21 ms·

CatalanGate: Spyware operation against Catalans using Pegasus and Candiru

367 points by jonbraun 4y ago

bigDinosaur 4y ago
Where's that quote about how Spain always seems to be close to collapse, but still somehow keeps going? For a variety of reasons I am often surprised that Spain hasn't turned into a Swiss style federation, at the very least (i.e. with the Federal government almost being powerless). Madrid seems to be the only area that actually wants (or wanted) the state to be as it is.
- franciscop 4y ago
  Spaniard here, I don't believe a federation-like would work here. Historically the more independence/leeway that has been given to Catalonia, the stronger it has snowballed into more separatism (e.g. when allowed to have somewhat different media, education, etc. that was turned to teach the younger generations that Catalonia is a different culture and not belonging to Spain, which in turn ...). TBH I do not know what the solution is here, I'd like to see a unified country, but I can see how both the left and right politic parties are destroying it (one with lies/doctrinism, other with oppression/treating them like they are still 3rd party) and makes me sad. When visiting Barcelona, Spanish is often the 3rd language, after the Catalan (for Catalonian and the rest of Spain) and English (for tourists). Edit: look at the numbers, it's scary how in a single generation a whole region has gone from 90%+ wanting to be united to 50%+ wanting independence, specially during a "peace" era: https://en.wikipedia.org/wiki/Catalan_independence_movement#Recent_Pro-independence_vote_evolution https://en.wikipedia.org/wiki/Catalan_independence_movement#...
  - inglor_cz 4y ago
    The Basques got the right to manage their own finances and it seems to have quelled the independence push. Financial autonomy also helped to rein in separatists in South Tirol, a German-speaking region of Italy. Maybe the same should be extended to the Catalans.
    - franciscop 4y ago
      The Basques got their most extreme terrorists put into Jail after decades of blowing up people, which you could also argue might have helped quelling their independence push as well... Luckily I'm too young to remember, but I do know older people talking about ETA with fear and me thinking they were overblowing it, until I stumbled upon the wikipedia article with all they did and holy cow when I looked at the list of the 2000s: https://en.wikipedia.org/wiki/List_of_ETA_attacks#2000%E2%80%932011 https://en.wikipedia.org/wiki/List_of_ETA_attacks#2000%E2%80...
  - deleted 4y ago
    [deleted]
  - ipaddr 4y ago
    This sounds crazy but why not let go and allow them to decide their own fate?
    - capableweb 4y ago
      To prevailing reasoning for not letting Catalunya decide that without involving the rest of Spain seems to be because Catalunya is one of the biggest contributor to the overall economy of Spain, so if Catalunya leaves Spain, it'll impact the entire country, not just Catalunya itself.
      - scns 4y ago
        This. Same as in belgium. The part with lots of industry wants independence, the part without does not want them to leave.
      - zozbot234 4y ago
        They are wealthy because they have high-quality policy-making and a less corrupt government than the other autonomous communities. Other parts of Spain could engage in reform efforts of their own and contribute just as much to the government budget. Why should this be an argument against Catalunya?
        capableweb 4y ago
        > Why should this be an argument against Catalunya? I have no stake in either outcome of independence happening or not, but I can definitely understand that some people can see it as problematic if one part of a bigger thing wants to leave without considering the other parts. I still think Catalunya should be able to decide themselves, just like the UK decided themselves if they wanna leave the EU. Forcing states to belong to other states is something I thought we left behind a long time ago.
        the_gipsy 4y ago
  - mdp2021 4y ago
    > I'd like to see a unified country Careful 'what you wish. You want options. If all your rooms get painted green but your colour is white...
    - mdp2021 4y ago
      Will the pestiferous snipers glance, in these days of news reporting "Victims of war rape have no right to abortion in refuge Country", at the flow of "This about to be illegal in this State" in the past few years within a most prominent federation... There is no "love it or leave it" if there is no "leave it". Existence should not be a bed of Procuste - least you accept that /I/ take the measures and /you/ submit to them. Surely there will be some place where "debate" is not different from "pooling", and they will be as comfortable there as we find it a buggery.
  - melenaboija 4y ago
    > When visiting Barcelona, Spanish is often the 3rd language Non separatist Catalan here and I can say this is complete BS. There is no doubt that there is more people in Catalunya that doesn't know Catalan than Spanish. I have been raised in a family that has been speaking Catalan for many generations and everybody now is almost bilingual with Spanish. And oh hell if I wish that English was the second language there. Tired of this propaganda that only causes more pain and exalts nationalist feelings in both sides.
    - the_gipsy 4y ago
      It's not bullshit. It is the 3rd language, in a synthetic effort from the local government. You could say that this is not bad, ok. But you can't deny it.
      - melenaboija 4y ago
        Is not BS it is a synthetic effort from the government? Lol. Go there and experience it yourself and try to create an objective opinion from it. Another fact, most of the first generation immigrants will learn Spanish way earlier than Catalan, if they ever learn Catalan at all. And I am not saying this is bad, as for practical reasons they will obviously learn the 4th most spoken language in the world before learning a language that is spoken by 7 million people. Besides they know that with Spanish they can communicate with everybody, which is not the case with Catalan. More rigor and an independent point of view from politicians and media is needed if there is a real will to solve the issue.
        the_gipsy 4y ago
        I've lived there for a decade.
        lynguist 4y ago
        Catalan is spoken by 9.2 million people in Spain, Andorra, France, Italy (one town in Sardinia).
  - logicchains 4y ago
    >TBH I do not know what the solution is here, I'd like to see a unified country, but I can see how both the left and right politic parties are destroying it (one with lies/doctrinism, other with oppression/treating them like they are still 3rd party) and makes me sad. When visiting Barcelona, Spanish is often the 3rd language, after the Catalan (for Catalonian and the rest of Spain) and English (for tourists). What's wrong with having separate countries? Would Canadians be better off if they were part of America? I don't understand westerners who cheer for independence in places like Xinjiang and Tibet but steadfastly oppose the idea when any region of their own country wants to be independent.
