Samsung embeds IronSource spyware app on phones across WANA

Wherever you are from or whatever side of the conflict you are on, I think we can all agree that it’s never been easier to infer so much about a person from “semi-public” sources such as companies selling customer data and built-in apps that spy on their users and call home. It allows intelligence agencies to outsource intelligence gathering to the market, which is probably cheaper and a lot more convenient than traditional methods.

“Privacy is a human right” landed on deaf ears but hopefully politicians will soon realise that it’s a matter of national security too.

Check the weather today, get bombed tomorrow.

We all like to imagine this super cool clandestine hacking operation using peoples mobile phones to secretly track people who visit nuclear facilities back to their homes.

The much more logical explanation is someone approached a low level employee at the MEAF who turned over a USB stick with the governments org charts and payroll records in exchange for their kids getting a full ride to a prestigious foreign university.

Here is how Pegasus seems: - China has 1.5 billion people, lots of resources, would profit a lot economically if they found a way to hack iOS, etc. But yet couldn't hack it. - Israel with its 7 million people, not only hacks iOS multiple times, but does it to spy on its allies.

Now I've seen the threads analysing Pegasus' complexity, I don't know if it's been reproduced, and if it has then I guess it logically proves me wrong (the tinfoil hatter in me still thinks its right though).

Here is why:

Israel has a lot of silicon fabs or R&D centers, now it makes ZERO sense for the US to have fabs or R&D centers in Israel, since that country is (allegedly) always at the risk of being bomber for no reason at all (yeah right).

Intel has had fabs in Israek since the 80s, why not in Japan or France or the UK (France and the UK are close allies to the US and have no earthquakes or risk of being bombed), why not even Canada?

And I compared the dates of when intel started putting the Intel Management Engine in all of their CPU and the date of which they built their biggest fab in Israel, then I went down the rabbit hole of when AMD started using PSP (similar tech to Intel ME), and it coinciding with it buying a large pentesting startup in Israel, then starting to build its R&D centers there, Apple and Qualcomm have similar stories.

Obviously this is all tinfoil, and while the dates coincide it's obviously not enough.

But to each their own, and I choose to treat my tech as if it was all was backdoored already, because for me the evidence (while not enough to be sure) is enough for how much I value my privacy.

In addition, saying that

> someone approached a low level employee at the MEAF who turned over a USB stick with the governments org charts and payroll records in exchange for their kids getting a full ride to a prestigious foreign university

is an oversimplification on multiple levels:

1. Low-level employees typically don't have access to sensitive information.

2. With human intelligence, there is always a risk that the person you (e.g. Israel) are in touch with (e.g. an Iranian officer) who pretends to be a "double agent" (e.g. leaking info to Israel), is in fact a "triple agent" (e.g. actually working for Iran to mislead Israel).

3. You can send your kids to foreign universities but not your siblings, your parents, your wife's family, and so on... Some of your beloved ones are almost certain to suffer the consequences of your actions. High treason is no joke.

We, the people, need to demand and force our politicians to work for us.

You would think, but when I was interning (well, it was a paid internship) for a company, I was fixing an excel spreadsheet with payroll information for an entire department of a few hundred people. Not the best piece of "opsec", but when you are in a hurry (pay was due in a couple of days) and most people are on vacations "hey the junior kid can probably fix it, he seems fine" is a way too common approach. And it is fine - sometimes for a long time. Until it isn't.

Yes, privacy is a question of civil defense in the drone age. But the existing crop of states will never acknowledge that; their structure and institutions presume precisely the kind of mass databases of PII that create this vulnerability, as well as institutional transparency for public accountability. This makes them structurally vulnerable to insurgencies that expropriate those databases for targeting. The existing states will continue to clutch at their fantasies of adequately secured taxpayer databases until their territorial control (itself an anachronism in the drone age; boots on the ground can no longer provide security against things like Operation Spiderweb) has been reduced to a few fortified clandestine facilities.

Things are going to be very unpredictable and, I suspect, extremely violent.

SW coming out of Korea's domestic industry giants isn't any better. Because they used to treat SW like a cost center or another item on the BoM.

IIRC, the only way to do online banking in Korea years ago, was you needed Internet explorer and some active-X plugin that supported encryption.

Some Korean giants do have good SW, but a lot of it is developed internationally by offices outside of Korea.

What makes you think China can't hack iOS?

Since then there has been a movement to reduce Chinese vendors in general our if security concerns, as well as to improve the security posture of the mobile networks by doing things like "encrypting connections" and "switching away from telnet".

On the other hand, the Chinese managed to break into the US wiretapping system, so it's not like other networks aren't vulnerable either.

Plausible deniability.

