Stopping Pegasus for Dummies

23Sha-ger

K8y
NSO are professional.
The electronics and gadgets are just a playground. Everyone uses them. Both good and bad guys.
You need to have some sort of a way to get the "idiot" ones. Those who don't use GOS, those who do
the actual crimes. They use cheap Androids and out-of-date iPhones. This race will never end.
Cellebrite does a good job as well but I don't like their policy of selling the technology to anyone.
But that's forensics, you need to get the device first, not blatant internet compromise.

This will be a cat and mouse game forever. Sometimes the red teams find it first, get the high value
targets, and then it's patched. Sometimes the blue team (what you call good) find it and the read team
has to find another ones. One day at an RND office at any of those groups will tell you how hectic it is :)

K8y

23Sha-ger I just want to know remote 0 click attacks can be stopped. It sounds like they can if I'm right above. : /

userofgos

K8y GrapheneOS has great deal of exploit protections you can read about here: https://grapheneos.org/features#exploit-protection

Apple has recently added their own Memory Tagging implementation in their iPhone17 line-up: https://security.apple.com/blog/memory-integrity-enforcement

Hopefully, you do take time to actually read these links, they will answer a lot of your questions :)

de0u

K8y I just want to know remote 0 click attacks can be stopped.

I believe the situation right now is:

Zero-day remote vulnerabilities for phones are very rare, and thus expensive, and thus deployed only against somebody who is a specific target by a wealthy organization. Zero-day remote vulnerabilities for phones are not something that just happen in the sense that earthquakes happen.
At present, zero-day remote vulnerabilities in phones are something that developers work to avoid and mitigate, but the situation is not that if people just tried a little harder for a year or two the problem would be solved.

Ten years from now the situation may be different, but that would require a lot of difficult and time-consuming development work.

What can people do now to reduce the risk of a zero-day remote vulnerability?

Run less software! Adding apps means adding more code and more potential vulnerabilities.
Be more selective! Some messaging apps have a lot more known exploits than others.
Run an OS with more hardening and mitigations if possible.
If one is personally likely to be the target of an organization willing to spend $100,000 on surveilling one, hire a security consultant. Changing behavior in specific ways might help, but general worrying about RCEs won't help.

Zero-day RCE vulnerabilities are serious and dramatic, but for almost everybody they are not a significant threat. My nosy neighbor is not going to spend $100,000 to break into WhatsApp or Telegram on my phone. A criminal in a foreign land is not going to spend $100,000 to break into a banking app on my phone to steal $5,000 from my bank account. (This is especially true since I don't have WhatsApp or Telegram on my phone.)

23Sha-ger

NSO export approval depends on this. Read and translate:
https://he.wikipedia.org/wiki/%D7%90%D7%92%D7%A3_%D7%94%D7%A4%D7%99%D7%A7%D7%95%D7%97_%D7%A2%D7%9C_%D7%94%D7%99%D7%A6%D7%95%D7%90_%D7%94%D7%91%D7%99%D7%98%D7%97%D7%95%D7%A0%D7%99

Basically if the USA will sell it, and there are no sanctions, NSO will sell it. Government to government.

The tools exist and can be bought legally or via "legal" exploit brokers. Funny, some of them are
in France. Regards to Chaouki Bekrar, CEO @Zerodium. He sells stuff that his government later claims illegal.

M_2_Sade

23Sha-ger Are you seriously implying that one shouldn't do journalism or then its ok if his life is taken ?

23Sha-ger

de0u
You are correct about most of your points except prices.
Here is a Russian buyer:
https://opzero.ru/en/prices
I can quote more than 3 that don't specify prices in the public, but pay 1M for such things.
So you were only off by a 0. ;)

Vomitorius

One licence of pegasus cost like 50k bucks, so they really gotta be sure you are this important

Ilgar

23Sha-ger our regional allies

shame on you.

Olaolaho

The prices have dropped significantly for zero days!! There are much more available then only pegasus and they are used very often.. Not just in the wild but specifically targeted persons and you don't need to be a terrorist!! I will not go in to much details but there is proof what i cant put up here that in the last 12 months many law enforcements in many European counties and Australia have used and are still using pegasus kind zero clicks against suspects of organized crime. Not the Pablo Escobar's or el chapos from the world but your average drugs importer/distributors!!

50.000-100.000 is long gone. The only entities who pay that are governments who pay it for discretion because of the people who they attack like presidents or ministers what needs to stay confidential!!

K8y

Olaolaho prices have dropped significantly for zero days!! There are much more available then only pegasus and they are used very often.. Not just in the wild but specifically targeted persons and you don't need to be a terrorist!!

This is what I feared. So do we have competent people quickly patching the vulnerabilities thereby making these pegasus type intrusions very unlikely on devices that get the patches?

GrouchyGrape

Olaolaho There are much more available then only pegasus and they are used very often

Please provide sources, otherwise these claims are meaningless. We should be an evidence-informed community that doesn't get lost in fictional worlds of conspiracies. Not saying you're wrong, just saying you need to backup your claims.

K8y This is what I feared.

While some amount of "fear" can be beneficial if it turns productive and soon thereafter dissipates, don't spend your life fearing things you aren't certain is legitimate. Remember, acute fear = helpful, chronic fear = toxic.

Don't believe anything someone says on the internet just because it confirms what you were already thinking. Demand real evidence, not just he said/she said nonsense.

de0u

Olaolaho The prices have dropped significantly for zero days!! [...] 50.000-100.000 is long gone.

If there are so many out there, surely the security industry is aware of that change (including people who lurk on malware exchanges). Is there a conspiracy to keep this news a secret, or is it possible to cite reports that have been overlooked by members of this forum?

Has Citizen Lab documented a sharp rise in victims due to the claimed sharp rise in availability of zero-days? If not, why wouldn't they?

If there is verifiable support for the claim of an escalation in the threat landscape, that would be interesting. If not, then unverifiable alarming claims are not what this forum aims for.

Olaolaho

Until today there is not a proven successfully attempt on a grapheneos device so there is no panic needed these kind of company's are more focused on the most used devices like iOS and stock android.
That being said its not impossible!!

« Previous Page