Hello world, Apple has just filed a lawsuit against the infamous spyware developers, NSO
group. Now if you don’t know what ‘NSO group’ is, welcome, you must be new here.
I’ve made a few videos on these guys, essentially they make some of the world's most advanced
spyware which primarily targets IOS and Android devices. They wrap up these zero day vulnerabilities
they discover, stick a little bow on top and sell their software to the most awful regimes
imaginable, such as those of Saudi Arabia, Bahrain, etc, and then act surprised when
their tools are used to carry out human rights abuses, allegedly.
I’m not going to rehash their whole history, but just one example to give you an idea of
who we’re dealing with. It has been alleged that NSO’s spyware, which is called Pegasus,
was used to spy on the close relatives of the Saudi Arabian journalist Jamal Kasoggi,
he “was” a Journalist before he was murdered by Saudi secret agents, cut up into little
pieces and dissolved in acid - breaking bad style. The allegation is that spying using
Pegasus aided in planning his assasination. And even if you ignore this one example or
for whatever reason it turns out to be false, there is an odd pattern of instances where
Pegasus spyware has apparently been used for evil.
So in this new lawsuit filed about by Apple, they describe NSO in the most amazing terms,
saying the “defendants are notorious hackers—amoral 21st century mercenaries who have created
highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse.”
Ouch, now that has to be one of the most eloquent roasts of NSO I’ve heard. However, Apple’s
hurdle in this lawsuit is that you can’t necessarily hold NSO responsible for the actions
of their customers, just like you can’t blame a gun manufacturer for a shooting, however
Apple counters this by arguing that NSO “provide[s] consulting and expert services to their clients,
assist[s] them with their deployment and use of Pegasus, and participate[s] in their attacks
on Apple devices, servers, and users.” And so because NSO is at least somewhat involved
in the use of their tools, they should be held responsible for its use.
Apple is demanding some pretty hefty penalties. One of which is described as “A permanent
injunction, restraining Defendants from accessing and using any Apple servers, devices, hardware,
software, applications, etc”. Now if Apple gets their way on this it would de facto kill
NSO’s business model overnight, because of course you can’t exploit IOS devices
if you can’t use IOS devices. NSO would be screwed, basically. Apple is also asking
for “Disgorgement of Defendants’ profits resulting from the conduct alleged” - that’s
legal speak for give us all the money you made hacking iPhones. This would also cripple
NSO, for reasons that we’ll get to shortly.
Along with filing this lawsuit, Apple has simultaneously announced a new notification
system for victims of state sponsored hacking. They explain here on their website that “If
Apple discovers activity consistent with a state-sponsored attack, we notify the targeted
users in two ways”. Firstly, you’ll get one of these threat notifications when you
log in on Apple’s website - which seems a little pointless, I mean how often do you
log in on Apple’s website, I’ve never done that. Alternatively though Apple will
also send you an “email and iMessage notification”. Apple makes it clear not to rely on this system
though, adding that “It’s possible that some Apple threat notifications may be false
alarms, or that some attacks are not detected.”
Oh and if you wake up one morning to find an alert sent to your phone, don’t bother
asking Apple for more information, as Apple says they’re “unable to provide information
about what causes [them] to issue threat notifications, as that may help state-sponsored attackers
adapt their behavior to evade detection in the future.” So if you do get an alert you’re
effectively on your own. Better just, idk burn everything.
If we’re being honest though, this is a really positive move on the part of Apple,
if they win, it sets somewhat of a precedent for other companies thinking of supplying
awful regimes with super advanced hacking tools. Another nugget of praise for Apple
comes in the form of them announcing that they will donate any money they make from
this lawsuit to citizen lab, amnesty tech, and other non profits organisations that expose
spyware. Without these two organisations in particular, much of the NSO Pegasus abuses
simply wouldn’t have come to light. Journalists and activists targeted by state sponsored
hackers rely on organisations like these to investigate their cases.
However, whilst Apple opening up this new front against NSO is of course something to
applaud. Let’s not delude ourselves into thinking that tech giants, like Apple, care
about our privacy and security as a matter of principle. In this case it may have been
convenient to side with users. But of course let’s not forget the concessions Apple has
made on user privacy and security in China where they have effectively ceded control
of user data and even legal ownership of that data to a company owned by the Chinese state
to the point where according to a New York Times investigation, Apple don’t even run
their Chinese data centres, they’re effectively manned by government employees and only monitored
by Apple from outside the country. I have a whole video on Apple’s Chinese concessions
which I’ll link below if you want to watch it and lose some credit score.
However, back to NSO group, on which there is more good news. It seems NSO group is facing
a dramatic decline, being torn apart at their seams, and it looks like Apple’s lawsuit
may simply be yet another milestone in their inevitable demise - one can only hope. For
example, earlier this month the US sanctioned NSO group for what the US department of commerce
describes as enabling “the practice of authoritarian governments targeting dissidents, journalists
and activists”. The sanctions mean that US companies simply can’t do any kind of
business or have any kind of relationship with NSO without a license. Breaking the rules
would incur some big fines.
To add to NSO’s growing list of problems, they were recently denied an appeal to have
their ongoing lawsuit instigated by facebook thrown out. If you weren’t aware they’re
also being sued by Facebook which claims they hacked WhatsApp, though that’s old news,
it came to light in 2019, but these things take time and there haven’t been many developments
since then.
Also, the guy who was meant to become NSO’s new CEO has just quit. And, NSO have had their
credit rating downgraded to just slightly above the “substantial risk” category.
The reason I bring this up is because look, we can have our circle jerk as to why NSO
is awful and bad and whatever, but if they’re profitable then it’s irrelevant. This downgrading
of their rating by Moody’s is an amoral judgement on their future outlook which is
looking increasingly bleak - they're in debt to the tune of hundreds of millions of dollars
and lenders are trying to offload their debt at a steep discount in order to distance themselves
from NSO.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered. If it runs
on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware. Linode’s philosophy
is to focus on providing all the tools a developer really needs at competitive prices. Use the
link in the description now to claim your free $100.
If you enjoy this kind of video make sure to help me out by fondling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on the
new allegations against election hackers.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.