5 ms·

>> Further validating our finding of targeting, our forensic analysis shows Kouloglou received multiple Apple threat notifications about targeting with mercenar

>> Further validating our finding of targeting, our forensic analysis shows Kouloglou received multiple Apple threat notifications about targeting with mercenary spyware on three occasions: March 2, 2023, August 29, 2023, and April 10, 2024. It is important to note that threat notifications from Apple and other companies are not real-time alerts. They are typically sent to users in batches, often months or more after targeting takes place. >> Kouloglou reports to us that he did not recall receiving the Apple notifications we observed. Am I understanding this correctly that Apple sent him notifications that he was being monitored and he ignored them?

pmontra 3mo ago
"he did not recall receiving the Apple notifications" so he didn't notice them.
- captn3m0 3mo ago
  Do we know how Apple sends these? Is it just a notification, or also email?
  - krackers 3mo ago
    https://support.apple.com/en-us/102174 https://support.apple.com/en-us/102174 >A Threat Notification is displayed at the top of the page after the user signs into account.apple.com. >Apple sends an email and iMessage notification to the email addresses and phone numbers associated with the user’s Apple Account. You can see what it looks like in https://reddit.com/r/iphone/comments/1c10jai/i_have_received_two_messages_from_apple_stating/ https://reddit.com/r/iphone/comments/1c10jai/i_have_received... I wonder how they detect it, is it for known IOCs that they've already found elsewhere, or do they have heuristic detection that flags things that might need further investigation.
- arka2147483647 3mo ago
  Could those have been intercepted or suppressed somehow?
  - stavros 3mo ago
    It's possible, if the attacker controls the device enough. I don't think a big "you're being targeted" warning is something you don't notice, or forget.
- bawolff 3mo ago
  That is kind of surprising given he is on the comittee investigating pegasus. I'd assume someone on the comittee would be paying much more attention to this than a normal person. I wonder what triggered him to suspect he was hacked then. Since presumably something triggered him to have his phone forensically investigated.
  - DANmode 3mo ago
    If he knew he was compromised, and was okay with it for one reason or another (like money or other coercion), this is what his cleanup would look like. Not saying this is likely. Just another possibility.
  - tyre 3mo ago
    Or that Apple could either run searches on the names of affected users against publicly known members of government or have close relationship with governments to flag exactly this.
  - isodev 3mo ago
    > That is kind of surprising Have you seen notifications on iOS? There are even notifications for the notifications. But this type of notification I believe is delivered via iMessage and email. So unless you’re actively using iMessage or your icloud email then chances are all this is practically invisible.
  - goobatrooba 3mo ago
    People seem to have this fiction that parliamentarians working on a committee actually have some expertise. This can happen but is actually rare. They are not elected for skill but for political reasons, and then the parties pawn them to different committees. So in other words he probably speaks about security, whatever his staffers feed him, but most likely has no clue whatsoever what it's about.
- lostlogin 3mo ago
  I could be wrong here, but I can’t see any way of viewing old notifications. It isn’t hard to accidentally dismiss one then wonder what it was. Why there isn’t there an interface for looking back? Edit: below it says there are emails and notices on web login.
  - wwind123 3mo ago
    If a notification is dismissed on iphone, there's indeed no central UI to see it again on the phone. That's a sad state of iphone. Many people have asked, but Apple just doesn't care enough to do it. Now I hope this kind of high-profile security incidents could nudge Apple towards taking action.
    - brookst 3mo ago
      Any source for that “Apple just doesn’t care”, as opposed to thinking there are security/privacy tradeoffs or other considerations that cut against such a feature?
      - crewindream 3mo ago
        Ok, apple does not care, but gives “security/privacy” consideration as a public reason for not doing anything.
      - Y-bar 3mo ago
        If Apple can store the sms/iMessage, and email history, and health/journal history, and my Wallet payment history, in a safe manner I would think Apple can store notification history in a safe manner. How would notifications be meaningfully different from these? I think the proof of Apple’s level of care is in their lack of attention to this issue.
        DANmode 3mo ago
        > How would notifications be meaningfully different from these? Ephemeral transit layer owned by third-parties constantly, vs cold storage of secrets your architecture owns from start to finish.
- chatmasta 3mo ago
  Do they send them via notification infrastructure or email? Personally I almost never check the email associated with my Apple ID so I would miss those. But if all my Apple devices were notifying me and I had a badge in Settings.app, I’d notice. Then again, you’d think that’s the kinda thing malware developers would spend some time learning to hide from the user.
- CalRobert 3mo ago
  Or he lied about noticing them to avoid embarrassment.
EA-3167 3mo ago
That seems to be the case, although he claims to have somehow missed them. Overall this is one of those stories that's obviously an outrage, except for the fact that every country on Earth spies on the rest, and quite a few private entities do as well. Still the way the game is played if you get caught you have to act ashamed, and the people catching you get to gloat. It's silly, but it's a show the public never tires of.
- healthworker 3mo ago
  In this case he was investigating misuse of Pegasus spyware specifically, and was targeted with it while doing so. That's obstruction of justice, morally speaking, and would feel very scary, in that it would make you feel that this company might be so powerful that investigating it is personally dangerous.
  - EA-3167 3mo ago
    That's certainly the feeling the story is meant to engender yes.
  - crewindream 3mo ago
    Alternate spin: He now has a conflict of interest. He’s now too biased to work on the committee.
    - DANmode 3mo ago
      For who?
- hammock 3mo ago
  The US does not spy on Five Eyes government leadership or that of Israel. And perhaps more: in the wake of Snowden, which obliterated many diplomatic relationships the U.S. has with other countries, Obama issued a directive that the U.S. would not monitor heads of state and government of close friends and allies (even outside Five Eyes) unless there was a compelling national security reason. As far as we know that directive has remained in force with each successive administration as well. They spy on most others though. Germany’s Merkel, successive French presidents etc all had their phones hacked by US there is widely reported news of.
saintfire 3mo ago
I mean his device was pwnd completely. Its not a stretch that attempts to warn are suppressed. That or he didn't notice or could have assumed the notice itself was one of many phishing attempts against large orgs. If I saw a notification that my account was compromised by Pegasus I'd personally assume phishing.
- stavros 3mo ago
  Kouloglou is a famous investigative journalist, not you and me. Yes you and I might think we're being scammed, but someone who actually spent a lot of their life getting death threats probably would pay more attention.
  - benjiro29 3mo ago
    Fairly sure that if anybody using a advanced piece of hacking software, they are also going to delete any messages that are related to detection of such hardware. PC viruses used to do that stuff going back so many years ago. Suppressing any notification under Windows, by disabling the AV software, its notifications, windows notifications related to it. So it will amaze me that this is not done by any modern espionage software. Especially as the notification methods are known. Given that his device is hacked, that means a lot of avenues are under control of the espionage software. Even mails etc ... So impersonating the end user, to confirm they read a warning, is extreme easy. I find it rather odd that people are so fixated on the idea if Kouloglou read it or not.
    - stavros 3mo ago
      Maybe the software can only exfiltrate information, rather than change it.
      - benjiro29 3mo ago
        If i was going to write software on this level, that will be used by governments. There is no way, its going to be a nice little program that only extract information. Its going to have every trick in the book (and outside it), to stay hidden. And it will have payloads to alter its behavior, updates, etc... Nobody is going to pay you big fat money envelops for software that anybody can write in a afternoon. You want it to be as capable as ever, and you do not want it found!

