Share this page!

Enter Twitter Thread URL to Unroll

Needs to be the full URL like: https://twitter.com/threadreaderapp/status/1644127596119195649

How to get URL link on Twitter App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
John Scott-Railton Profile picture
@jsrailton
Apr 18 • 6 tweets • 9 min read Twitter logo Read on Twitter
Scrolly
NEW INVESTIGATION: recent Mexican #Pegasus spyware abuses led us to evidence of a trio of zero-click exploits used by #NSO.

Targets? HomeKit & FindMy.

Remarkably, #Apple's #iOS #LockdownMode blocked one of them.

Quick THREAD 1/
citizenlab.ca/2023/04/nso-gr… Image
2/ First, the new victims: Mexican lawyers representing families of victims of Military abuses

The timing of the targeting matches key developments in efforts to hold #Mexico's army responsible.

It's really bad.

We @citizenlab forensically confirmed the spyware infections. One infected device belongs...ImageImage
3/ We found evidence of 3 #zeroclick #0day chains used by NSO's #Pegasus #spyware in 2022.

First: #PWNYOURHOME: worked against #homekit even if you didn't set up a home.

Apple's changes in iOS 16.3.1 that address.

#LockdownMode also kneecaps it. ImageImageImageImage
4/ #FINDMYPWN and #LATENTIMAGE: #0click #0days We found traces of these iOS15 exploits on confirmed infected devices.

It appears common target = #findmy service.

Takeaway: services that connect iOS devices to cloud services, handle push notifications = perennial target. ImageImageImage
5/ Our investigation into the #Mexican cases was done in close collaboration with NGO @R3Dmx, which continues to do amazing work defending victims of hacking and surveillance abuses in Mexico.

Please consider giving them a follow to boost their signal.

6/ By the way, Apple's experiment in higher security #LockDown mode... did its job!

Concerned about your security? Go turn it on.

Yes there are usability trade-offs, but for the first time we can say, in an evidence-backed way, that it can work.

support.apple.com/guide/iphone/l… ImageImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with John Scott-Railton

John Scott-Railton Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @jsrailton

John Scott-Railton Profile picture
Apr 20
I can practically *feel* the coming uptick in scamming. ImageImageImageImage
This is absolutely fine. ImageImageImageImage
What could go wrong? ImageImageImageImage
Read 10 tweets
John Scott-Railton Profile picture
Apr 20
Remember that awful adult when you were growing up?

We've all known him.

The grownup that gets off on punching down?

The one siding with the bullies every time?

That's Ron DeSantis.
DeSantis wields power against people without it.

It gets him attention.

But it isn't even leadership's distant cousin.

It's kicking kids sandcastles to look like a big man.
DeSantis is all about the presidential look.

But this man is a divider.

Not a unifier.

You simply can't raise a country up if all you know is how to tear it apart. Image
Read 4 tweets
John Scott-Railton Profile picture
Apr 19
Watching reactions to the #DominionvFox settlement.

Deja vu of so many times folks had big expectations (pushed by media coverage) about how big cases & civil litigation would somehow heroically defend democracy with a clear win.

Only to be inevitably disappointed. 1/
2/ As our democracy is assailed by relentless streams of disinformation & institutions are attacked, it's important to recognize that we are rarely going to get clean, unambiguous wins.

Especially from the legal system. Especially when parties have competing incentives.
3/ People want heroes when the stakes are big.

Media encourages it.

Easier to cheer heroics on a screen... than roll up sleeves & find your own way to pitch in.

If you take the first path, prepare yourself for the inevitable disappointment as heroes never. quite. deliver.
Read 7 tweets
John Scott-Railton Profile picture
Apr 18
PSA: Have an #iPhone?

Do you think because of who you / what you do, someone may try to hack you?

Try enabling #LockdownMode.

For the first time, we found evidence that it does frustrate *certain* hacking attempts. 🧵1/ Image
2/ Here's the research I'm talking about👇

Basically, we @citizenlab found some sophisticated #Pegasus #spyware hacking attempts against human rights groups were getting stopped by #LockdownMode.

3/ When #LockdownMode first came out last year a lot of people were pointing out: hey, this mode degrades some features!

(#Apple is also up front about this)

So there was this question: are the trade-offs worth it?

Well, we finally have some evidence of it doing its job.
Read 7 tweets
John Scott-Railton Profile picture
Apr 17
Remember #Predator mercenary spyware was delivered to #RSF, the militia attempting the coup in #Sudan right now.

Reporters described the tech as having the "potential to tip the balance of power"

By @cr0ft0n @telloglou @e_triantafillou & @omerbenj
haaretz.com/israel-news/se… ImageImageImageImage
2/ It won't just be #Sudan.

It isn't abundantly clear, commercial #spyware proliferation is on track to play a growing role in geopolitical instability. Image
Was it worth it? This is exactly the question.

Without oversight and control, unfortunately, this will keep happening.

Read 4 tweets
John Scott-Railton Profile picture
Apr 17
NEW: 40 officers of China's national police charged for schemes to harass US Residents critical of 🇨🇳#China.

Fake accounts & insiders at a US company...

It's clear: the US is a massive target for #transnatinoalrepression by autocracies.

h/t @RonDeibert
justice.gov/opa/pr/40-offi… Two criminal complaints fil... SHARE JUSTICE NEWS Departm...ImageImage
2/ Great that @TheJusticeDept @EDNYnews are leaning into transnational #repression pointed at dissent in the US.

Which includes recruiting useful & sometimes-unwitting US persons.

#China is the juggernaut in this space, but so many autocrats are now running same playbook. Image
3/ It's also good to see the insider problem at US companies continues to be a focus.

Whether it's #SaudiArabia with #Twitter (speaking of countries that run big online harassment operations targeting dissidents including in the US...) or #China with #Zoom.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Send Email!

:(