30 milligrams of high explosive is enough to open your daughter's skull, or, more relevantly, your commanding officer's daughter's skull, and there are a thousand ways to deliver it to her if she can be tracked: in pager batteries, crawling, swimming, floating, waiting for ambush, hitchhiking on migratory birds, hitchhiking on car undercarriages, in her Amazon Prime deliveries, falling from a hydrogen balloon in the mesosphere, and so on. And if 30mg is too much, 2mg of ricin on a mechanical ovipositor will do just as well.

All of this is technically possible today without any new discoveries. At this point it's a straightforward systems development exercise. And you can be sure that there are bad people working for multiple different countries' spy agencies who know this; they don't need me to tell them.

That you know of. Maybe they just don't indiscriminately sell the results to anybody who shows they have money. Or maybe they have different strategies for spying.

> - Israel with its 7 million people, not only hacks iOS multiple times,

NSO and friends find zero-days or buy them on the open market (not just from Israel). Citizen Lab has identified specific vulnerabilities used to install Pegasus. The exploits don't require or use CPU back doors.

... and you think Israel's smaller population somehow translates into better infiltrators than China has, but not better hackers than China has? Israel also makes better halva than China, by the way.

That kind of "logic" is what turns you into a loony raving on a street corner somewhere.

> but does it to spy on its allies.

Everybody spies on their allies, at least opportunistically. But Pegasus is a commercial product, sold to basically every government and mostly used to spy on normal people, not other governments. The people writing it have ties to Israeli spies, and I'm sure it's been used by Israeli spies, but it's general-purpose.

> Israel has a lot of silicon fabs

As far as I can tell, Israel has one facility capable of making remotely serious CPUs. It's owned by Intel. There are no phones using Intel processors.

The processors in iPhones are "Designed by Apple in Cupertino" and fabbed by TSMC in Taiwan. The processors in basically all other phones are ARM, and most of them also come from TSMC. Pegasus does not run on Intel processors, ever.

> And I compared the dates of when intel started putting the Intel Management Engine in all of their CPU and the date of which they built their biggest fab in Israel

So the fab somehow reached out into the rest of Intel and retroactively caused it to develop a heavily advertised feature?

There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race.

For example, there are many ethnically Chinese people who grew up in the West, working in businesses, in countries where there is a culture of security.

Now, you could label it 'culturalist', and maybe it is, but there are definitely inferior and superior cultures. Especially, there are parts of cultures which are quite comparable this way.

While we are talking about flying drones, we are not far off from Slaughterbots becoming reality.[0] Why bother with surgical assassinations if you can blanket entire regions with with swarms of autonomous seek-and-destroy explosives?

After all, as last two years have so amply demonstrated: people are fine with genocide.

0: https://www.youtube.com/watch?v=O-2tpwW0kmU

If there are spies in foreign countries going around offering life-changing sums of money for USB sticks, which people are accepting

is it not also plausible that folks at google/samsung/apple/aws/cloudflare/microsoft are getting offered life-changing sums of money for leaving their work-from-home laptop unattended for 5 minutes?

Last two years? Try last few decades at the very least. People only care about the war in Gaza more because it's controversial. For non-controversial cases people just agree it's bad but shrug their shoulders.

https://en.wikipedia.org/wiki/Bosnian_genocide

https://en.wikipedia.org/wiki/Rwandan_genocide

https://en.wikipedia.org/wiki/Darfur_genocide

What's "just" a war crime amongst friends?

From what I've seen with bribes, it doesn't even take life-changing amounts of money.

Why bother? For the same reason to bother with surgical assassinations if you can blanket entire regions with nuclear fireballs. Radioactive wastelands are unprofitable! This is a general problem with genocide: it only gets you land, and since the Green Revolution land is abundant. Protection rackets, on the otehr hand, are highly profitable, but only with some exclusivity; if extortionists multiply, the unique Nash equilibrium is multiple gangs that collectively demand many times the victims' total revenues, resulting in ecological collapse.

More generally, the threat of violence is only effective as a form of coercion when you can credibly withdraw the violence as a reward for compliance. Violence provides no incentive to comply to someone who believes they are just as likely to be a victim whether they comply or not.

But swarms of autonomous seek-and-destroy explosives are plausibly the most effective way to provide that surgical-assassination threat, perhaps combined with poisons, solid penetrators, and/or incendiaries. The Minority Report spiders (not yet technically feasible) or a quadcopter can be enormously more selective than a GBU-57, a Hellfire missile, or even a hand grenade, and can choose to avert their attack at the last millisecond upon the presentation of properly signed do-not-assassinate orders, even if long-distance communication is jammed.

>There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race.

