Apple's Pegasus lawsuit a 'declaration of war' against offensive software developers, says Kaspersky director

Kaspersky's APAC director of Global Research and Analysis, Vitaly Kamlyuk, has called Apple's lawsuit against Pegasus maker NSO a "declaration of war against software developers." On Tuesday, Apple filed suit against the cyber firm and its parent company for surveillance and targeting of US Apple users. Apple wants to prevent …

[Anonymous Coward]

Offensive Researchers

While I have no doubt Apple want to stop any research they don't control NSO are not just offensive researchers. They crossed a line selling the malware to various ever so slightly dodgy groups and organisations. As such Apple have a legitimate reason to sue here.

[Pascal Monett]

Re: Offensive Researchers

Indeed. Vitaly missed a golden opportunity to shut his mouth.

The NSO is not your garden variety of software developer. Conflating NSO state-approved malware writers with "software developers" in general is just muddying the waters.

Shame on you, Vitaly.

[Yet Another Anonymous coward]

Re: Offensive Researchers

And of course Apple/Google/Facebook/etc won't use any NSO decision to prosecute people who find vulnerabilities in the future - because they are all such nice friendly companies.

[Roland6]

Re: Offensive Researchers

But a NSO decision could open the door to cases against the US for Stuxnet...

[doublelayer]

Re: Offensive Researchers

No, it couldn't, because you already have all the legal rights you need to sue the U.S. over Stuxnet. The problem is that they will deny that they did it, and it's hard to provide sufficient proof otherwise. You would also have to prove that you were damaged by Stuxnet in order to have standing. If you can do both of those things, you don't need a new legal precedent for it. If you can't do both of those things, you still don't need one but you're likely wasting your efforts.

[Yet Another Anonymous coward]

Re: Offensive Researchers

But the Iranians didn't accept the terms and conditions before installing Stuxnet - so presumably the USA could sue Iran for pirating their software

[Roland6]

Re: Offensive Researchers

>No, it couldn't, because you already have all the legal rights you need to sue the U.S. over Stuxnet.

Expect once Apple has finished with NSO, there will be a costly set judgement and precedent set...

>The problem is that they will deny that they did it, and it's hard to provide sufficient proof otherwise.

It is going to be interesting to see how Apple provides sufficient proof of NSO's claimed misdemeanours...

[gnasher729]

Re: Offensive Researchers

Discovery. And when they refuse to open up, anything they don’t say will be used against them. This is a civil case.

[Anonymous Coward]

Re: Offensive Researchers

Pegasus is no different than the malware used in state sponsored attacks from Russia or China except that it's used for state sponsored attacks by Israel and is sold to other Western governments for their own state sponsored attacks. It would not surprise me to see the US or UK pop up as users.

Finding vulnerabilities and creating malware to exploit them is totally different from finding them and disclosing them like Kapersky does.

[Clausewitz 4.0]

Re: Offensive Researchers

US + UK are users of NSO. Didn't you read? USA govt. just asked for an additional agency stamp for US "companies" to be able to buy from NSO.

NSO is not blacklisted. The ability to buy from them was restricted to a few agencies.

Business as usual.

[BOFH in Training]

Re: Offensive Researchers

Yeap, sold only to other Western countries like India and various contries in the middle east. Wasnt the famous terrorist, the French President Macron under investigation via the tools provided by NSO?

https://www.bbc.com/news/world-europe-57937867

[elsergiovolador]

Backdoor smashed in

In my opinion it sounds like Apple has created ability for services to spy on its customers and now are upset that private company is also using these features?

Surely instead of "declaring a war" they should just patch the holes?

[Anonymous Coward]

Re: Backdoor smashed in

Surely instead of "declaring a war" they should just patch the holes?

They did. Here, here, and here.

[elsergiovolador]

Re: Backdoor smashed in

Well, given the lawsuit, you can't really trust these patches don't ship new set of holes for services to use.

[Anonymous Coward]

Re: Backdoor smashed in

Well, of course not. But as soon as an application accepts input from the user or an external source it's highly unlikely to be exploit free. We (software engineers) do the best we can with the tools we have available, but there are never any guarantees.