    - deleted 4y ago
      [deleted]
    - mikem170 4y ago
      Agreed! There's the theory that people don't willingly aggregate into large countries, they need to be manipulated or coerced (pledge every day in school, anthem at sports events, etc), and that large countries inevitably become bullies, unable to restrain themselves from dominating the weak. The book Breakdown of Nations by Leopold Khor talks about this. He talks about the idea of dividing into smaller political units to fix our problems. He makes a lot of sense. There's a video summarizing the book [0]. [0] https://www.youtube.com/watch?v=gaszpQaNwAU https://www.youtube.com/watch?v=gaszpQaNwAU
  - armadillu 4y ago
    > Historically the more independence/leeway that has been given to Catalonia, the stronger it has snowballed into more separatism Maybe this is what happens when you try strangle a nation and its culture, but you fail to do it entirely. Catalonia was conquered by force, and luckily its language and culture survived along the centuries (despite all attempts). You can't invade a region, enforce your language and culture and expect it to magically become yours. Look at what happened to all the other (former) Spanish colonies, how many of them fought for their independence (and won it)? > TBH I do not know what the solution is here, I'd like to see a unified country You would like a "united country", but this will prove difficult, as there is no such thing. Spain is just Castille and a bunch of other regions conquered by force – with more or less success at assimilating them into the Castilian culture over time. Some went along, some do not feel like they belong, some feel entirely mistreated but got an ok tax deal with enough leeway, and some just had enough altogether. Many Catalans (me included) don't want to be part of Spain, and I doubt this will change any time soon. Especially on those who witnessed what happened during our attempt at a peaceful referendum in 2017. The speech the King of Spain gave after citizens where beaten for trying to cast a vote(!) is a great example. The silence of the non-catalans whilst the beating was happening another one. The former King doings, his fleeing out of the country with total impunity, and how the farce of a judicial system treated the whole thing, one more for the list. There's a certain "way of doing" embedded deep into Spain, that I fear will never go away ("atado y bien atado"). There's only one solution and it's what Catalonia has been asking for all along. Allow a fair referendum, where the repercussions of both options (stay and secede) are explained clearly to the population, and let the people decide. It seems inconceivable to me that a proper referendum about this ongoing issue is not allowed, especially in a supposedly democratic country like Spain. I could see Spain and Catalonia being good allies within the EU; but as it is setup now, the relationship is just not working. And making it work "by force" will only stir more and more trouble. > it's scary how in a single generation a whole region has gone from 90%+ wanting to be united to 50%+ wanting independence, specially during a "peace" era I think you are confusing 90%+ "wanting to be united" for "not bothered enough to do anything about it". The end of the dictatorship (without consequences the fascist side btw) gave hope to a lot of people, and attempts were made to "make it work" despite all the terrible acts Catalonia suffered. As soon as it became obvious there was no way to decide our own future whilst inside Spain (see Estatut d'Autonomia 2006 https://en.wikipedia.org/wiki/Statute_of_Autonomy_of_Catalonia_of_2006 https://en.wikipedia.org/wiki/Statute_of_Autonomy_of_Catalon...), it was clear that it was all a farce. Anti-Catalanism (https://en.wikipedia.org/wiki/Anti-Catalanism https://en.wikipedia.org/wiki/Anti-Catalanism) and other attitudes / reactions from many parts of Spain towards Catalonia lead to this. It is way too easy for political parties to get votes around Spain by stirring anger towards Catalonia... I think most catalans would be happy remaining in Spain if their language, culture, traditions and pockets were respected. But that's just not what Spain wants Catalonia for.
- inglor_cz 4y ago
  „I am firmly convinced that Spain is the strongest country of the world. Century after century trying to destroy herself and still no success.“ Source: https://quotepark.com/quotes/1886698-otto-von-bismarck-i-am-firmly-convinced-that-spain-is-the-strongest/ https://quotepark.com/quotes/1886698-otto-von-bismarck-i-am-...
  - AshamedCaptain 4y ago
    There is also a nice quote from when, after a period of chaos in the late 19th century, Spaniards democratically chose to bring in a foreign King to govern them (sorry if I got this wrong -- https://en.wikipedia.org/wiki/Amadeo_I_of_Spain https://en.wikipedia.org/wiki/Amadeo_I_of_Spain ). In a short two years, Amadeo ended up fleeing the country claiming Spain to be simply ungovernable; and that the most dangerous enemies of Spain where the Spaniards themselves.
- ricardobayes 4y ago
  - AlotOfReading 4y ago
    Catalonia has been trying to secede for longer than Russia has existed in its current form. It may well be that Russia is funding separatist campaigns like they've done in many regions, but there's a genuine desire for independence regardless of Russian activities.
  - smcl 4y ago
    It's kinda funny to see vague speculation of nefarious Russian involvement in the pro-independence side when we're discussing a very concrete case of espionage in the anti-independence side. The implication - and we see it sometimes in Scottish independence too - is that the separatist side is radical and sinister. And that the robust support the movement has is simply a mirage, artificially inflated by a foreign government who wishes to do harm.
  - pvaldes 4y ago
    Is a known fact that Russian farms played a huge role in the flooding of fake news supporting Catalonia secession movement and tagging Spain as evil 24 hours a day. You can spot some patterns here also. But there are other actors. Politicians used this card for decades as leverage to obtain more and more power and to divert the focus from their own corruption
    - ricardobayes 4y ago
      It doesn't help that Spain has notoriously bad PR in anglo-saxon countries due to the black legend https://en.wikipedia.org/wiki/Black_Legend_(Spain) https://en.wikipedia.org/wiki/Black_Legend_(Spain)
- cycomanic 4y ago
  I was very surprised how little education there is amongst Spaniards about the Franco area, how this plays a significant role in the catalonian independence desires. Also how little processing of the Franco regime there was (compared to Germany), I mean the last Franco statue was removed only last year.
  - the_gipsy 4y ago
    La transición was way too soft, out of fear of a coup d'etat. Decades later and we still suffer the consequences of that fear.
    - permalac 4y ago
