back to article The spyware business is booming despite government crackdowns

The commercial spyware economy – despite government and big tech's efforts to crack down – appears to be booming. In addition to the major players like Pegasus developer NSO Group, and Predator maker Intellexa, Google’s Threat Analysis Group (TAG) has found "dozens of smaller" commercial surveillance vendors and tracks around …

  1. Version 1.0 Silver badge
    Terminator

    Your internet is deadly infected these days.

    Potentially as a result of the early days of government abuse to spy on everyone on the internet, the internet has the "ability" to be deadly infected everywhere. Effectively government actions taught the cyber-criminal environment how to get started and now there are no discussions about making the internet totally secure - so effectively both governments and cyber-criminals see 100% security as a problem.

    1. amanfromMars 1 Silver badge

      Re: Your internet is deadly infected these days.

      Disinfection of the internet and eradication or reprogramming of abusive government officials/practices and cyber-criminals is not a problem whenever 100% security is provided by no leaky discussions about intelligent actions taken.

      NB .... Beware, Be Aware and Take Care ..... If you are up to no good and/or even just merely supportive of a dodgy inequitable system, are you liable to suffer punitive consequences by virtue of either your ignorance or your wilful arrogance which may assume widespread ignorance will provide stealthy undetectable cover for immunity from persecution and prosecution .... an ACTive Impunity.

      So educate yourself with such information as is freely available revealing the state of affairs you are expected to accept and be held captive in. It is out there, everywhere ..... and recognised as a truly almighty existential threat to powers that now be in worthy rapid practical and virtual decline because of arrogant systemic abuse of ignorance.

  2. Pascal Monett Silver badge
    Stop

    "can only be sold to governments and used to fight terrorism"

    Sure, I'll believe that.

    Now tell me, who defines what terrorism is, hmm ? The government you sold your stuff to.

    1. 43300 Silver badge

      Re: "can only be sold to governments and used to fight terrorism"

      The difference between a "terrorist" and a "freedom fighter" is often dependent on the viewpoint of those judging them!

      1. Roj Blake Silver badge

        Re: "can only be sold to governments and used to fight terrorism"

        If a firefighter fights fires and a crimefighter fights crime, what do freedom fighters fight?

        1. LionelB Silver badge

          Re: "can only be sold to governments and used to fight terrorism"

          And indeed, what about cage fighters?

          1. A. Coatsworth Silver badge
            Trollface

            Re: "can only be sold to governments and used to fight terrorism"

            Street fighters have always faced an uphill battle

      2. Anonymous Coward
        Anonymous Coward

        @43300 - Re: "can only be sold to governments and used to fight terrorism"

        As they use to say, hunting is a noble sport or a horrible cruelty, it all depends on which end of the rifle's barrel you're standing.

  3. Anonymous Coward
    Anonymous Coward

    Rewrite Required!!!

    Quote: "....their victims live in fear..."

    As I understand it, their victims mostly DON'T KNOW that they are victims.....and surely that is the whole point of the technology.

    Yes...."...political dissidents, lawyers, journalists and activists..." all know that they have a target on their backs.

    Rewrite quote: "....potential victims need to take adequate precautions to mitigate their risk - like changing their burner phone and SIM every two weeks. That way they don't need to live in fear!"

    1. Anonymous Coward
      Anonymous Coward

      @AC - Re: Rewrite Required!!!

      Yes, but by doing that you become officially suspect in the eyes of the government.

      1. Anonymous Coward
        Anonymous Coward

        Re: @AC - Rewrite Required!!!

        @AC

        Quote: "....you become officially suspect..."

        Let me explain.........

        Yup.....burners....but the government then has the problem of finding the identity of "you"!!!

  4. rafff

    " The spyware business is booming despite government crackdowns"

    But government is the biggest customer

    1. Anonymous Coward
      Anonymous Coward

      Re: " The spyware business is booming despite government crackdowns"

      @rafff

      Quote: "....government is the biggest customer...."

