We're naming names 🔥 because the harm is not hypothetical.
Today we share "Buying Spying", our new report diving into the commercial surveillance/spyware industry. We dive into the players, the campaigns, the spyware, & the harm it perpetuates.
There's also lots of goodies that we've never released before like:
👀 That Chrome 0-day (CVE-2023-7024) @_clem1 discovered in Dec? NSO Group
🤔 Which vendor gets caught the most
🕐 In April, it took Intellexa 45 days to come back after their Chrome 0days were caught & patched
And of course the attribution chart for in-the-wild 0-days in the appendix 🔥
While most are not at risk of being personally targeted with these capabilities, the impacts affect us all. When the most at-risk in our society: human rights defenders, journalists, opposition politicians, etc are targeted, that threatens & harms our free societies as a whole.
I'm so thrilled that we're getting this out to share and so thankful that I got to work with some incredible people on this: @auroracath @k_dennesen @az_matazz @charley_snyder_ @Kimberly_Samra @_clem1
My therapist said something to me back in 2020 (we talked about my anxiety around money a lot) that's stuck with me: How does you making your life more difficult help anyone else?
It's only been in the last few years that I have truly felt stable and comfortable financially. Previously I was always trying to pay bills, debts, and just dreaming of being able to maybe save an emergency fund and donate to causes I care about.
So the idea of spending $ on things that aren't strictly necessary has always felt uncomfortable. So my therapist's q has helped when I consider where my $ goes. Which ever way the answer is, it helps me feel more at peace.
2021 was a wild year for 0-day exploitation detection. 2021 was also full of Google Project Zero & TAG publishing lots of good (in my biased opinion) stuff on 0-day exploits. 🧵ICYMI here they are:
1. In January, Project Zero published a 6 part series about a watering hole attack. The series covers the Chrome, Android, & Windows exploits, & the Android post-exploitation behavior of this attack.
Part #1: googleprojectzero.blogspot.com/2021/01/introd…
2. Also in January, @digivector of TAG published about a North Korean campaign targeting security researchers. While 0-day use was never confirmed, evidence suggested that the attackers did use 0-days in some cases. blog.google/threat-analysi…
The few glimmers of details we get confirm to me we need to be concerned about who NSO's technology is being sold to & how it's being used.
I "live chatted" my reading of this to my teammates as my frustration & rage grew. There was so much. I'll limit this to just a few. 2/12
The main two points are: 1. We have strict processes to ensure our technology is not misused in ways that violate human rights. 2. We have no insight into how our customers use our technology.
🤔
This leads in to claims of how little misuse there is. 3/12
This thread from ~yr ago was a turning point for me. Not because the harassment stopped, but because I finally no longer dealt with all this bs predominantly alone. As illogical & irrational as it is, I think I felt shame every time I received one of these messages. 1/x
*I* must have been doing something wrong, *I* must have been less than if all these people took the effort to say these things to me. If colleagues weren’t dealing with this, then *I* must be the problem. I’m *drama*. These were the quiet thoughts. 2/x
And while each time I came out of it knowing those thoughts were incorrect, it was exhausting & took capacity to process the messages and get to that point. Capacity & energy I would have much preferred to spend elsewhere...like maybe my actual work. 3/x
Along with many others in infosec, I've always cautioned against any of the voice activated smart gadgets, largely thinking there's only marginal benefit for the risks of an always-on microphone.
Recovering from surgery with only one usable arm has completely changed my views.1/
Using voice control, which has required turning on the mics on my phone and home mini, has made my quality of life substantially better and even prevented physical pain. 2/
2 days post-op I was staying at family's house & had gone for a nap. I woke up & was completely tangled in the velcro straps from the sling and ice pack. Hair & a pillowcase were involved in the velcro nightmare too. 3/
Can't believe I'm voluntarily wading into this, but here we go.
When you share those full details, that's when I drop everything & get to work (and I usually pull in my teammates too 💁🏽♀️). It's not just another cool vuln, it's something being used to harm. 1/6
As an example, here's how I approach it as soon as the details are out:
-understand the root cause & exploit method
-think of potential detection methods & talk to the folks who can implement them if it's not us 2/6
-find variants that the attackers either already have (and may even be using) or could easily switch to and try to get them fixed at the same time as the original bug
-brainstorm fixes, mitigations, system improvements & share them 3/6