      Like just rebranding their fascist tribunal? In the same building with the same people, but one day they become Democrats. Amazing story. Also, they have a tribunal that has two powers, and another one that decides if money has been well spent, if they decide otherwise you get to pay with your properties. Amazing country, and is part of EU.
medell 4y ago
Check out The Silence of Others (2018) on Netflix, produced by Almodovar for more background on the Franco atrocities and how it still is echoing today.
marcodiego 4y ago
Candiru is the name of an amazonian species of fish with a history of anecdotes of entering the human urethra sometimes requiring amputation of genitals.
- sofixa 4y ago
  That's a very apt name, kudos to whoever came up with it.
  - randomhodler84 4y ago
    No kudos but curses. A thousand curses on them. A disgusting fish, a disgusting software and a disgusting developer. This is something that hurts people. Do not celebrate it.
    - nix23 4y ago
      I can celebrate any fish i want! It's a free country...at least on my side.
- matheusmoreira 4y ago
  Amazing name for such an insidious malware.
  - pvaldes 4y ago
    I would appreciate more info about what the software does for the non tech
capableweb 4y ago
Seems random developers were targeted as well as European Parliament members (and more): > Jordi Baylina is the technology lead at Polygon, a popular decentralised Ethereum scaling platform. He is also an advisor on projects related to digital voting and decentralisation, and has built a widely-used privacy toolkit. He was extensively targeted with Pegasus, receiving at least 26 infection attempts. Ultimately, he was infected at least eight times between October 2019 and July 2020. > Baylina received a text message masquerading as a boarding pass link for a Swiss International Air Lines flight he had purchased. Targeting in this case indicates that the Pegasus operator may have had access to Baylina’s Passenger Name Record (PNR) or other information collected from the carrier. Scare stuff that not just random text messages can infect you (we knew this) but combined with harvesting other data (like PNR), they can time to exploit messages with other actions you do (like buying an flight ticket) and get you that way. I was scared of receiving random text messages already, but easy to just ignore them as they have nothing to do with me. But if I buy a flight ticket and receive a text message that looks relevant to me, I'm not sure I'd be able to guess it was actually malicious. Scary stuff. Edit: The more I read, the worse it gets: > Another common mode of targeting was to masquerade as official notifications from Spanish government entities, including the Tax and Social Security authorities.The messages also used SMS Sender IDs to masquerade as official agency accounts. > Notably, fake official messages were sometimes highly personalized. For example, a message sent to Jordi Baylina included a portion of his actual official tax identification number, suggesting that the Pegasus operator had access to this information. Seems clear at this point that the official Spanish government was behind these attacks, or the official registries got hacked (together with various delivery companies). Both are bad, but that signs are pointing to the earlier makes it even worse. It seems that the Spanish government can't help itself to give more fuel to the fire that is the fight for Catalan independence. Who'd want to belong to a state that constantly suppresses and surveillance you?
- ricardobayes 4y ago
  - deleted 4y ago
    [deleted]
pluc 4y ago
https://twitter.com/RonDeibert/status/1516011319719247873 https://twitter.com/RonDeibert/status/1516011319719247873 https://twitter.com/citizenlab/status/1516016174559121409 https://twitter.com/citizenlab/status/1516016174559121409
88840-8855 4y ago
I really never got the Catalonia crisis, especially around 2017, 2018. A region of approx. 8 million Catalonias who see themselves as Catalonians first and as Spanish second, with their own distinct history, vote with over 80% for their indipendence from Spain. People representing the interests of Catalonians go to the Spanish parlament, explain their goal of indipendence. And then stuff happens that I only read from bad China and bad Russia. Those political leaders are arrested. Police is sent in to stop the protests. Protests are suddenly called "the rebellion", people are arrested, the representatives of the indipendance movement have to flee Spain. Later it comes out that the police was seizing ballet boxes during the election. Spain then acts hard on the region, holds a gun against the head of many businesses located in the Catalonian region so they have to move out from there. So much more bad stuff has happened around that. I am just wondering - where is the outcry? I cannot stop overseeing the paralls to other conflicts around the world, very hot conflicts.
- zozbot234 4y ago
  - amackera 4y ago
    Minus the whole slavery thing, no?
    - McWobbleston 4y ago
      Yes, because Catalonia was resisting the fascist coup with their own revolutionary struggle to collectivize agriculture based on consent of the farmers, and worker ownership led by the labor unions who had been providing education and other community services for years. Its a lesser known fact that George Orwell wrote a book on his experiences there, and that the people's struggle inspired him so much he took up arms and joined them. The guy who's work people claim is an indictment of socialism, fought for it against the rise of fascism.
      - tough 4y ago
mercy_dude 4y ago
All these spyware incidents by nation states prove one thing: how fickle the so called rule of law is in much of the western democracy. In fact west has increasingly become de facto kleptocracy with media and nation state security apparatus actively seeking ways to maintain and grow the power for the national elites leaving them unchecked.
- antattack 4y ago
  Is there something better? Seems like pendulum swings the opposite way once it reaches western democracy.
- twoneurons 4y ago
  Too many bureaucrats and public servants are more occupied with growing their own power and protecting their space, than serving the public interest.
  - EricE 4y ago
    Welcome to human nature. One of the reasons anyone who thinks socialism is a realistic strategy just is't with reality.
- sbarre 4y ago
  I mean, this was all happening before too, we just had less visibility into it. If you think that the governments of 'western democracies' weren't spying on their own citizens or going against their own laws - even in collaboration with private interests - before the advent of the Internet and spyware/malware, I've got bad news for you.
  - colpabar 4y ago
    Sure, but even now with the greater visibility we have, these claims are never taken seriously en masse. One group would call you a traitor, and another would call you a conspiracy theorist. I do not have a solution, but I'd just like to point out that if someone on HN makes a comment like the one GP did, they 100% understand that this isn't "new". I also don't think we should just accept this as a part of life because "it was all happening before", because the level of spying the internet has enabled is orders of magnitude worse than it was without it. We should be afraid and upset.