      No - "...government is the biggest customer...as far as we know..."

      I say this because there are other snoops out there with VERY deep pockets....Meta, Palantir, Google.....

      1. Andy The Hat Silver badge

        Re: " The spyware business is booming despite government crackdowns"

        Why would those companies bother with commercial spyware when you already give them your data on a plate?

        1. Killfalcon Silver badge

          Re: " The spyware business is booming despite government crackdowns"

          Honestly, I'd guess that even Google will find people it can't track but really wants to. Rival companies, for example, won't be using google docs for their accounting, and so the corporate espionage world still has reasons to exist. It's risky, obviously, especially when staff can move between the giants freely, but it's certainly not unthinkable.

          They don't need to steal my data, as you say they get plenty of that, but there's always gaps they'll want to fill.

  5. Anonymous Coward
    Anonymous Coward

    Why are vendors allowed to market?

    Usecure hardware, Breached software.... Microsoft... Google... anybody listening??

    1. Charlie Clark Silver badge

      Re: Why are vendors allowed to market?

      The answer is simple: in the US, software is exempt from standard product liability requirements and manufacturers just have to promise to release updates with the fixes.

      1. Anonymous Coward
        Anonymous Coward

        Re: Why are vendors allowed to market?

        It's good to be the king!

  6. Charlie Clark Silver badge

    Nothing learned from the wars on…

    If demand is great enough, and it seems to be growing, the market will supply. Government intervention may, at best, limit supply but also drive up prices.

    For a fraction of the money spent on these schemes, research projects into more secure hardware and software could be supported; hopefully going beyond the kind of thing that got an airgapped Windows NT system certified as secure.

    1. This post has been deleted by its author

  7. DS999 Silver badge
    Devil

    $860K per target?

    At least I don't have to worry about my phone getting attacked by these shady companies, because there's no reason why any government or organization would pay anywhere near that kind of cash to spy on me!

    1. doublelayer Silver badge

      Re: $860K per target?

      Not exactly. It's $860k per concurrent target. If they target you, gather information from your phone from an hour, then stop, they pay nothing other than that they have to take their eyes off someone else for an hour. If they're targeting lots of people, adding you can be pretty cheap.

      This is also not necessarily the only price. I think it's likely they may have multiple prices. For the wealthy dictatorships, they have the inflated government price. For many other governments, they have the less inflated government price. For the keen business who wants some surveillance, they have their special discount based on how much money the company has available and how badly they seem to want it. Why not sell to the low end at a lower price when adding more victims is almost free? You might get some customer loyalty.

    2. Denarius

      Re: $860K per target?

      they dont have to. Your telco, ISP, antiSocial media and financial records do most of it at your expense in fees and charges. All automatically slurped.

    3. Anonymous Coward
      Anonymous Coward

      @DS999 - Re: $860K per target?

      That's what you think.

      If observed well enough, every innocent person becomes strange and suspect.

    4. Anonymous Coward
      Anonymous Coward

      @DS999 - Re: $860K per target?

      I hope you know by now government is paying with tax payer money so they don't care much about the cost. You're paying for the surveillance so why not.

      1. DS999 Silver badge

        Re: @DS999 - $860K per target?

        Since I don't pay $860K in taxes, it will be a money losing proposition for them to spy on me. If they find I'm guilty of some crime it will cost them even more because I'll stop paying taxes and they'll have to pay to house me in prison. They can't do that sort of thing too much before even the United States exceeds its credit line.

        1. Anonymous Coward
          Anonymous Coward

          @DS999 - Re: @DS999 - $860K per target?

          You didn't get it, it's not their money. Besides, in case you didn't know, US are very good at printing money.

          1. DS999 Silver badge

            Re: @DS999 - @DS999 - $860K per target?

            You can always tell someone who doesn't understand how money works via their complaints about "printing money". You probably think the US has been printing money the last couple years, blame inflation on that, and don't realize that since mid 2021 trillions have actually been taken OUT of circulation as bonds held on the Fed's QE balance sheet have been allowed to mature without being replaced.

