The spyware business is booming despite government crackdowns

The commercial spyware economy – despite government and big tech's efforts to crack down – appears to be booming. In addition to the major players like Pegasus developer NSO Group, and Predator maker Intellexa, Google’s Threat Analysis Group (TAG) has found "dozens of smaller" commercial surveillance vendors and tracks around …

[Version 1.0]

Your internet is deadly infected these days.

Potentially as a result of the early days of government abuse to spy on everyone on the internet, the internet has the "ability" to be deadly infected everywhere. Effectively government actions taught the cyber-criminal environment how to get started and now there are no discussions about making the internet totally secure - so effectively both governments and cyber-criminals see 100% security as a problem.

[amanfromMars 1]

Re: Your internet is deadly infected these days.

Disinfection of the internet and eradication or reprogramming of abusive government officials/practices and cyber-criminals is not a problem whenever 100% security is provided by no leaky discussions about intelligent actions taken.

NB .... Beware, Be Aware and Take Care ..... If you are up to no good and/or even just merely supportive of a dodgy inequitable system, are you liable to suffer punitive consequences by virtue of either your ignorance or your wilful arrogance which may assume widespread ignorance will provide stealthy undetectable cover for immunity from persecution and prosecution .... an ACTive Impunity.

So educate yourself with such information as is freely available revealing the state of affairs you are expected to accept and be held captive in. It is out there, everywhere ..... and recognised as a truly almighty existential threat to powers that now be in worthy rapid practical and virtual decline because of arrogant systemic abuse of ignorance.

[Pascal Monett]

"can only be sold to governments and used to fight terrorism"

Sure, I'll believe that.

Now tell me, who defines what terrorism is, hmm ? The government you sold your stuff to.

[43300]

Re: "can only be sold to governments and used to fight terrorism"

The difference between a "terrorist" and a "freedom fighter" is often dependent on the viewpoint of those judging them!

[Roj Blake]

Re: "can only be sold to governments and used to fight terrorism"

If a firefighter fights fires and a crimefighter fights crime, what do freedom fighters fight?

[LionelB]

Re: "can only be sold to governments and used to fight terrorism"

And indeed, what about cage fighters?

[A. Coatsworth]

Re: "can only be sold to governments and used to fight terrorism"

Street fighters have always faced an uphill battle

[Anonymous Coward]

@43300 - Re: "can only be sold to governments and used to fight terrorism"

As they use to say, hunting is a noble sport or a horrible cruelty, it all depends on which end of the rifle's barrel you're standing.

[Anonymous Coward]

Rewrite Required!!!

Quote: "....their victims live in fear..."

As I understand it, their victims mostly DON'T KNOW that they are victims.....and surely that is the whole point of the technology.

Yes...."...political dissidents, lawyers, journalists and activists..." all know that they have a target on their backs.

Rewrite quote: "....potential victims need to take adequate precautions to mitigate their risk - like changing their burner phone and SIM every two weeks. That way they don't need to live in fear!"

[Anonymous Coward]

@AC - Re: Rewrite Required!!!

Yes, but by doing that you become officially suspect in the eyes of the government.

[Anonymous Coward]

Re: @AC - Rewrite Required!!!

@AC

Quote: "....you become officially suspect..."

Let me explain.........

Yup.....burners....but the government then has the problem of finding the identity of "you"!!!

[rafff]

" The spyware business is booming despite government crackdowns"

But government is the biggest customer

[Anonymous Coward]

Re: " The spyware business is booming despite government crackdowns"

@rafff

Quote: "....government is the biggest customer...."

No - "...government is the biggest customer...as far as we know..."

I say this because there are other snoops out there with VERY deep pockets....Meta, Palantir, Google.....

[Andy The Hat]

Re: " The spyware business is booming despite government crackdowns"

Why would those companies bother with commercial spyware when you already give them your data on a plate?

[Killfalcon]

Re: " The spyware business is booming despite government crackdowns"

Honestly, I'd guess that even Google will find people it can't track but really wants to. Rival companies, for example, won't be using google docs for their accounting, and so the corporate espionage world still has reasons to exist. It's risky, obviously, especially when staff can move between the giants freely, but it's certainly not unthinkable.

They don't need to steal my data, as you say they get plenty of that, but there's always gaps they'll want to fill.

[Anonymous Coward]

Why are vendors allowed to market?

Usecure hardware, Breached software.... Microsoft... Google... anybody listening??

[Charlie Clark]

Re: Why are vendors allowed to market?

The answer is simple: in the US, software is exempt from standard product liability requirements and manufacturers just have to promise to release updates with the fixes.

[Anonymous Coward]

Re: Why are vendors allowed to market?

It's good to be the king!

[Charlie Clark]

Nothing learned from the wars on…

If demand is great enough, and it seems to be growing, the market will supply. Government intervention may, at best, limit supply but also drive up prices.

For a fraction of the money spent on these schemes, research projects into more secure hardware and software could be supported; hopefully going beyond the kind of thing that got an airgapped Windows NT system certified as secure.

[DS999]

$860K per target?

At least I don't have to worry about my phone getting attacked by these shady companies, because there's no reason why any government or organization would pay anywhere near that kind of cash to spy on me!

[doublelayer]

Re: $860K per target?

Not exactly. It's $860k per concurrent target. If they target you, gather information from your phone from an hour, then stop, they pay nothing other than that they have to take their eyes off someone else for an hour. If they're targeting lots of people, adding you can be pretty cheap.