pmontra 3mo ago

"he did not recall receiving the Apple notifications" so he didn't notice them.

captn3m0 3mo ago
Do we know how Apple sends these? Is it just a notification, or also email?
- krackers 3mo ago
  https://support.apple.com/en-us/102174 https://support.apple.com/en-us/102174 >A Threat Notification is displayed at the top of the page after the user signs into account.apple.com. >Apple sends an email and iMessage notification to the email addresses and phone numbers associated with the user’s Apple Account. You can see what it looks like in https://reddit.com/r/iphone/comments/1c10jai/i_have_received_two_messages_from_apple_stating/ https://reddit.com/r/iphone/comments/1c10jai/i_have_received... I wonder how they detect it, is it for known IOCs that they've already found elsewhere, or do they have heuristic detection that flags things that might need further investigation.
arka2147483647 3mo ago
Could those have been intercepted or suppressed somehow?
- stavros 3mo ago
  It's possible, if the attacker controls the device enough. I don't think a big "you're being targeted" warning is something you don't notice, or forget.
bawolff 3mo ago
That is kind of surprising given he is on the comittee investigating pegasus. I'd assume someone on the comittee would be paying much more attention to this than a normal person. I wonder what triggered him to suspect he was hacked then. Since presumably something triggered him to have his phone forensically investigated.
- DANmode 3mo ago
  If he knew he was compromised, and was okay with it for one reason or another (like money or other coercion), this is what his cleanup would look like. Not saying this is likely. Just another possibility.
- tyre 3mo ago
  Or that Apple could either run searches on the names of affected users against publicly known members of government or have close relationship with governments to flag exactly this.
- isodev 3mo ago
  > That is kind of surprising Have you seen notifications on iOS? There are even notifications for the notifications. But this type of notification I believe is delivered via iMessage and email. So unless you’re actively using iMessage or your icloud email then chances are all this is practically invisible.
- goobatrooba 3mo ago
  People seem to have this fiction that parliamentarians working on a committee actually have some expertise. This can happen but is actually rare. They are not elected for skill but for political reasons, and then the parties pawn them to different committees. So in other words he probably speaks about security, whatever his staffers feed him, but most likely has no clue whatsoever what it's about.
lostlogin 3mo ago
I could be wrong here, but I can’t see any way of viewing old notifications. It isn’t hard to accidentally dismiss one then wonder what it was. Why there isn’t there an interface for looking back? Edit: below it says there are emails and notices on web login.
- wwind123 3mo ago
  If a notification is dismissed on iphone, there's indeed no central UI to see it again on the phone. That's a sad state of iphone. Many people have asked, but Apple just doesn't care enough to do it. Now I hope this kind of high-profile security incidents could nudge Apple towards taking action.
  - brookst 3mo ago
    Any source for that “Apple just doesn’t care”, as opposed to thinking there are security/privacy tradeoffs or other considerations that cut against such a feature?
    - crewindream 3mo ago
      Ok, apple does not care, but gives “security/privacy” consideration as a public reason for not doing anything.
    - Y-bar 3mo ago
      If Apple can store the sms/iMessage, and email history, and health/journal history, and my Wallet payment history, in a safe manner I would think Apple can store notification history in a safe manner. How would notifications be meaningfully different from these? I think the proof of Apple’s level of care is in their lack of attention to this issue.
      - DANmode 3mo ago
        > How would notifications be meaningfully different from these? Ephemeral transit layer owned by third-parties constantly, vs cold storage of secrets your architecture owns from start to finish.
chatmasta 3mo ago
Do they send them via notification infrastructure or email? Personally I almost never check the email associated with my Apple ID so I would miss those. But if all my Apple devices were notifying me and I had a badge in Settings.app, I’d notice. Then again, you’d think that’s the kinda thing malware developers would spend some time learning to hide from the user.
CalRobert 3mo ago
Or he lied about noticing them to avoid embarrassment.