This just seems like nitpicking to me. Colloquially most people would classify discrimination based on country of origin, or "culture" (whatever that means) as racism, even if it doesn't meet the technical definition. For instance Trump's travel bans have been called by many as "racist", even though it covers a bunch of countries, and even though the countries are majority muslim, it also excludes major muslim countries like Pakistan and Indonesia.

The gop is controlled by donors who are mostly free market liberals. Elon won’t let anyone “censor” (regulate) x. The democrats don’t care about national security historically, and it’s not currently an issue their cosmopolitan TikTok loving base cares anything, at all, about. “Security” is something that most democrats I talk to now associate with deportation or military spending, both of which they ferociously hate. Across parties, policy and discourse are reactive. Security requires a proactive orientation that it seems the public sector may structurally lack.

Security and encryption is taken as a given by Western regulators given how many times they pass laws to break encryption. If you look at targeted 0-days, the conclusion would be more along the lines of the very best hardware+software is barely secure.

- the smaller country hacked ios, have to sell it to recoup r&d costs, got caught many times.

- the larger country hacked ios, don't need to sell it around, haven't been caught.

Nobody is going to believe you're talking about real things if you let people call your argument "racism" so it's not nitpicking if you can explain why it's not. Also the word "discrimination" is itself a loaded term.

And yes areas having cultures is real. Sometimes it's tied to country, sometimes it's not.

> Trump's travel bans have been called by many as "racist", even though it covers a bunch of countries,

I'm confused? Covering a whole bunch of countries sharing a demographic is much more likely to be a racist move than picking one or two.

> and even though the countries are majority muslim, it also excludes major muslim countries like Pakistan and Indonesia.

That's a good argument against saying "muslim ban" but I'm pretty sure a focus on the middle east makes it more about race.

It's interesting you would write this as if nobody's pointed out actual cultural differences yet.

[The nuclear scientists on the other hand are much more questionable because its pretty unclear if they are legal targets at all]

Or investigation into some russian topics: https://theins.ru/en/inv

https://www.bloomberg.com/features/2021-supermicro/

Now, we do still need to respect cultural differences where it makes sense and consider the historical context behind cultural differences, such as colonialism.

https://www.cve.org/CVERecord/SearchResults?query=supermicro

Of course, Israel has hit hospitals in Tehran. And condos. War crimes.

So, no matter how you slice it, Israel commits war crimes as a matter of course.

Now, one could object and say that Israel has to commit war crimes because it's so endangered. If that's the case, why doesn't it go to the security council and get authorization for lethal military action? Who on the security council would vote against Israel if the threat was remotely real?

Other actions in this conflict of course could be crimes and require appropriate analysis.

> Since Israel started the war without authorization being the security council, it's legally the aggressor. Which means the actions in of themselves are crimes, regardless of where they are conducted.

I disagree with the way you phrased this. The analysis of if the use of force is legal in general should be separate from if individual actions are war crimes. See https://www.icrc.org/en/law-and-policy/jus-ad-bellum-and-jus... which emphasizes that jus ad bellum is separate from jus in bello.

Israel is probably going to claim self-defense here (you do not need UNSC permission for a defensive war). The claim is probably pretty far-fetched unless there is some bombshell evidence we are not privy to, as the threat does not seem imminent the way self-defense normally requires.

OTOH - the last time anyone cared about the crime of agression was germany in WW2 (although there are some voices about ukraine & russia). People tend to care much more about war crimes than crimes of aggression.

> Israel has hit hospitals in Tehran

I'm not aware of this allegation. I did hear an allegation from Iran about a hospital in Kermanshah. Regardless, if it is true, it would indeed probably be a war crime. (Generally speaking. Details do matter in these sorts of things)

> And condos

I think the analysis of this would require knowing what specificly was targeted. Generally of course, civilian housing is not an acceptable target, but if for example,it was housing for senior military leadership, that might change things.

> Now, one could object and say that Israel has to commit war crimes because it's so endangered.

If by war crime you mean commit "agression" (to be clear, the crime of agression is not a war crime. These are two separate categories of crimes), this would be an argument that the act is not "agression", since defensive wars are allowed to be done without UNSC approval. You only need UNSC approval if you are not facing an imininent threat.

> Who on the security council would vote against Israel if the threat was remotely real?

Security council is largely about geopolitics, and russia & iran are allies.

The US behaviour is despicable, but ultimately it hasn't really changed anything.

Snowden was a contract Sharepoint admin. He was on the absolute bottom of the org chart.

Anyone who runs a country, especially senior politicians, just shouldn't have a standard mobile.

It should be a built from the ground up phone by your own countries government services. Running GrapheneOS or something.

And you shouldn't have a second phone to have your affairs either.

And open war crimes like intentionally killing civilians (TV broadcasters in Iran for example, or Gaza en mass)

lol. lmao even.

this is the holy mary of security, politicians (US) will not give a damn as long as they’re not the ones being targeted and as long as the ad giants like google and co keep lining their pockets.

