israeli company, with headquesters in Herzliya, Israel. The company will cease to be an Israeli company, when it stops being under the jurisdiction of Israel. Again, I don't understand how any of this made my question a slander. And why are you mocking the author of the article? > Should we assume that comments and logs for Hacker News are all shared with the UK Intelligence Community because Paul Graham was born in Weymouth, UK? HN and Paul Graham are not in the weapons trade business, but yes, you should assume that all of this is monitored, though not because of Paul Graham's place of birth.
1cvmask 6y ago
Journalists as messengers have always been targeted, and even killed, and it seems that Apple’s messaging system was the attack vector here. While the article decries NSO for being nefarious and selling to suspect “authoritarian” countries, high schools here in our democratic US have been buying hacking solutions to spy on students: https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tech-that-the-fbi-1845862393 https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tec...
primroot 6y ago
Less than a decade ago NSO Group assisted the then president of Panama, Ricardo Martinelli, in spying his political adversaries. Around the same time Martinelli requested similar assistance from the US, but they refused his request (according to Wikileaks).
DSingularity 6y ago
Join NSO! Protect your favorite colonial interests without the stigma of working for big tech!

111 points by aleksei 6y ago

Journalists can't seem to keep up with the latest threat model material. I'm wondering if a resource for journalist training is a good idea considering the resources stacked against them.

0_____0 6y ago
More of a failing of AJ's IT dept than anything else. Not sure if they were using AJ issued devices but they should be on managed devices that get updated on schedule, which may have mitigated this attack. Journos aren't necessarily deeply technical folks, that's really not their core competency.
- fakedang 6y ago
  When you work in a sensitive environment such as the middle east as a journalist, one really needs to go overboard and keep an insulated protection layer - separate devices, clean contacts, Tor and VPN, the whole gamut. It is the journalist's responsibility in such environments to ensure their survival and make sure that they don't engage in something stupid. I presume AJ, just like the others, tends to use a lot of freelancers - in fact, they pay out some of the highest commissions to freelancers. Most freelancers are responsible for their own lives.
  - Throwaway1771 6y ago
    Everyone is.
- filmgirlcw 6y ago
  Read the details on this attack. They were running the latest software. I wouldn’t be surprised if the devices were managed in some way too. It doesn’t matter. This highly-targeted attack couldn’t be mitigated and that’s exactly the point.
  - 0_____0 6y ago
    ??? From TFA? > Researchers at Citizen Lab said the apparent malicious code they discovered, which they claim is used by clients of Israel’s NSO Group, made “almost all” iPhone devices vulnerable if users were using an operating system that pre-dated Apple’s iOS 14 system, which appears to have fixed the vulnerability. Edit: and that's almost not relevant to my point - what I'm saying is that journalists aren't inherently technical people, and that the work of reading reports on the latest exploits and vulnerabilities and developing countermeasures should probably go to someone else in their org
    - filmgirlcw 6y ago
      And my point is that with this attack, that wouldn’t matter. The exploit was state-sponsored and specifically targeted and was going after even up to date (at the time) devices. Citizen Lab was only able to glean as much information as it was in one case because the journalist reached out 7 months before he was hacked and they gave him a VPN they could use to monitor his traffic logs. The journalist was a key part of figuring this out, which goes against your entire point that the IT department would have caught this. They wouldn’t have and they didn’t. This isn’t a scenario where you can blame lack of information or talk about who is or is not inherently technical. It was state-sponsored targeted hacking.
  - deleted 6y ago
    [deleted]
filmgirlcw 6y ago
Many journalists who are frequently engaging in conversations that would be deemed highly sensitive are keeping up with the latest thread model material and following best security practice, moreover, the circumstances we know in this case make me question if any individual outside of the most security paranoid, could have prevented being hacked in this way. This was an iOS 0-day that appears to have targeted iMessage [1] and worked via zero-click, meaning user interaction wasn’t necessary. CitizenLabs says that in one case, the initial vector appears to be Apple’s own servers. So you’ve got people with modern (if not the latest) phones running the latest software on what is considered to be the most secure mobile operating system and you have highly-targeted attacks that appear to be state-sponsored, with high precision, going after these individuals. What could education do to help in this case? Literally every single person I know, and this includes some extremely sophisticated security experts, would have been victims here too. In the abstract, I agree with more training — though I’ll offer that these resources are widely available already in many newsrooms — but in this case, it would have done nothing. [1]: https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

dessant 6y ago

Why are companies that stockpile zero-days for resale legal? Aren't they also a threat to the countries that host them, even if some or all of the intelligence is shared? And why aren't countries that host these companies sanctioned?

fortran77 6y ago
NSO is owned by a European company Novalpina Capital with headquarters in London.
- dessant 6y ago
  My original comment asked if we should assume that the NSO Group arsenal is shared with the Israeli Intelligence Community, given that we've talking about an Israeli company. That's a valid question, because hosting such a company is a major diplomatic liability. Why would you consider this question, as you said, a slander?
  - fortran77 6y ago
    But they are not an "Israeli Company". They are owned by a European Private Equity group, with HQ in London, despite what the Guardian's "reporter" "Jassar Al-Tahat" says. Should we assume that comments and logs for Hacker News are all shared with the UK Intelligence Community because Paul Graham was born in Weymouth, UK?
    - av3csr 6y ago
      Technically the joint venture between Novalpina Capital and two of the original founders have a majority stake on the company. Is ARM a Japanese company because it's (currently) owned by SoftBank? Will it be American when Nvidia takes over? Or are they a British company because they are based in the UK?
    - dessant 6y ago
      > But they are not an "Israeli Company". They are owned by a European Private Equity group, with HQ in London, despite what the Guardian's "reporter" "Jassar Al-Tahat" says. Yes, Novalpina Capital purchased a majority stake in NSO Group in February 2019. NSO Group was and still is an Israeli company, with headquesters in Herzliya, Israel. The company will cease to be an Israeli company, when it stops being under the jurisdiction of Israel. Again, I don't understand how any of this made my question a slander. And why are you mocking the author of the article? > Should we assume that comments and logs for Hacker News are all shared with the UK Intelligence Community because Paul Graham was born in Weymouth, UK? HN and Paul Graham are not in the weapons trade business, but yes, you should assume that all of this is monitored, though not because of Paul Graham's place of birth.

1cvmask 6y ago

Journalists as messengers have always been targeted, and even killed, and it seems that Apple’s messaging system was the attack vector here. While the article decries NSO for being nefarious and selling to suspect “authoritarian” countries, high schools here in our democratic US have been buying hacking solutions to spy on students: https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tech-that-the-fbi-1845862393 https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tec...

primroot 6y ago

Less than a decade ago NSO Group assisted the then president of Panama, Ricardo Martinelli, in spying his political adversaries. Around the same time Martinelli requested similar assistance from the US, but they refused his request (according to Wikileaks).

DSingularity 6y ago

Join NSO! Protect your favorite colonial interests without the stigma of working for big tech!