EA-3167 3mo ago

That seems to be the case, although he claims to have somehow missed them. Overall this is one of those stories that's obviously an outrage, except for the fact that every country on Earth spies on the rest, and quite a few private entities do as well. Still the way the game is played if you get caught you have to act ashamed, and the people catching you get to gloat. It's silly, but it's a show the public never tires of.

healthworker 3mo ago
In this case he was investigating misuse of Pegasus spyware specifically, and was targeted with it while doing so. That's obstruction of justice, morally speaking, and would feel very scary, in that it would make you feel that this company might be so powerful that investigating it is personally dangerous.
- EA-3167 3mo ago
  That's certainly the feeling the story is meant to engender yes.
- crewindream 3mo ago
  Alternate spin: He now has a conflict of interest. He’s now too biased to work on the committee.
  - DANmode 3mo ago
    For who?
hammock 3mo ago
The US does not spy on Five Eyes government leadership or that of Israel. And perhaps more: in the wake of Snowden, which obliterated many diplomatic relationships the U.S. has with other countries, Obama issued a directive that the U.S. would not monitor heads of state and government of close friends and allies (even outside Five Eyes) unless there was a compelling national security reason. As far as we know that directive has remained in force with each successive administration as well. They spy on most others though. Germany’s Merkel, successive French presidents etc all had their phones hacked by US there is widely reported news of.

saintfire 3mo ago

I mean his device was pwnd completely. Its not a stretch that attempts to warn are suppressed. That or he didn't notice or could have assumed the notice itself was one of many phishing attempts against large orgs. If I saw a notification that my account was compromised by Pegasus I'd personally assume phishing.

stavros 3mo ago
Kouloglou is a famous investigative journalist, not you and me. Yes you and I might think we're being scammed, but someone who actually spent a lot of their life getting death threats probably would pay more attention.
- benjiro29 3mo ago
  Fairly sure that if anybody using a advanced piece of hacking software, they are also going to delete any messages that are related to detection of such hardware. PC viruses used to do that stuff going back so many years ago. Suppressing any notification under Windows, by disabling the AV software, its notifications, windows notifications related to it. So it will amaze me that this is not done by any modern espionage software. Especially as the notification methods are known. Given that his device is hacked, that means a lot of avenues are under control of the espionage software. Even mails etc ... So impersonating the end user, to confirm they read a warning, is extreme easy. I find it rather odd that people are so fixated on the idea if Kouloglou read it or not.
  - stavros 3mo ago
    Maybe the software can only exfiltrate information, rather than change it.
    - benjiro29 3mo ago
      If i was going to write software on this level, that will be used by governments. There is no way, its going to be a nice little program that only extract information. Its going to have every trick in the book (and outside it), to stay hidden. And it will have payloads to alter its behavior, updates, etc... Nobody is going to pay you big fat money envelops for software that anybody can write in a afternoon. You want it to be as capable as ever, and you do not want it found!