2/ Per @R3Dmx, #Pegasus victims were infected while working on:
❌Connections between Los Zetas Cartel & Mexican Army
❌Official misconduct in investigations into #Ayotzinapa forced disappearances
❌Human rights violations by Mexican Armed Forces.
Chilling.
3/ Mexico was first rocked by #Pegasus scandals in 2017 under President @EPN.
9/ A key detail: while previous Pegasus cases @citizenlab investigated in #Mexico involved finding SMS messages and 1-click attacks... these latest cases were zero-click attacks.
No action was required on the part of the victims to be infected.
10/ Of course NSO has a response that is not serious.
NOW: US court permanently bans Pegasus spyware maker from hacking WhatsApp.
NSO Group can't help their customers hack @WhatsApp, etc ether. Must delete exploits...
Bad news for NSO. Huge competitive disadvantage for the notorious company.
Big additional win for WhatsApp 1 /
2/ Although the massive punitive damages jury award against NSO Group ($167m) got reduced by the court, as is expected in cases where it is so large (to 9x compensatory damages)...
This is likely cold comfort to NSO since I think the injunction is going to have a huge impact on the value of NSO's spyware product.
Comes as NSO Group has been making noises about getting acquired by a US investor & some unnamed backers...
3/ NSO also emerges from the @WhatsApp v NSO case with just an absolute TON of their business splashed all over the court records..
NEW: fresh trouble for mercenary spyware companies like NSO Group.
@Apple launching substantial bounties on the zero-click exploits that feed the supply chain behind products like Pegasus & Paragon's Graphite.
With bonuses, exploit developers can hit $5 million payouts. 1/
2/ Apple is introducing Target Flags which speeds the process of getting exploits found & submitters rewarded.
This faster tempo is also a strike against the mercenary spyware ecosystem.
And the expanded categories also hit more widely against commercial surveillance vendors.
3/ If I contemplating investing in spyware companies I'd want to carefully evaluate whether their exploit pipeline can match what @apple just threw down.
NEW: @WhatsApp caught & fixed a sophisticated zero click attack...
Now they've published an advisory about it.
Say attackers combined the exploit with an @Apple vulnerability to hack a specific group of targets (i.e. this wasn't pointed at everybody)
Quick thoughts 1/
Wait, you say, haven't I heard of @WhatsApp zero-click exploits before?
You have.
A big user base makes a platform big target for exploit development.
Think about it from the attacker's perspective: an exploit against a popular messenger gives you potential access to a lot of devices.
You probably want maximum mileage from that painstakingly developed, weaponized, and tested exploit code you created/ purchased (or got bundled into your Pegasus subscription).
3/ The regular tempo of large platforms catching sophisticated exploits is a good sign.
They're paying attention & devoting resources to this growing category of highly targeted, sophisticated attacks.
But it's also a reminder of the magnitude of the threat out there...