And if that's something you're not comfortable with, feel free to live off grid somewhere cooking all your meals from food you've grown/killed yourself over a camp fire, because that's what it'll take to avoid software these days.

[Anonymous Coward]

Re: Backdoor smashed in

Even that won't help. Aircraft and satellites would still be able to see you, some even through cover.

[Paul 195]

Re: Backdoor smashed in

I don't think @elsergiovolador has really grasped the asymmetric nature of cyberwarfare. To keep determined bad actors out of systems requires creating completely bug-free software. Not just in the code you are writing, but in all the other code you depend on.

An attacker only has to find one weak point anywhere from the BIOS up to the application layer to find a way in Even the hardware can let us down, as shown by the side-channel attacks that exploit information leakage from optimisation techniques like branch prediction.

[Anonymous Coward]

Re: Backdoor smashed in

On the other hand, having their own source code ought to be an advantage for Apple; that ought to level things up.

And are we really supposed to believe that a tiny company like NSO can do more fuzzing than the richest most profitable company in the world? Apple probably easily has more money available to do this kind of self-analysis than all the world's security researchers (blackhat and whitehat) combined.

[Yet Another Anonymous coward]

Re: Backdoor smashed in

To miss-quote some other chaps. Apple have to be lucky on every line of code, we only have to be lucky once

[Anonymous Coward]

Re: Backdoor smashed in

I don't think it works like that. Interfaces are fuzzable, not lines of code.

There are a limited number of interfaces, both API and physical. Apple are in a supremely advantaged position to be able to fuzz each and every single one of these, and thus should be able to sustain a high rate of flaw discovery on each interface.

That does not mean that Apple will always beat a third party to the discovery of a specific flaw, but the higher average discovery rate they'd have would become telling over time; there's only so many flaws to be found.

Apple ought to be in the same position as a casino; an occasional big pay out, but winning on average. Better still they'd be a casino that's able to worsen the odds as time goes by, and eventually even the most hardened addicted gambler will stop turning up.

[Anonymous Coward]

Re: Backdoor smashed in

It's not just the interfaces though. It's every line of code that is touched by data from any external source, starting from the local file system.

It's perfectly conceivable that carefully crafted data can pass any initial validation only to break something deeper down.

[Charles 9]

Re: Backdoor smashed in

Especially if multiple disparate pieces of code can be put together just so with just the right kinds of inputs. It's hard enough to find a subtle fault in a single piece of code, but to find a well-designed one spread out over multiple areas...?

[Clausewitz 4.0]

Re: Backdoor smashed in

Hardware is just software baked in a waffle.

[Snake]

Re: patching holes

But the fundamental elephant in the room, which people never want to seem to accept, is that humans are fallible. There will never be perfect, uncrackable computers without vulnerabilities. Ever. From hardware to software there will always be something soft, and if all else fails they'll just social engineer the wetware to get what they want.

Patch holes? Absolutely! But then another hole will be found, the patching will never end. The issue is state-sponsored hacking - we have it bad enough without the governments that are supposed to be working for their people hacking those very people's computers for selfish 'benefit'.

[John Savard]

Re: patching holes

Humans are fallible. All right then, let's have software and hardware that are designed by computers.

It will be difficult to eliminate attacks like rowhammer that way, though.

And while it may not be possible to completely eliminate vulnerabilities, generally speaking major operating systems today are so filled with vulnerabilities that there is a lot of room for improvement.

[Charles 9]

Re: patching holes

"All right then, let's have software and hardware that are designed by computers."

Fatal flaw in this, of course, is that computers are made by humans, too, meaning computers can be fallible.

[Lord Elpuss]

Re: Backdoor smashed in

"In my opinion it sounds like Apple has created ability for services to spy on its customers and now are upset that private company is also using these features?"

Your opinion is wrong.

[LordHighFixer]

I am not

Entirely sure I care. I mean there are low tech ways to organize against your government. I believe that if you are going to do that, no matter which government we are talking about, using your iphone, or any device with GPS features, is just looking for more trouble than you originally intended. That is what burner phones are for.