lgl 4y ago
This seems like a good time to remember when an (apparently solo) spanish speaking hacker completely owned Hacking Team's (italian company that sells spyware to governments and that was mentioned/used in this post/attack) network and then detailed all the steps in what is still a really fascinating read. [0] The sysadmin's password was, wait for it... P4ssword [0] https://pastebin.com/kHUzWWm9 https://pastebin.com/kHUzWWm9
shmatt 4y ago
I see something very positive in this news - it looks like Apple and other companies have successfully blocked most if not all of Pegasus' 0-click exploits The true scary portion of this world is not even being sent an SMS/clicking a dangerous link, for a while people were getting infected without ever clicking anything To me the most interesting leak/investigation that can come out of NSO is what happens once a 0-day is patched, is there downtime? do customers need to wait for a software update? is there automatic rotation of exploits?
- onionisafruit 4y ago
  I wondered about how they manage their exploits too. Presumably they are constantly developing new exploits. I would guess that if they have a live 0-click that is working reliably they sit on the others until the current exploit is no longer effective. I doubt NSO considers their customers fully trustworthy. So they probably check every prerelease of ios and android for patches and ship the next exploit to customers only when a current exploit is being patched.
- badRNG 4y ago
  > To me the most interesting leak/investigation that can come out of NSO is what happens once a 0-day is patched, is there downtime? do customers need to wait for a software update? is there automatic rotation of exploits? I'd have to think NSO Group has the finances to bank at least a few 0-click, zero-days. It seems that the price of such vulnerabilities is increasing however. Zerodium, a large zero-day broker, is paying up to 2.5 million USD for 0-click Android and 2 million USD for iOS: https://zerodium.com/program.html https://zerodium.com/program.html
  - EricE 4y ago
    It still boggles my mind that input sanitization/validation hasn't gotten a formal discipline around it. It's boring and tedious, yet crucial.
deleted 4y ago
[deleted]
denton-scratch 4y ago
- wswope 4y ago
  You sure you know where France and Spain are on a map? Seems like you’re mixing them up.
  - denton-scratch 4y ago
    Gosh, I've been to both Catalunya and Pays Basque. I've lived in France. Catalunya is on Spain's south coast. North of Catalunya is Pays Basque, which also adjoins the pyrenees to the east. The north-east portion of Spain is the Pays Basque, not Catalunya. You can certainly get further south than Catalunya; but only by going west or getting on a boat. Catalunya is the southern portion of eastern Spain; it is therefore south-east, not north-east.
    - s1artibartfast 4y ago
      >I've lived in France. Where do you think the north east-corner of France is? Hauts-de-France or Grand Est? https://en.wikipedia.org/wiki/Regions_of_France https://en.wikipedia.org/wiki/Regions_of_France
      - denton-scratch 4y ago
        I've lived in France; but I haven't lived everywhere in France. And I'm certainly not French. I'll assume goodwill, although you've thrown me a trick question; so my answer is that France doesn't have a northeast "corner". Looking at that wikipedia map, I'd say they're both in the northeast, but neither is in the corner (Belgium is).
    - wswope 4y ago
      Looking at the most charitable map projection I can find, I see where you’re coming from - but I think most people would still call it the NE corner. ¯\_(ツ)_/¯ https://1igc0ojossa412h1e3ek8d1w-wpengine.netdna-ssl.com/wp-content/uploads/2018/03/TMS412.jpg https://1igc0ojossa412h1e3ek8d1w-wpengine.netdna-ssl.com/wp-...
aborsy 4y ago
CEOs, executives, members of parliaments, journalists, researchers at industrial labs, those working in defense/military, etc are at elevated risk of being hacked by governments and hacking companies such as NSO. I wonder how these people protect their digital assets? Are there guidelines? For example, if I am Microsoft CEO, would it be okay if I use the closed source iPhone from a competing company? Or perhaps these people use special hardened devices? Because even Apple CEO uses iPhone, and Pegasus apparently could hack any iPhone with zero click. So what prevents acquisition of highly valuable inside information by NSO or its customers (sensitive data about the company, iOS source code, implanting malware by infecting Apple engineers for the next exploit, etc)?
- Barrin92 4y ago
  > So what prevents acquisition of highly valuable inside information by NSO or its customers Given the Bezos hack two years ago I think the answer to that question is actually, very little. Cisco and Blackberry for example used to provide hardened phones for executives but with the prominence of modern smartphones it seems like even CEOs of large companies are increasingly on insecure hardware.
- slim 4y ago
  If I was NSO, I would have a team who's sole purpose is to make sure they maintain access inside Apple, Google and Microsoft.
favourable 4y ago
I reverse engineered a sketchy link I got in an SMS. I opened up Tor Browser Bundle (with JS disabled), then went to a URL 'un-shortener' service[0]. Furthermore, I saw an interstitial page with a JavaScript payload in it, and it was all obfuscated and obviously coded to hide what it was doing. I could have gone further and unpacked the code, beautifying it to see what 0 day it was leveraging, but I didn't proceed further. Obviously, this was designed to take over my device. Luckily, my default browser on my phone is Firefox with JavaScript turned off, so it wouldn't have been able to execute if I did click on the link. [0] https://urlex.org/ https://urlex.org/
- dundarious 4y ago
  Javascript is absolutely not the only way these payloads can infect your device, so I wouldn't consider that particularly safe. Also, if you aren't on a phone or similar, you can just use curl to expand shortened URLS. Tell it follow redirects (-L) and print headers (-I), and use the last "location: " header it spits out. e.g., curl -fsSLI https://t.co/blahblah | sed -n 's/^location: //p'
  - dundarious 4y ago
    I know I'm replying to a 2 day old comment now, but I should add that I understand there may be a benefit to using a URL expanding service, in that the connection is not made from your host, so the various endpoints of your URLs won't see your IP address, etc. But the single URL expanding service will see all the URLs you expand and your IP address, etc., so you should trust it as much as any VPN service or ISP. That is to say, you should not trust it at all, until given numerous legal, technical, and reputational guarantees or assurances.