  8. trindflo Bronze badge

    How much are we doing this to ourselves for convenience?

    When we give our smartphones access to our banking and install every fun sounding app, aren't we part of the problem? Would the spyware industry exist if only flip phones and hardened operating systems were being used? Does single signon make things more secure?

    1. doublelayer Silver badge

      Re: How much are we doing this to ourselves for convenience?

      It depends what you were doing with them, but probably not. Banking apps are rarely the targets of the attackers because there are a bunch of apps and each user probably only has one or two of them installed. Finding a bug in banking app A doesn't let you attack anyone who doesn't have an account at bank A and anyone who doesn't need access to it on their phone. Nor do they usually attack by having someone install a dodgy app. Malware of that kind exists, but targeted attacks like this can't rely on someone installing something for them. Mostly, they look for vulnerabilities in the OS itself or in particularly common apps, often communication ones like WhatsApp which are popular and have an easy way to deliver a payload to them by sending a message to the victim's number.

      Nor are financial details the target of something like this. They're paying millions for the right to infect someone; they have enough money as it is. Usually, they want information. Your calls, your messages, your emails, and the ability to track your location and turn on your microphone. A flip phone has all the hardware needed to do that, and the only possible difference is that you might not sync your email to it because the interface makes it annoying to use. Flip phones have been able to read email for fifteen years, though, so nothing would prevent it from being an interesting target to users of stuff like this.

    2. Necrohamster Bronze badge

      Re: How much are we doing this to ourselves for convenience?

      If you're a target for a state-backed hacker or other groups who use Pegasus etc, having your phone hacked is only one of a bunch of things they're probably doing to you. So using a dumb phone won't help in that regard.

      Nobody's going to burn a chain of zero-days to get into your banking app anyway. Indian scammers are using social engineering to persuade people to send them money every day of the week.

  9. Ilgaz

    This is about Desktop security not server.

    You can't do much if your profile is specifically targeted by a state or a billion dollar company however every single day passing with zero competition on the Win32 Desktop security, it goes worse.

    Yea I am talking about Windows built in security. There is no conspiracy, it is just nobody is that good. E.g. even Mr Cutler himself wrote it, they would find a way. Actually, the attack surface is gigantic compared to pre Windows 10. A black hat really knows which one to break now unlike Win 7 which had thousands of security configs.

    1. Necrohamster Bronze badge
      Facepalm

      "This is about Desktop security not server."

      You must have read a different report, because the one I read was all about the exploitation of vulnerabilities on IOS and Android

  10. Necrohamster Bronze badge
    Black Helicopters

    Funny how...

    ...the commercial surveillance industry has so many company founders who previously worked for IDF military intelligence (Unit 8200 or Unit 81) or the Mossad.

    e.g. Niv Karmi (NSO Group) or Tal Dilian (Intellexa)

    Coincidence?

    1. Graham Cobb Silver badge

      Re: Funny how...

      Neither funny nor coincidence. The Israeli government makes no secret about encouraging and using spyware. Right or wrong, they see it as critical to the continued existence of their country and the safety of their citizens.

      There are many things about the Israeli government, and the IDF, I don't like. But at least they are not hypocritical about their use of spyware.

      Russia, China, North Korea and the US are the governments who are two-faced hypocrites who pretend to dislike spyware but actually actively promote and heavily use it. One assumes they are (between them) providing much money and much air cover (from legal investigations) for the criminal gangs who now seem to be the main controllers of the various breaches.

      1. Necrohamster Bronze badge

        Re: Funny how...

        Sorry, I use sarcasm a lot. Of course there's nothing funny or coincidental about ex-Mossad selling spyware worldwide.

        Where ex-employees of state security services use their knowledge to make commercial spyware, they're way outside the remit of "spyware for Israel's national security"

        Saudi Arabia might agree when it comes to Jamal Khashoggi's demise, but that justification is going to fall on deaf ears for the most part.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like