And good luck apple getting any money. By all mean take it to trial, I can hardly wait to see the 'discovery' phase..

[big_D]

Re: I am not

Yes, but in this case, the spyware was used against legitimate journalists, world leaders etc. doing their normal day-to-day business.

[LordHighFixer]

Re: I am not

"Yes, but in this case, the spyware was used against legitimate journalists, world leaders etc. doing their normal day-to-day business."

You seem to be making some kind of good vs evil argument. My argument is much simpler, if you don't want to be spied on, don't use things that can be spied on. As far as I am concerned every electronic device I own is spying on me and sending data somewhere I don't like. I expect it and accept it, and I act appropriately.

People may argue about the varying levels of expected vs actual privacy, but the bottom line is, once it is turned in to electrons, there is none, never has been, never will be.

[DS999]

They know they won't get any money

But one of two things are likely to happen. 1) somehow it goes to trial and there is a discovery phase, and some very seedy relationships with the worst regimes in the world are outed 2) NSO Group goes out of business, because everyone that doesn't want to be classed with the thugs in Thailand or the people who bonesawed Khashoggi will refuse to do business with them.

Sure its a shell game as there are other companies like NSO Group and you can't get rid of them all, but at least you can force the ones trying to operate as legitimate companies from doing business with the worst of the worst. There will probably still be criminal organizations selling such services on the darknet, but the authorities will go after those like they always have.

Sure people can say "where do you draw the line, should you do business with the US government since their hands aren't clean either" but I think when you support those murdering people with bonesaws that's a line everyone can agree on.

[Clausewitz 4.0]

Re: They know they won't get any money

Are you implying the US government does not murder people with bonesaws?

[DomDF]

Re: They know they won't get any money

No, it shoots them in the back or kneels on their neck until they can't breathe.

[shayneoneill]

Re: The next generation will attempt to port the kernel to Javascript...

I kind of hate this reasoning.

We don't want a world where only tech savy people can organize for political action. Thats just replacing old power heirachies with new power heirachies, and if the alt-right taught us anything, its that the extremists have tech savy people. I would still like my parents to also have a say in how their world goes, and my arty neice. And the vietnamese couple who sell me groceries each week.

And we have to assume that Farad the mechanic, whos also secretly a dissident in Iran who wants to overthrow the religious council and have a nice secular democracy probably knows about as much on how to secure his iphone as my grandmother did.

Its incumbant on the tech giants to secure that phone so Farad doesn't end up swinging from a crane in a public square because he doesnt know what a "Tor" is.

[Charles 9]

Re: The next generation will attempt to port the kernel to Javascript...

Problem with your idea is that governments can exert a lot of pressure. Overwhelming pressure, even. From angles that may not have a viable alternative (like radio chips--governments regulate airwaves, after all).

At some point, your exercise will just put everyone in DTA mode, which just leads to anarchy.

[Electronics'R'Us]

There is a big difference...

Between searching for flaws and responsibly disclosing them compared to using them to sell to high bidders for some very nefarious purposes that have possibly led to the death of some people and quite probably others being detained 'for the good order of the state'.

In other cases the threat of not being able to make a living is certainly an issue when the state is getting its hands on literally everything of interest in the phone and its surroundings.

The surveillance of politicians and press by certain governments is quite well documented elsewhere when they use NSO's wares.

Certainly Apple might not want pen testers from outside rooting through their kit (no pun directly intended) but that is not something they can really control.

So overall, I really can't see Vitaly Kamluk's comments as being the case.

[Yet Another Anonymous coward]

Re: There is a big difference...

>Between searching for flaws and responsibly disclosing them compared to using them to sell to high bidders

Yes one enables people to search for vulnerabilities as a full time job.

If you ban selling exploits then Apple/Google/Facebook can just offer 1c rewards for each exploit, and threaten to sue anybody else.

As a result only criminals have exploits. No exploits are ever made public and so all computers must be secure.

[doublelayer]

Re: There is a big difference...