367 points by jonbraun 4y ago

Where's that quote about how Spain always seems to be close to collapse, but still somehow keeps going? For a variety of reasons I am often surprised that Spain hasn't turned into a Swiss style federation, at the very least (i.e. with the Federal government almost being powerless). Madrid seems to be the only area that actually wants (or wanted) the state to be as it is.

franciscop 4y ago
Spaniard here, I don't believe a federation-like would work here. Historically the more independence/leeway that has been given to Catalonia, the stronger it has snowballed into more separatism (e.g. when allowed to have somewhat different media, education, etc. that was turned to teach the younger generations that Catalonia is a different culture and not belonging to Spain, which in turn ...). TBH I do not know what the solution is here, I'd like to see a unified country, but I can see how both the left and right politic parties are destroying it (one with lies/doctrinism, other with oppression/treating them like they are still 3rd party) and makes me sad. When visiting Barcelona, Spanish is often the 3rd language, after the Catalan (for Catalonian and the rest of Spain) and English (for tourists). Edit: look at the numbers, it's scary how in a single generation a whole region has gone from 90%+ wanting to be united to 50%+ wanting independence, specially during a "peace" era: https://en.wikipedia.org/wiki/Catalan_independence_movement#Recent_Pro-independence_vote_evolution https://en.wikipedia.org/wiki/Catalan_independence_movement#...
- inglor_cz 4y ago
  The Basques got the right to manage their own finances and it seems to have quelled the independence push. Financial autonomy also helped to rein in separatists in South Tirol, a German-speaking region of Italy. Maybe the same should be extended to the Catalans.
  - franciscop 4y ago
    The Basques got their most extreme terrorists put into Jail after decades of blowing up people, which you could also argue might have helped quelling their independence push as well... Luckily I'm too young to remember, but I do know older people talking about ETA with fear and me thinking they were overblowing it, until I stumbled upon the wikipedia article with all they did and holy cow when I looked at the list of the 2000s: https://en.wikipedia.org/wiki/List_of_ETA_attacks#2000%E2%80%932011 https://en.wikipedia.org/wiki/List_of_ETA_attacks#2000%E2%80...
- deleted 4y ago
  [deleted]
- ipaddr 4y ago
  This sounds crazy but why not let go and allow them to decide their own fate?
  - capableweb 4y ago
    To prevailing reasoning for not letting Catalunya decide that without involving the rest of Spain seems to be because Catalunya is one of the biggest contributor to the overall economy of Spain, so if Catalunya leaves Spain, it'll impact the entire country, not just Catalunya itself.
    - scns 4y ago
      This. Same as in belgium. The part with lots of industry wants independence, the part without does not want them to leave.
    - zozbot234 4y ago
      They are wealthy because they have high-quality policy-making and a less corrupt government than the other autonomous communities. Other parts of Spain could engage in reform efforts of their own and contribute just as much to the government budget. Why should this be an argument against Catalunya?
      - capableweb 4y ago
        > Why should this be an argument against Catalunya? I have no stake in either outcome of independence happening or not, but I can definitely understand that some people can see it as problematic if one part of a bigger thing wants to leave without considering the other parts. I still think Catalunya should be able to decide themselves, just like the UK decided themselves if they wanna leave the EU. Forcing states to belong to other states is something I thought we left behind a long time ago.
      - the_gipsy 4y ago
- mdp2021 4y ago
  > I'd like to see a unified country Careful 'what you wish. You want options. If all your rooms get painted green but your colour is white...
  - mdp2021 4y ago
    Will the pestiferous snipers glance, in these days of news reporting "Victims of war rape have no right to abortion in refuge Country", at the flow of "This about to be illegal in this State" in the past few years within a most prominent federation... There is no "love it or leave it" if there is no "leave it". Existence should not be a bed of Procuste - least you accept that /I/ take the measures and /you/ submit to them. Surely there will be some place where "debate" is not different from "pooling", and they will be as comfortable there as we find it a buggery.
- melenaboija 4y ago
  > When visiting Barcelona, Spanish is often the 3rd language Non separatist Catalan here and I can say this is complete BS. There is no doubt that there is more people in Catalunya that doesn't know Catalan than Spanish. I have been raised in a family that has been speaking Catalan for many generations and everybody now is almost bilingual with Spanish. And oh hell if I wish that English was the second language there. Tired of this propaganda that only causes more pain and exalts nationalist feelings in both sides.
  - the_gipsy 4y ago
    It's not bullshit. It is the 3rd language, in a synthetic effort from the local government. You could say that this is not bad, ok. But you can't deny it.
    - melenaboija 4y ago
      Is not BS it is a synthetic effort from the government? Lol. Go there and experience it yourself and try to create an objective opinion from it. Another fact, most of the first generation immigrants will learn Spanish way earlier than Catalan, if they ever learn Catalan at all. And I am not saying this is bad, as for practical reasons they will obviously learn the 4th most spoken language in the world before learning a language that is spoken by 7 million people. Besides they know that with Spanish they can communicate with everybody, which is not the case with Catalan. More rigor and an independent point of view from politicians and media is needed if there is a real will to solve the issue.
      - the_gipsy 4y ago
        I've lived there for a decade.
      - lynguist 4y ago
        Catalan is spoken by 9.2 million people in Spain, Andorra, France, Italy (one town in Sardinia).
- logicchains 4y ago
  >TBH I do not know what the solution is here, I'd like to see a unified country, but I can see how both the left and right politic parties are destroying it (one with lies/doctrinism, other with oppression/treating them like they are still 3rd party) and makes me sad. When visiting Barcelona, Spanish is often the 3rd language, after the Catalan (for Catalonian and the rest of Spain) and English (for tourists). What's wrong with having separate countries? Would Canadians be better off if they were part of America? I don't understand westerners who cheer for independence in places like Xinjiang and Tibet but steadfastly oppose the idea when any region of their own country wants to be independent.
  - deleted 4y ago
    [deleted]
  - mikem170 4y ago
