NSO Collateral Damage: Is an Intelware Bug Zapper at Work
February 11, 2022
I have shared my view about NSO Group: The company’s conversion from secret specialized services vendor to publicity magnet will have downstream consequences. If the information in “Another Israeli Firm Caught Selling Pegasus Hacking Tool for Exploiting iPhone Flaw to Shut Down” is accurate, the knock on effect or some type of advanced bug zapper has killed another intelware vendor. (A bug zapper is a device which is technically a system or device which uses a brief electrical pulse to incinerate insects. I do not own a bug zapper because the little critters deserve to live happy lives despite the chemicals the lawn care company dumps on the yard every couple of weeks.)
The zappers come in a variety of form factors. There are bug zappers which look like pickle ball rackets. These are loved by the over 65 crowd. Some look like 1950s spaceships (pictured below), and others are like big toasters with wires and a weird blue glow.
The write up offers some factoids about the QuaDream intelware vendor zapping:
- QuaDream could compromise iPhones in the manner of NSO Group’s Pegasus system. (Does this suggest that NSO Group’s systems and methods may have been shared in the specialized services’ technology community making QuaDream a reseller?)
- The app was called “Reign” as in “reign of terror” perhaps?
- The Reign solution cost upwards of $2.0 million US, excluding maintenance.
- Reign allegedly could turn on a compromised iPhone’s camera and microphone. (Be sure to look for the small colored dots, iPhone user.)
I have noticed that some Israeli specialized software vendors are forming partnerships with firms providing services to financial institutions, law firms, and other commercial outfits. This is a mad scramble for cover in my opinion. The problem is that when the systems’ functions are explained some executives get cold feet despite the appeal of the specialized systems’ functionality.
This must be quite thrilling for the investment firms who have bet that the market for intelware and policeware was large and going to grow, as Ed Sullivan used to say, “really big.”
A high stakes game is underway and now there’s the mysterious bug zapper at work.
Stephen E Arnold, February 11, 2022
NSO Group: Former Police Chief Demos Yoga One-Handed Tree Pose
February 10, 2022
Remember the NSO Group? If not, this post is not for you. I read a story from the scary Associated Press. The outfit said it would sue anyone who quoted too much of the richness of its stories. As a former employee of the Courier-Journal & Louisville Times Co., I am pretty easily frightened by outfits like the AP.
The story — should you be able to locate it online — is “Ex-Israeli Police Chief Dismisses Claims of Spyware Hacking.” The write up is typical AP stringer wonderfulness. The main point is that the 58 year old Roni Alsheikh made a video to explain that chatter, allegations, and assertions about alleged use of the NSO Group’s Pegasus specialized service tool was different. I believe this person; however, you may not. That’s okay.
An investigation is underway, and my hunch is that if — note the if — the NSO Group’s system was used, it was within the boundaries of authorized behavior. Innocent until proven guilty, not guilty by PR focused GenXers.
Now is the story spot on? Who knows.
My take on the write up is:
- The MBA-inspired drive for revenue created the NSO Group’s marketing and positioning. Big booths and compelling demos are powerful things, particularly when not shrouded in secrecy.
- The “sunlight” flooding the specialized software and services industry is spill over from the Silicon Valley behavior model. Yo, bro, problemo.
- The yoga exercise the one handed tree thing is not something 58 years olds do before having a morning mouthful of matzah brei.
The one-handed tree pose. It’s tough, correct? The NSO Group helped Roni Alsheikh get in this remarkable position. How long can one “hold” it? I would be able to do two, maybe three seconds with a couple of my research team propping me up.
NSO Group is creating interesting opportunities for retired law enforcement professionals. It’s the difficulty of the pose that is interesting to contemplate.
Stephen E Arnold, February 10, 2022
NSO Group: Another Ripple in the Intelware Sector
February 8, 2022
I read Haaretz’s article “Pegasus Scandal Is a Massive Can of Worms About to Erupt All Over Israel’s Elites.” Is a “commission of inquiry” into NSO Group and related topics a good idea, an inevitable action, or just handwaving after the train has left Tel Aviv Savidor Mercaz? Overturning previous legal decisions may be the least disruptive consequence of the NSO Group-type of publicity that specialized software and service firms are attracting.
There’s another twist. This write up states:
Public Security Minister Omer Bar-Lev announced the formation of a commission of inquiry into the police use of Pegasus after both he and Israel Police commissioner Kobi Shabtai had called for an external investigation into the matter. This was a major about-face from earlier statements…
What repercussions will result from this new group poking around in systems, methods, policies, customers, use cases, and functionalities?
My thought is that there will be louder thumps than those created by Ringo Star in the tune “Get Back.”
I found this line particularly interesting:
Netanyahu is also the pioneer of “Pegasus diplomacy,” using the cyber offense tool developed by the NSO Group as a sweetener for all manner of diplomatic and security agreements with foreign leaders – ranging from Brazil’s Jair Bolsonaro to Saudi Crown Prince Mohammed bin Salman.
When will the rest of the band kick in? Nope, says the write up:
This investigation has the potential to rock Israel’s political class, the law enforcement establishment, the intelligence community and Israel’s foreign relations. As a result, it is unlikely to go very far.