Rubbish. I'll make it simple: search for exploit, allowed. Have exploit: allowed. Use exploit to invade a device you don't own: not allowed. That's all this would do, and that's what the laws currently say anyway. If you think the only way that security researchers can make money is selling their findings to malware creators, you're wrong. If existing security researchers do that, they've committed a crime.

[Anonymous Coward]

Re: There is a big difference...

Quote: "...Use exploit to invade a device you don't own: not allowed..."

Ah.....more misdirection. While the quote is true, it applies only to "data at rest".

What it leaves out is the widespread abuse of "data in transit"....you know....Snowden, NSA, Cisco, abuse of metadata.....and so on.

Privacy actually SHOULD apply to ALL personal data. "doublelayer" is observing the illegality of only one half of the problem.

[doublelayer]

Re: There is a big difference...

I am observing the legal concerns of the half of the problem this discussion is about. The malware affected user's devices, not data in transit. If you want to discuss something unrelated to this discussion, maybe here's not the right place.

[DevOpsTimothyC]

Re: There is a big difference...

Have exploit: allowed.

My $0.02 is that having an exploit for months and years is inexcusable.

The likes of Google/Microsoft/Apple/Facebook etc should face fines if they are not actively securing their products. Companies who sell physical goods are liable for the safety of their products and where there is sufficient danger to the public they recall defective products why should software companies be except?

[Charles 9]

Re: There is a big difference...

"Companies who sell physical goods are liable for the safety of their products and where there is sufficient danger to the public they recall defective products why should software companies be except?"

Haven't you seen? The worst of the worst know it's cheaper to just lobby the government to look the other way and NOT implement rules and regulations that would end up costing them. Look at the constant problem with water quality (exemplified by the Flint fiasco). Software companies know the technique, too, and have the advantage of having goods that don't necessarily have to be anchored to any one country; play sovereignties against one another.

[Anonymous Coward]

Just offer a life-changing bounty to anyone who provides exploit details that NSO is using. Indemnify them against any legal action re: stealing trade secrets. Get them on a plane and out of the reach of Mossad. Drop flyers all around NSO's HQ announcing the $bignumber bounty. You'll have the code within a week

[Anonymous Coward]

Doesn't Mossad have a reputation for "extraordinary rendition," though, meaning nowhere is really safe?

[Sandtitz]

Mossad is just a bunch of bumbling, murdering fools.

[Clausewitz 4.0]

Mossad guys are a bunch of sissies. Go after them with a knife/stiletto and they freak out.

Third-world countries police and military are tough.

[Potemkine!]

Mossad guys are a bunch of sissies. Go after them with a knife/stiletto and they freak out.

Hmmm... Mossad committed enough assassinations to prove you wrong.

[Jimmy2Cows]

And assassination is not the same thing as not legging it when someone steps to you with a knife.

High assassination count != tough and/or brave.

[W.S.Gosset]

In related news, Mike Tyson has joined MI6.

[Lord Elpuss]

"Mossad guys are a bunch of sissies. Go after them with a knife/stiletto and they freak out."

Having never gone after them with a knife, I wouldn't know; but given their track record it seems unlikely. Generally speaking, if the Mossad want you dead, you end up dead. Whether innocent bystanders also get taken down is a different question.

[stiine]

if Mossad wants you dead

The bystanders don't actually matter.

[TheOldGuy]

out of the reach of Mossad

Hmm... Good luck with that.

[Anonymous Coward]

Apple & C. want the information control - and the power to decide who is under surveillance or not.

We should start from an axiom - law enforcement agencies require to be able to access communication and data storage for investigations - which could be wholly lawful and to combat nasty crimes. Of course the same technologies can be used to commit nasty crimes - it's not different from guns. And even common people do employ surveillance cameras that can be used to protect people and properties, or to peep.

NSO still made the huge mistake of selling to the wrong government and agencies - and in some cases it can amount to a crime, and I'm not going to say that all governments and law enforcement agencies are wrong - although the more power they get the more accountable they must be.