    Agreed! There's the theory that people don't willingly aggregate into large countries, they need to be manipulated or coerced (pledge every day in school, anthem at sports events, etc), and that large countries inevitably become bullies, unable to restrain themselves from dominating the weak. The book Breakdown of Nations by Leopold Khor talks about this. He talks about the idea of dividing into smaller political units to fix our problems. He makes a lot of sense. There's a video summarizing the book [0]. [0] https://www.youtube.com/watch?v=gaszpQaNwAU https://www.youtube.com/watch?v=gaszpQaNwAU
- armadillu 4y ago
  > Historically the more independence/leeway that has been given to Catalonia, the stronger it has snowballed into more separatism Maybe this is what happens when you try strangle a nation and its culture, but you fail to do it entirely. Catalonia was conquered by force, and luckily its language and culture survived along the centuries (despite all attempts). You can't invade a region, enforce your language and culture and expect it to magically become yours. Look at what happened to all the other (former) Spanish colonies, how many of them fought for their independence (and won it)? > TBH I do not know what the solution is here, I'd like to see a unified country You would like a "united country", but this will prove difficult, as there is no such thing. Spain is just Castille and a bunch of other regions conquered by force – with more or less success at assimilating them into the Castilian culture over time. Some went along, some do not feel like they belong, some feel entirely mistreated but got an ok tax deal with enough leeway, and some just had enough altogether. Many Catalans (me included) don't want to be part of Spain, and I doubt this will change any time soon. Especially on those who witnessed what happened during our attempt at a peaceful referendum in 2017. The speech the King of Spain gave after citizens where beaten for trying to cast a vote(!) is a great example. The silence of the non-catalans whilst the beating was happening another one. The former King doings, his fleeing out of the country with total impunity, and how the farce of a judicial system treated the whole thing, one more for the list. There's a certain "way of doing" embedded deep into Spain, that I fear will never go away ("atado y bien atado"). There's only one solution and it's what Catalonia has been asking for all along. Allow a fair referendum, where the repercussions of both options (stay and secede) are explained clearly to the population, and let the people decide. It seems inconceivable to me that a proper referendum about this ongoing issue is not allowed, especially in a supposedly democratic country like Spain. I could see Spain and Catalonia being good allies within the EU; but as it is setup now, the relationship is just not working. And making it work "by force" will only stir more and more trouble. > it's scary how in a single generation a whole region has gone from 90%+ wanting to be united to 50%+ wanting independence, specially during a "peace" era I think you are confusing 90%+ "wanting to be united" for "not bothered enough to do anything about it". The end of the dictatorship (without consequences the fascist side btw) gave hope to a lot of people, and attempts were made to "make it work" despite all the terrible acts Catalonia suffered. As soon as it became obvious there was no way to decide our own future whilst inside Spain (see Estatut d'Autonomia 2006 https://en.wikipedia.org/wiki/Statute_of_Autonomy_of_Catalonia_of_2006 https://en.wikipedia.org/wiki/Statute_of_Autonomy_of_Catalon...), it was clear that it was all a farce. Anti-Catalanism (https://en.wikipedia.org/wiki/Anti-Catalanism https://en.wikipedia.org/wiki/Anti-Catalanism) and other attitudes / reactions from many parts of Spain towards Catalonia lead to this. It is way too easy for political parties to get votes around Spain by stirring anger towards Catalonia... I think most catalans would be happy remaining in Spain if their language, culture, traditions and pockets were respected. But that's just not what Spain wants Catalonia for.
inglor_cz 4y ago
„I am firmly convinced that Spain is the strongest country of the world. Century after century trying to destroy herself and still no success.“ Source: https://quotepark.com/quotes/1886698-otto-von-bismarck-i-am-firmly-convinced-that-spain-is-the-strongest/ https://quotepark.com/quotes/1886698-otto-von-bismarck-i-am-...
- AshamedCaptain 4y ago
  There is also a nice quote from when, after a period of chaos in the late 19th century, Spaniards democratically chose to bring in a foreign King to govern them (sorry if I got this wrong -- https://en.wikipedia.org/wiki/Amadeo_I_of_Spain https://en.wikipedia.org/wiki/Amadeo_I_of_Spain ). In a short two years, Amadeo ended up fleeing the country claiming Spain to be simply ungovernable; and that the most dangerous enemies of Spain where the Spaniards themselves.
ricardobayes 4y ago
- AlotOfReading 4y ago
  Catalonia has been trying to secede for longer than Russia has existed in its current form. It may well be that Russia is funding separatist campaigns like they've done in many regions, but there's a genuine desire for independence regardless of Russian activities.
- smcl 4y ago
  It's kinda funny to see vague speculation of nefarious Russian involvement in the pro-independence side when we're discussing a very concrete case of espionage in the anti-independence side. The implication - and we see it sometimes in Scottish independence too - is that the separatist side is radical and sinister. And that the robust support the movement has is simply a mirage, artificially inflated by a foreign government who wishes to do harm.
- pvaldes 4y ago
  Is a known fact that Russian farms played a huge role in the flooding of fake news supporting Catalonia secession movement and tagging Spain as evil 24 hours a day. You can spot some patterns here also. But there are other actors. Politicians used this card for decades as leverage to obtain more and more power and to divert the focus from their own corruption
  - ricardobayes 4y ago
    It doesn't help that Spain has notoriously bad PR in anglo-saxon countries due to the black legend https://en.wikipedia.org/wiki/Black_Legend_(Spain) https://en.wikipedia.org/wiki/Black_Legend_(Spain)
cycomanic 4y ago
I was very surprised how little education there is amongst Spaniards about the Franco area, how this plays a significant role in the catalonian independence desires. Also how little processing of the Franco regime there was (compared to Germany), I mean the last Franco statue was removed only last year.
- the_gipsy 4y ago
  La transición was way too soft, out of fear of a coup d'etat. Decades later and we still suffer the consequences of that fear.
  - permalac 4y ago
    Like just rebranding their fascist tribunal? In the same building with the same people, but one day they become Democrats. Amazing story. Also, they have a tribunal that has two powers, and another one that decides if money has been well spent, if they decide otherwise you get to pay with your properties. Amazing country, and is part of EU.