Technologies are morally agnostic: a knife, a rifle, a piece of cryptography, they all work equally well for the noblest and the most nefarious purposes. It's the humans' task to structure the society in such a way that good uses of technology mostly dominate evil uses.

Hence, I suppose, important figures will eventually disappear from the public eye. Definitely, a president or a governor must be present in person at many events. But e.g. CEOs of military contractors, or even key scientists and developers in certain fields, may start to fade away, turn pseudonymous, and virtualize, now that remote work and videoconferencing is normalized. They would still be somehow trackable as normal citizens, but their visible connection to their work would be severed and kept an utmost secret, literally a life-and-death secret.

This would be good news for national defense, but bad news for any dissenters who cross any powerful-enough entities for those to consider an assassination or at least blackmailing. Unlike a hitman, a hit drone can be completely and safely destroyed beyond recognition within an hour, by burning it and grinding the ashes.

Also, precisely delivered non-lethal means could be quite effective, and hard to track. Inject or just spray a bad virus to disable your opponent for several critical months. Spray a potent allergen if the target is allergic. Inject some LSD into politician's bloodstream an hour before an important meeting or speech. "Innocent" stuff like that.

One thing to keep in mind is those people are already paid quite well. What life can you offer them that they don't already have? Blackmail is a likelier angle.

https://www.wired.com/story/minnesota-lawmaker-shootings-peo...

Like, for example, cultures which are outwardly hostile towards women and their autonomy don’t keep that as a secret. In those places, it’s well known and obvious.

I've worked in many restaurants and a lot of the health scores are stacked against ethnic restaurants and how they prepare foods.

Your score gets knocked down if you have soups simmering for too long, but in Chinese cuisine it's often times common to have the broth cooking for more than 12 hours.

This also explains the more prevalent ignorance concerning the other two genocides of your list: they are simply for away from the place the respective person lives.

WNYC's On the Media carried several interviews with a documentarian filming Alexy Navalny as Navalny and the documentarian team identified Navalny's (initial) would-be assassins, including various FSB agents. They specifically targeted a person they'd think might have weak opsec, a scientist directly engaged in producing nerve agents (novichok IIRC). His core competence was chemistry rather than spycraft. The documentary team included a former Bellingcat investigator:

Brooke Gladstone: In the months following Navalny's poisoning, Christo Grozev, former lead Russia investigator at Bellingcat, was stuck in Vienna with filmmaker Daniel Roher. The two had just been booted from Ukraine where they had been trying to film an investigation. Now Grozev had lots of time on his hands and a laptop and a fresh stack of data from the Russian black market....

Christo Grozev: When we were looking at the Navalny poisoning, we thought, "Well, they must have used the same scientists. They can't have hundreds of scientists who do this. This has to be kept top secret. These people have to take the risk to manufacture this toxin." I started looking at the phone records of these scientists, and we bought them on the Russian markets where you can buy absolutely any kind of data.... [Navalny's people] provided the data of how Navalny had traveled to what locations. I matched it to the known travel data of the poisoners and spies. We saw this pattern, essentially a group of six to eight FSB poisoners had been tailing him for more than four years to a total of 66 different towns and cities.

<https://www.wnycstudios.org/podcasts/otm/episodes/revisiting...>

Other general coverage (searching "russia black market data"):

"Russian data theft: Shady world where all is for sale" (26 May 2019)

According to cyber-security experts, vast quantities of supposedly private data - including from Russian state institutions - are bought and sold every day....

<https://www.bbc.com/news/world-europe-48348307>

And for a long time. From 2009:

Goldmine of black market in Russian data

Gorbushka Market, just outside central Moscow, does a thriving trade in any electronics good you could want: mobile phones, plasma television sets, the latest DVDs, and, if you ask to see them, software peddlers will show potential clients a list of “databases”.

These consist of CDs with names such as “Ministry of Interior – Federal Road Safety Service”, “Tax Service” and “Federal Anti-Narcotics Service” and cost about $100 apiece. Each contains confidential information gathered by Russian law enforcement or government agencies: anything from arrest records, personal addresses, passport numbers, phone records or address books to bank account details, known associates, tax data and flight records are on offer...

<https://www.ft.com/content/07dedd34-d921-11de-b2d5-00144feab...>

Archive: <https://archive.is/UPPHK>

And 2005:

"In the stolen-data trade, Moscow is the Wild East"

<https://web.archive.org/web/20050708015611/http://www.globet...>

Adjacent article on Bellingcat OSINT generally (2024), though nothing on black markets:

"The forensic empire that is Bellingcat"

<https://www.theprojectcounselgroup.com/2024/06/19/the-forens...>