Still these tools are here to stay - unless we want to see more government pressure to cripple cryptography, provide interception facilities, and require access to data stored by companies. But maybe that's what Apple & C. exactly want? Because that will put THEM in charge of what information can be accessed by law enforcement agencies, under their full control.

For example a spyware could hit - let's imagine for wholly lawful reasons - Tim Cook iPhone. And Apple would have no way to control it. But if law enforcement agencies have to ask Apple to graciously provide access to that, they have the power to decide what is accessed.

Just like banks offer ways to customers who can pay for it to get a far higher degree of "secrecy", I wouldn't be surprised if that happens or will happen in the comm/data storage arena....

[Phil O'Sophical]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

law enforcement agencies require to be able to access communication and data storage for investigations

Law enforcement agencies undoubtedly want such access, but it should be up to the courts to decide, on a case by case basis, if it is required.

[Anonymous Coward]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

The fact they need a warrant still means the law empowers law enforcement agencies with that access - they just need the proper oversight to avoid abuses - it's just separation of powers. The court authorize then and they access communications or data, Judges can authorize it but can't perform the investigation themselves. It's that simple.

And yet, what oversight aqnd accountability Apple & C. have? They force all your data through themselves. And decide about their access in very opaque ways.

[batfink]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

Unfortunately in some countries the courts will just do as they're told.

[Strahd Ivarius]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

Are you speaking of the US secret courts?

[doublelayer]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

They may not have been, but I will. Yes, those are courts I include on the list, which is why I take a dim view of NSO and companies like them facilitating the penetration of technical defenses. The U.S. may not be using them; I have not seen them on any of the lists of NSO clients that have been released so far. However, the U.S. develops similar exploits and I want them to stop. I want everyone doing such things to stop committing these crimes, and if NSO is the low hanging fruit on the issue, then start there.

[stiine]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

They also don't like to be told what to do by foreign courts. Its a little thing called sovereignty. Perhaps you've heard of it.

[Anonymous Coward]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

@LDS

OK, you don't like Apple. I get it. I look forward to reading more of your theories on, let's say, El regs' privacy policy, or maybe Google? Or whatever search engine you use. For what it is worth, Here is Apples' privacy policy. It's written in English, not that legal stuff.

Warning, PDF link.

https://www.apple.com/legal/privacy/pdfs/apple-privacy-policy-en-ww.pdf

[stiine]

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

Court's in your country? Or their country?

[xyz123]

In my opinion, Apple wants offensive researchers out of the field - said Putin-controlled spokesperson for Russian "anti-virus" company thats been banned from dozens of government systems due to integrated "vulnerabilities".

[MrDamage]

Popcorn Time

> "Furthermore, a US appeals court ruled earlier this month that the Israel-based firm cannot hide behind its government clients when it comes to litigation"

In which case, I can't wait for all the class action lawsuits against the companies that contribute to the military-industrial complex, brought against them by the various human rights organisations. Sorry Blackwater, you're fucked now, according to this court.

[W.S.Gosset]

Re: Popcorn Time

You should change your username to be plural.

[Anonymous Coward]

Apple's Logic

NSO = Bad. NSA=OK.

[Paul Hovnanian]

And another thing ...

You need to put a stop to those people manufacturing screwdrivers and spudgers.

[Short Fat Bald Hairy Man]

Shakespeare has it

A plague o’ both your houses

[W.S.Gosset]

Re: Shakespeare has it

Don't drag China into this.

[StargateSg7]

I severely MISREAD this article as if they were talking about getting rid of OFFENSIVE to one's sensibilities software. I.e. get rid of all software that has swearing, sex, violence, etc. in it .... which I thought GOOD LUCK WITH THAT! It took me a second or ten to realize they were talking about software that exploits machine and user vulnerabilities.

That goal of removing offensive-capability software is kinda difficult to do when I could replace parts of the BIOS on a GPU (i.e. graphics card) to take screen shots every 5 seconds and compress/encrypt it out to some unnamed website folder OR I could modify ANY software executable in a certain way that its hash value (i.e. digital signature) STILL calculates out to the original correct value BUT NOW HAS the modified bytes in it that do my dastardly deeds!