medell 4y ago

Check out The Silence of Others (2018) on Netflix, produced by Almodovar for more background on the Franco atrocities and how it still is echoing today.

marcodiego 4y ago

Candiru is the name of an amazonian species of fish with a history of anecdotes of entering the human urethra sometimes requiring amputation of genitals.

sofixa 4y ago
That's a very apt name, kudos to whoever came up with it.
- randomhodler84 4y ago
  No kudos but curses. A thousand curses on them. A disgusting fish, a disgusting software and a disgusting developer. This is something that hurts people. Do not celebrate it.
  - nix23 4y ago
    I can celebrate any fish i want! It's a free country...at least on my side.
matheusmoreira 4y ago
Amazing name for such an insidious malware.
- pvaldes 4y ago
  I would appreciate more info about what the software does for the non tech

capableweb 4y ago

Seems random developers were targeted as well as European Parliament members (and more): > Jordi Baylina is the technology lead at Polygon, a popular decentralised Ethereum scaling platform. He is also an advisor on projects related to digital voting and decentralisation, and has built a widely-used privacy toolkit. He was extensively targeted with Pegasus, receiving at least 26 infection attempts. Ultimately, he was infected at least eight times between October 2019 and July 2020. > Baylina received a text message masquerading as a boarding pass link for a Swiss International Air Lines flight he had purchased. Targeting in this case indicates that the Pegasus operator may have had access to Baylina’s Passenger Name Record (PNR) or other information collected from the carrier. Scare stuff that not just random text messages can infect you (we knew this) but combined with harvesting other data (like PNR), they can time to exploit messages with other actions you do (like buying an flight ticket) and get you that way. I was scared of receiving random text messages already, but easy to just ignore them as they have nothing to do with me. But if I buy a flight ticket and receive a text message that looks relevant to me, I'm not sure I'd be able to guess it was actually malicious. Scary stuff. Edit: The more I read, the worse it gets: > Another common mode of targeting was to masquerade as official notifications from Spanish government entities, including the Tax and Social Security authorities.The messages also used SMS Sender IDs to masquerade as official agency accounts. > Notably, fake official messages were sometimes highly personalized. For example, a message sent to Jordi Baylina included a portion of his actual official tax identification number, suggesting that the Pegasus operator had access to this information. Seems clear at this point that the official Spanish government was behind these attacks, or the official registries got hacked (together with various delivery companies). Both are bad, but that signs are pointing to the earlier makes it even worse. It seems that the Spanish government can't help itself to give more fuel to the fire that is the fight for Catalan independence. Who'd want to belong to a state that constantly suppresses and surveillance you?

ricardobayes 4y ago
- deleted 4y ago
  [deleted]

pluc 4y ago

https://twitter.com/RonDeibert/status/1516011319719247873 https://twitter.com/RonDeibert/status/1516011319719247873 https://twitter.com/citizenlab/status/1516016174559121409 https://twitter.com/citizenlab/status/1516016174559121409

88840-8855 4y ago

I really never got the Catalonia crisis, especially around 2017, 2018. A region of approx. 8 million Catalonias who see themselves as Catalonians first and as Spanish second, with their own distinct history, vote with over 80% for their indipendence from Spain. People representing the interests of Catalonians go to the Spanish parlament, explain their goal of indipendence. And then stuff happens that I only read from bad China and bad Russia. Those political leaders are arrested. Police is sent in to stop the protests. Protests are suddenly called "the rebellion", people are arrested, the representatives of the indipendance movement have to flee Spain. Later it comes out that the police was seizing ballet boxes during the election. Spain then acts hard on the region, holds a gun against the head of many businesses located in the Catalonian region so they have to move out from there. So much more bad stuff has happened around that. I am just wondering - where is the outcry? I cannot stop overseeing the paralls to other conflicts around the world, very hot conflicts.

zozbot234 4y ago
- amackera 4y ago
  Minus the whole slavery thing, no?
  - McWobbleston 4y ago
    Yes, because Catalonia was resisting the fascist coup with their own revolutionary struggle to collectivize agriculture based on consent of the farmers, and worker ownership led by the labor unions who had been providing education and other community services for years. Its a lesser known fact that George Orwell wrote a book on his experiences there, and that the people's struggle inspired him so much he took up arms and joined them. The guy who's work people claim is an indictment of socialism, fought for it against the rise of fascism.
    - tough 4y ago

mercy_dude 4y ago

All these spyware incidents by nation states prove one thing: how fickle the so called rule of law is in much of the western democracy. In fact west has increasingly become de facto kleptocracy with media and nation state security apparatus actively seeking ways to maintain and grow the power for the national elites leaving them unchecked.

antattack 4y ago
Is there something better? Seems like pendulum swings the opposite way once it reaches western democracy.
twoneurons 4y ago
Too many bureaucrats and public servants are more occupied with growing their own power and protecting their space, than serving the public interest.
- EricE 4y ago
  Welcome to human nature. One of the reasons anyone who thinks socialism is a realistic strategy just is't with reality.
sbarre 4y ago
I mean, this was all happening before too, we just had less visibility into it. If you think that the governments of 'western democracies' weren't spying on their own citizens or going against their own laws - even in collaboration with private interests - before the advent of the Internet and spyware/malware, I've got bad news for you.
- colpabar 4y ago
  Sure, but even now with the greater visibility we have, these claims are never taken seriously en masse. One group would call you a traitor, and another would call you a conspiracy theorist. I do not have a solution, but I'd just like to point out that if someone on HN makes a comment like the one GP did, they 100% understand that this isn't "new". I also don't think we should just accept this as a part of life because "it was all happening before", because the level of spying the internet has enabled is orders of magnitude worse than it was without it. We should be afraid and upset.

