The NSO Hacking Edition

Noah here. Over the last two years, the NSO Group has come up in a few WITIs. In November 2019’s Hacking Edition, Colin wrote about NSO’s role in helping governments spy on journalists:

A particularly important recent example comes from software made by the Israeli company NSO Group, a firm that contracts itself to governments ostensibly to combat terror threats. Its corporate purpose touts global security and stability, but their tools are being retro-fitted for repression and harassment. NSO developed technology called Pegasus to co-opt WhatsApp, a popular and otherwise secure messaging platform. WhatsApp traffic is encrypted, meaning that even if it is intercepted in transit it is of little use—which is why nefarious actors, state intelligence agencies, and others are working to get inside phones to read the messages after they are deciphered.

NSO came up again in February’s BlastDoor edition, which outlined the new security measures taken by Apple to help protect against so-called zero-click exploits. This is the type of attack where an adversary gains access to private information without the target ever even interacting with a link in a message or an attachment in an email.

Why is this interesting?

I’ve been reading Nicole Perlroth’s new book This Is How They Tell Me the World Ends, which outlines the history of cyberweapons and how we found ourselves in our current perilous global cybersecurity position. Not surprisingly, NSO plays a prominent role throughout the story. The company seems to have carved a niche out for itself as the go-to source for “endpoint” surveillance tools. In other words, they are specialists in getting government agencies onto a specific device—particularly mobile ones—and keeping them there without the target knowing. “What NSO offered law enforcement was a powerful workaround, a tool to keep from going blind,” Perlroth explains. “NSO’s technology gave authorities access to data before and after it was encrypted on their target’s device.” 

But it’s not just how they got those authorities onto those devices, which involves a series of security exploits, but also critically how they kept them there without arousing any suspicion from those who had been hacked. It turns out the buyers of hacking tools want the same thing as the rest of us—better battery life. Here’s Perlroth again:

One of the biggest selling points was that the spyware was “battery conscious.” One of the few tells that you may have spyware on your device is a constantly draining battery. All that spying and siphoning can be a battery hog. But Pegasus came with a nifty trick. It could sense when it was killing battery life, shut itself down, and wait for a target to connect to WiFi before extracting any more data. This was, as far as I could tell, the most sophisticated spyware on the commercial market.

How much does all this cost? As of 2015, “[NSO] charged a flat $500,000 installation fee, then another $650,000 to hack just ten iPhones or ten Android phones. Their clients could hack an additional hundred targets for $800,000; fifty extra targets cost $500,000; twenty, $250,000; and ten extra cost $150,000.” Presumably, things cost a lot more now, as the tech companies have taken on a much deeper commitment to encryption and keeping hackers—both state and non-state actors—out of their systems and the devices of their customers (not always successfully, as evidenced by the recent SolarWinds mega hack). As Perlroth argues (and I agree), this arms race doesn’t look like it’s going to end anytime soon. (NRB)

Product of the day:

We love shouting out products from friends of WITI. Former Apple designer Eddie Cohen has been working on Walden, a new meditation brand. The first product is a cushion that is beautifully designed and made by NYC craftsmen and made from natural materials including buckwheat hull sourced from Upstate New York. We have one and can attest that is great. Use the code INTERESTING for 10% off and free shipping. (CJN) 

Quick Links:

• Related to today’s WITI: messaging app Signal reverse-engineered a data-extraction device, found vulnerabilities, and claims they’re going to exploit those vulnerabilities moving forward. (NRB)

• Is the Apple TV remote finally good? (CJN)

• The Afrofuturist Sounds of Dawn Richard (CJN) 

• A radical guide to spending less time on your phone (CJN) 

Thanks for reading,

Noah (NRB) & Colin (CJN)

Why is this interesting? is a daily email from Noah Brier & Colin Nagy (and friends!) about interesting things. If you’ve enjoyed this edition, please consider forwarding it to a friend. If you’re reading it for the first time, consider subscribing (it’s free!).

4