This is also not necessarily the only price. I think it's likely they may have multiple prices. For the wealthy dictatorships, they have the inflated government price. For many other governments, they have the less inflated government price. For the keen business who wants some surveillance, they have their special discount based on how much money the company has available and how badly they seem to want it. Why not sell to the low end at a lower price when adding more victims is almost free? You might get some customer loyalty.

[Denarius]

Re: $860K per target?

they dont have to. Your telco, ISP, antiSocial media and financial records do most of it at your expense in fees and charges. All automatically slurped.

[Anonymous Coward]

@DS999 - Re: $860K per target?

That's what you think.

If observed well enough, every innocent person becomes strange and suspect.

[Anonymous Coward]

@DS999 - Re: $860K per target?

I hope you know by now government is paying with tax payer money so they don't care much about the cost. You're paying for the surveillance so why not.

[DS999]

Re: @DS999 - $860K per target?

Since I don't pay $860K in taxes, it will be a money losing proposition for them to spy on me. If they find I'm guilty of some crime it will cost them even more because I'll stop paying taxes and they'll have to pay to house me in prison. They can't do that sort of thing too much before even the United States exceeds its credit line.

[Anonymous Coward]

@DS999 - Re: @DS999 - $860K per target?

You didn't get it, it's not their money. Besides, in case you didn't know, US are very good at printing money.

[DS999]

Re: @DS999 - @DS999 - $860K per target?

You can always tell someone who doesn't understand how money works via their complaints about "printing money". You probably think the US has been printing money the last couple years, blame inflation on that, and don't realize that since mid 2021 trillions have actually been taken OUT of circulation as bonds held on the Fed's QE balance sheet have been allowed to mature without being replaced.

[trindflo]

How much are we doing this to ourselves for convenience?

When we give our smartphones access to our banking and install every fun sounding app, aren't we part of the problem? Would the spyware industry exist if only flip phones and hardened operating systems were being used? Does single signon make things more secure?

[doublelayer]

Re: How much are we doing this to ourselves for convenience?

It depends what you were doing with them, but probably not. Banking apps are rarely the targets of the attackers because there are a bunch of apps and each user probably only has one or two of them installed. Finding a bug in banking app A doesn't let you attack anyone who doesn't have an account at bank A and anyone who doesn't need access to it on their phone. Nor do they usually attack by having someone install a dodgy app. Malware of that kind exists, but targeted attacks like this can't rely on someone installing something for them. Mostly, they look for vulnerabilities in the OS itself or in particularly common apps, often communication ones like WhatsApp which are popular and have an easy way to deliver a payload to them by sending a message to the victim's number.

Nor are financial details the target of something like this. They're paying millions for the right to infect someone; they have enough money as it is. Usually, they want information. Your calls, your messages, your emails, and the ability to track your location and turn on your microphone. A flip phone has all the hardware needed to do that, and the only possible difference is that you might not sync your email to it because the interface makes it annoying to use. Flip phones have been able to read email for fifteen years, though, so nothing would prevent it from being an interesting target to users of stuff like this.

[Necrohamster]

Re: How much are we doing this to ourselves for convenience?

If you're a target for a state-backed hacker or other groups who use Pegasus etc, having your phone hacked is only one of a bunch of things they're probably doing to you. So using a dumb phone won't help in that regard.

Nobody's going to burn a chain of zero-days to get into your banking app anyway. Indian scammers are using social engineering to persuade people to send them money every day of the week.

[Ilgaz]

This is about Desktop security not server.

You can't do much if your profile is specifically targeted by a state or a billion dollar company however every single day passing with zero competition on the Win32 Desktop security, it goes worse.

Yea I am talking about Windows built in security. There is no conspiracy, it is just nobody is that good. E.g. even Mr Cutler himself wrote it, they would find a way. Actually, the attack surface is gigantic compared to pre Windows 10. A black hat really knows which one to break now unlike Win 7 which had thousands of security configs.

[Necrohamster]

"This is about Desktop security not server."

You must have read a different report, because the one I read was all about the exploitation of vulnerabilities on IOS and Android

[Necrohamster]

Funny how...

...the commercial surveillance industry has so many company founders who previously worked for IDF military intelligence (Unit 8200 or Unit 81) or the Mossad.

e.g. Niv Karmi (NSO Group) or Tal Dilian (Intellexa)

Coincidence?

[Graham Cobb]

Re: Funny how...

Neither funny nor coincidence. The Israeli government makes no secret about encouraging and using spyware. Right or wrong, they see it as critical to the continued existence of their country and the safety of their citizens.

There are many things about the Israeli government, and the IDF, I don't like. But at least they are not hypocritical about their use of spyware.

Russia, China, North Korea and the US are the governments who are two-faced hypocrites who pretend to dislike spyware but actually actively promote and heavily use it. One assumes they are (between them) providing much money and much air cover (from legal investigations) for the criminal gangs who now seem to be the main controllers of the various breaches.

[Necrohamster]

Re: Funny how...

Sorry, I use sarcasm a lot. Of course there's nothing funny or coincidental about ex-Mossad selling spyware worldwide.

Where ex-employees of state security services use their knowledge to make commercial spyware, they're way outside the remit of "spyware for Israel's national security"

Saudi Arabia might agree when it comes to Jamal Khashoggi's demise, but that justification is going to fall on deaf ears for the most part.