lgl 4y ago

This seems like a good time to remember when an (apparently solo) spanish speaking hacker completely owned Hacking Team's (italian company that sells spyware to governments and that was mentioned/used in this post/attack) network and then detailed all the steps in what is still a really fascinating read. [0] The sysadmin's password was, wait for it... P4ssword [0] https://pastebin.com/kHUzWWm9 https://pastebin.com/kHUzWWm9

shmatt 4y ago

I see something very positive in this news - it looks like Apple and other companies have successfully blocked most if not all of Pegasus' 0-click exploits The true scary portion of this world is not even being sent an SMS/clicking a dangerous link, for a while people were getting infected without ever clicking anything To me the most interesting leak/investigation that can come out of NSO is what happens once a 0-day is patched, is there downtime? do customers need to wait for a software update? is there automatic rotation of exploits?

onionisafruit 4y ago
I wondered about how they manage their exploits too. Presumably they are constantly developing new exploits. I would guess that if they have a live 0-click that is working reliably they sit on the others until the current exploit is no longer effective. I doubt NSO considers their customers fully trustworthy. So they probably check every prerelease of ios and android for patches and ship the next exploit to customers only when a current exploit is being patched.
badRNG 4y ago
> To me the most interesting leak/investigation that can come out of NSO is what happens once a 0-day is patched, is there downtime? do customers need to wait for a software update? is there automatic rotation of exploits? I'd have to think NSO Group has the finances to bank at least a few 0-click, zero-days. It seems that the price of such vulnerabilities is increasing however. Zerodium, a large zero-day broker, is paying up to 2.5 million USD for 0-click Android and 2 million USD for iOS: https://zerodium.com/program.html https://zerodium.com/program.html
- EricE 4y ago
  It still boggles my mind that input sanitization/validation hasn't gotten a formal discipline around it. It's boring and tedious, yet crucial.

deleted 4y ago

[deleted]

denton-scratch 4y ago

wswope 4y ago
You sure you know where France and Spain are on a map? Seems like you’re mixing them up.
- denton-scratch 4y ago
  Gosh, I've been to both Catalunya and Pays Basque. I've lived in France. Catalunya is on Spain's south coast. North of Catalunya is Pays Basque, which also adjoins the pyrenees to the east. The north-east portion of Spain is the Pays Basque, not Catalunya. You can certainly get further south than Catalunya; but only by going west or getting on a boat. Catalunya is the southern portion of eastern Spain; it is therefore south-east, not north-east.
  - s1artibartfast 4y ago
    >I've lived in France. Where do you think the north east-corner of France is? Hauts-de-France or Grand Est? https://en.wikipedia.org/wiki/Regions_of_France https://en.wikipedia.org/wiki/Regions_of_France
    - denton-scratch 4y ago
      I've lived in France; but I haven't lived everywhere in France. And I'm certainly not French. I'll assume goodwill, although you've thrown me a trick question; so my answer is that France doesn't have a northeast "corner". Looking at that wikipedia map, I'd say they're both in the northeast, but neither is in the corner (Belgium is).
  - wswope 4y ago
    Looking at the most charitable map projection I can find, I see where you’re coming from - but I think most people would still call it the NE corner. ¯\_(ツ)_/¯ https://1igc0ojossa412h1e3ek8d1w-wpengine.netdna-ssl.com/wp-content/uploads/2018/03/TMS412.jpg https://1igc0ojossa412h1e3ek8d1w-wpengine.netdna-ssl.com/wp-...

aborsy 4y ago

CEOs, executives, members of parliaments, journalists, researchers at industrial labs, those working in defense/military, etc are at elevated risk of being hacked by governments and hacking companies such as NSO. I wonder how these people protect their digital assets? Are there guidelines? For example, if I am Microsoft CEO, would it be okay if I use the closed source iPhone from a competing company? Or perhaps these people use special hardened devices? Because even Apple CEO uses iPhone, and Pegasus apparently could hack any iPhone with zero click. So what prevents acquisition of highly valuable inside information by NSO or its customers (sensitive data about the company, iOS source code, implanting malware by infecting Apple engineers for the next exploit, etc)?

Barrin92 4y ago
> So what prevents acquisition of highly valuable inside information by NSO or its customers Given the Bezos hack two years ago I think the answer to that question is actually, very little. Cisco and Blackberry for example used to provide hardened phones for executives but with the prominence of modern smartphones it seems like even CEOs of large companies are increasingly on insecure hardware.
slim 4y ago
If I was NSO, I would have a team who's sole purpose is to make sure they maintain access inside Apple, Google and Microsoft.

favourable 4y ago

I reverse engineered a sketchy link I got in an SMS. I opened up Tor Browser Bundle (with JS disabled), then went to a URL 'un-shortener' service[0]. Furthermore, I saw an interstitial page with a JavaScript payload in it, and it was all obfuscated and obviously coded to hide what it was doing. I could have gone further and unpacked the code, beautifying it to see what 0 day it was leveraging, but I didn't proceed further. Obviously, this was designed to take over my device. Luckily, my default browser on my phone is Firefox with JavaScript turned off, so it wouldn't have been able to execute if I did click on the link. [0] https://urlex.org/ https://urlex.org/

dundarious 4y ago
Javascript is absolutely not the only way these payloads can infect your device, so I wouldn't consider that particularly safe. Also, if you aren't on a phone or similar, you can just use curl to expand shortened URLS. Tell it follow redirects (-L) and print headers (-I), and use the last "location: " header it spits out. e.g., curl -fsSLI https://t.co/blahblah | sed -n 's/^location: //p'
- dundarious 4y ago
  I know I'm replying to a 2 day old comment now, but I should add that I understand there may be a benefit to using a URL expanding service, in that the connection is not made from your host, so the various endpoints of your URLs won't see your IP address, etc. But the single URL expanding service will see all the URLs you expand and your IP address, etc., so you should trust it as much as any VPN service or ISP. That is to say, you should not trust it at all, until given numerous legal, technical, and reputational guarantees or assurances.