BREAKING: NSO Group liable for #Pegasus hacking of @WhatsApp users.
Big win for spyware victims.
Big loss for NSO.
Bad time to be a spyware company.
Landmark case. Huge implications. 1/ 🧵
2/ In 2019, 1,400 @WhatsApp users were targeted with #Pegasus.
WhatsApp did the right thing & sued NSO Group.
NSO has spent 5 years trying to claim that they are above the law.
And engaged in all sorts of maneuvering.
With this order, the music stopped and NSO is now without a chair.
3/ Today, the court decided that enough was enough with NSO's gambits & efforts to hide source code.
Judge Hamilton granted @WhatsApp's motion for summary judgement against the #Pegasus spyware maker.
The judge finds NSO's hacking violated the federal Computer Fraud & Abuse Act (#CFAA), California state anti-fraud law #CDFA, and was a breach of contract.
What happens next? The trial proceeds only on the issue of resolving damages stemming from NSO's hacking.
4/@WhatsApp suing NSO Group was a huge deal at the time.
We at @citizenlab & our peers in civil society had been investigating & surfacing a pile of #Pegasus abuses since 2016. Journalists, dissidents, truth-tellers, scientists, lawyers..
But nobody was taking action & NSO was flying high.
11/ Even as NSO has a bad time, other spyware companies like #Paragon present themselves as 'different' & 'approved' to try and break into the US market & grab market share.
I think their goal is to get enough contracts with countries like the US that it's hard to regulate them.
Be skeptical of their claims.
Seems like some are already falling apart.
They want to put secret hacking tools in the hands of American cops & police forces around the world.
You should demand oversight & action from Congress to stop this toxic industry from nesting in the US.
Today's ruling also raises questions about how legally safe it is for a company to sell & run hacking services targeting US-based platforms & their users.
NOW: US court permanently bans Pegasus spyware maker from hacking WhatsApp.
NSO Group can't help their customers hack @WhatsApp, etc ether. Must delete exploits...
Bad news for NSO. Huge competitive disadvantage for the notorious company.
Big additional win for WhatsApp 1 /
2/ Although the massive punitive damages jury award against NSO Group ($167m) got reduced by the court, as is expected in cases where it is so large (to 9x compensatory damages)...
This is likely cold comfort to NSO since I think the injunction is going to have a huge impact on the value of NSO's spyware product.
Comes as NSO Group has been making noises about getting acquired by a US investor & some unnamed backers...
3/ NSO also emerges from the @WhatsApp v NSO case with just an absolute TON of their business splashed all over the court records..
NEW: fresh trouble for mercenary spyware companies like NSO Group.
@Apple launching substantial bounties on the zero-click exploits that feed the supply chain behind products like Pegasus & Paragon's Graphite.
With bonuses, exploit developers can hit $5 million payouts. 1/
2/ Apple is introducing Target Flags which speeds the process of getting exploits found & submitters rewarded.
This faster tempo is also a strike against the mercenary spyware ecosystem.
And the expanded categories also hit more widely against commercial surveillance vendors.
3/ If I contemplating investing in spyware companies I'd want to carefully evaluate whether their exploit pipeline can match what @apple just threw down.
NEW: @WhatsApp caught & fixed a sophisticated zero click attack...
Now they've published an advisory about it.
Say attackers combined the exploit with an @Apple vulnerability to hack a specific group of targets (i.e. this wasn't pointed at everybody)
Quick thoughts 1/
Wait, you say, haven't I heard of @WhatsApp zero-click exploits before?
You have.
A big user base makes a platform big target for exploit development.
Think about it from the attacker's perspective: an exploit against a popular messenger gives you potential access to a lot of devices.
You probably want maximum mileage from that painstakingly developed, weaponized, and tested exploit code you created/ purchased (or got bundled into your Pegasus subscription).
3/ The regular tempo of large platforms catching sophisticated exploits is a good sign.
They're paying attention & devoting resources to this growing category of highly targeted, sophisticated attacks.
But it's also a reminder of the magnitude of the threat out there...