...OR....

I could secretly strobe your display in such a way to embed sub-conscious and subliminal messages that tell you to buy my products or goto my websites which will steal your passwords or make you spend large amounts of money on useless items or services! I could even have those sub-conscious commands MAKE YOU drink rotten milk to poison you so I could profit out of the secret Two Million Euro insurance policy I took out on you with ME as the beneficiary! Do that enough times and I could retire and BUY the Playboy Mansion WITH the models as part of the deal!

....AND.....

I could make microcode software that injects itself and hides in the 32 kilobyte caches of automobile microcontrollers which are ALWAYS kept alive by the thin trickle of car battery power. That cache based software then turns on the brakes OR the accelerator within your post-2010 era drive-by-wire vehicles as my cache-based software intercepts data from various car sensors sensors and on-the-fly changes their values when they redirect to the destination microcontroller! I could make you drive into a river or or off the cliff and collect on some insurance money!

SOFTWARE CAN DO ANYTHING !!!!!!!

BEWARE THE SOFTWARE YOU CANNOT SEE and DO NOT KNOW ABOUT !!!

This is all about "THE UNKNOWN UNKNOWNS" --- Evil people creating malicious code that can wreck havoc against YOU and your loved ones is but a mere few days or weeks worth of coding and injecting into your VULNERABLE devices and systems. Even a TOASTER can be compromised these days! Then again WHO CAN YOU TRUST?

Apple?

Microsoft?

Oracle?

Me?

You don't NEED to regulate software -- BUT YOU DO NEED TO EVALUATE IT! And that means FULLY OPEN SOURCE CODE that industry experts from a WIDE variety of backgrounds that BOTH are paid AND do volunteer their time to review and bring to the public light their intended and ACTUAL function.

Even COMPILERS and INTERPRETERS can be compromised SO AGAIN ---- Keep ALL software in ANY critical system OPEN FOR PUBLIC and INDUSTRY REVIEW !!!

V

[W.S.Gosset]

Offensive...

Anyone else remember the "Are you offensive enough?" idiocy of the senior officers during Wipers/Ypres?

First thing that popped into my head when I read it; couldn't get it out for the whole damn article.

[YetAnotherJoeBlow]

Devil's advocate...

It will be interesting to see if Citizen Lab continues to report about 0 days to the public or just to Apple - or perhaps focus on just Android and Windows to publically report.

[Anonymous Coward]

Apple's argument is that the software "weaponizes powerful state-sponsored spyware against those who seek to make the world a better place."

Is that meant to imply that _Apple_ "seek to make the world a better place"? I thought their only motivation was to make more money, just like NSO.

While NSO does seem to be guilty of selling Pegasus to "the wrong places", surely that's something arms manufacturers have been doing since time immemorial.

[RPF]

2 wrongs don't make a right.

[Anonymous Coward]

This is like listening to Jimmy Savile and Rolf Harris bicker over who looks after the grandkids.

[amanfromMars 1]

Novel NEUKlearer Times/HyperRadioProACTivated IT 0Days Ahead .... whether you want them or not.*

If Steve Jobs were alive, Apple would have AI to do with as he liked.

Now though has Apple AI to do with as AI like.

And that may or may not be Advanced or Artificial or Augmented and Alien Intelligence for IntelAIgent Appled Applications/Core Promotions and Vital Projects.

And for that one doesn't need the Wealth of an Apple or an Alphabet Organisation to Function and Flourish/Flower and Seed for such Autonomously Generates ITs Own Feeds of Treasure to Share Everywhere Needed.

You might like to ask yourself if that is what is currently before you ..... and whether extant legacy systems would be self-destructively prone to trying to oppose and destroy rather than assist and reinforce it.

And what do you think might then befall such legacy systems whenever the former rather than the latter option is exercised?

* .... Such is Fundamentally Revolutionary Progress via Fait Accompli Roots to Boot. And maybe hard to believe is true in deed, indeed, but that is your problem to concede and overcome.