Stephen E Arnold, February 8, 2022
Threat Intelligence Purchases
February 8, 2022
Many companies are (rightly) are putting more emphasis on cybersecurity. In order to make the task easier and more efficient, a business might invest in software to help manage and analyze all the data involved. BetaNews offers “Five Pointers for Choosing a Threat Intelligence Platform: What to Look For in a TIP.” We see this write-up as but a starting point—it holds some useful pointers but includes no benchmark about SolarWinds and Exchange type exploits. Nor does it address the vital points of insider threats and phishing. Readers looking to expand their cybersecurity efforts would do well to carry their research beyond this article. That said, we turn to writer Anthony Perridge’s description of a TIP:
“A Threat Intelligence Platform, or TIP, serves as a central repository for all threat data and intelligence from internal and internal sources. Correctly configured, the TIP should be able to deliver essential context around threats that helps the team understand the who, what, when, how and why of a threat. Crucially, it should also help prioritize threats, based on the parameters set by the organization, filtering out the noise so the resulting actions are clear. A good TIP benefits a range of stakeholders, from the board aiming to understand strategic risk to CISOs focusing on improving defense while staying on budget, and from security analysts collaborating more effectively to incident response teams benefiting from automated prioritization of incidents. Knowing what you need to invest in is the first step. The next is to understand the key features you need and why. There is a lot to consider, but in my view the following are five key areas that should be on your checklist as you evaluate TIPs.”
The piece goes on to describe each of these five factors: support for both structured and unstructured data (shouldn’t that be a given by now?); the ability to provide context around data; how the platform scores and prioritizes indicators; the integration options available; and effective automation balanced with manual investigation. Then there are the “business considerations,” in other words, the costs involved. For example, TIPs are usually offered on a subscription, per user basis. One should consider carefully how many users should get access—teams outside security operations, like risk management, might need to be included. Also, pay close attention to the fees that can add up, like integration and cloud hosting fees. See the write-up for more information; just remember not to stop your investigation there.
Cynthia Murrell, February 8, 2021
NSO Group: Under Watch Names Revealed
February 7, 2022
I noted the Calcalist article “No One Was Immune: Israel Police Pegasus Surveillance List Revealed.” The downstream consequences of the NSO Group’s MBA-infused approach to specialized software and services continue to become visible.
This passage refers to Israel; however, it is a thought starter:
The bland term used by police for these activities was “technological and data oriented policing,” but Calcalist reveals that the use of Pegasus wasn’t local or limited to a small number of cases. This became one of the most useful tools implemented by police to gather intelligence. Special operations members of the police’s cyber-SIGINT unit have been penetrating the phones of citizens secretly and without judicial warrants, taking control of them with Pegasus against the law and with the understanding that judges wouldn’t approve such activity.
I want to reiterate that the old-school specialized software and services vendors focus their efforts on direct contacts with government agencies and/or attending limited or restricted attendance conferences. As the number of firms tapping open source and proprietary methods to gain access to certain data streams increased, the need for MBA-type marketing exponentiated.
A return to more traditional methods would be a refreshing change. Who is to blame? I think the entrepreneurs who create specialized software and services firms are prime movers. However, the enablers are the entities which fund these often young go-getters bear some responsibility. Blaming under funded, understaffed, and under equipped government professionals may be warranted under some circumstances.
My view is that an engineer chock full of MBA-isms should be licensed prior to hanging out a shingle, signing up for a trade show stand, and generating buzz via news releases and social media posts on LinkedIn.
Until then, the knock ons from the NSO Group’s global visibility are likely to hold some surprises. Do you like surprises? I don’t too much.
Stephen E Arnold, February 7, 2022
NSO Group: Media Pile On
February 3, 2022
A helpful person posted a link to a July 2021 story about NSO Group this weekend (January 29 – 30, 2022. The New York Times (that bustling digitally aware Gray Lady) published a New York Times Magazine story about NSO Group. But the killer item of PR appeared in Sputnik International (a favorite of some in Moscow) “India Bought Pegasus Spyware from Israel in an Alleged Deal Concerning Palestinians, Claims NYT.” I find this interesting because:
- The NSO Group continues to be a PR magnet. At this point, I am not sure the old adage “any publicity is good publicity.”
- Russian “real journalists” have wired together some click baity words: India, Israel, Palestinians, and the New York Times
- The intelware sector has a stiff upper lip, but the NSO Group – whether a viable business or not – has destabilized an entire industry sector.
Net net: A big problem which seems to be growing.
Stephen E Arnold, February 2, 2022
NSO Group Factoids: Dominoes Game Underway
February 2, 2022
I read “The Company Trying to Give Cyber Intel a Good Name.” The somewhat lofty goal of the write up is to put a bit of lipstick on what is now a somewhat unattractive blobfish. I don’t have an animal in the fight, although the image of squabbling blobfish strikes me as amusing. Maybe a cyber version of “Animal Farm”?
The article contains what I thought were interesting factoids and, as is my wont, I shall capture these gems:
- NSO Group is still for sale with a valuation of about $1.0 billion US.
- NSO Group technology “makes it possible, at the push of a button, to take over a telephone remotely, record conversations via its microphone, film via its camera, or determine its location, without its owner knowing.”
- Israeli police have been criticized for its use of technology like NSO Group’s.
- “Crime organizations use encrypted communications, on apps such as Telegram and Signal, and in countries like Russia and China the problem has been solved very simply: giant US companies like Google and Meta, and Chinese ones like WeChat and Weibo, provide the authorities with the key to read chat or listen to voice calls on their apps without having to break the encryption.”
- “… European countries were pioneers of planting Trojan horses and developing vulnerabilities for hacking telephones, among them Italian company Hacking Team, which was shut down and re-emerged as Memento Labs, and Amesys…”
- Germany “bought a system from NSO”
- “Israeli company Quadream is selling to Middle Eastern and African countries systems with capabilities similar to those of NSO, in collaboration with a Cypriot sales company InReach Technologies, while Cognyte, formerly the offensive cyber division of Verint, is already developing the next generation of its Trojan horses in a secret division called Ace Labs.”
- “One company trying to adapt to the new era is Paragon Solutions, an offensive cyber company founded two-and-a-half years ago by former IDF intelligence unit 8200 commander Ehud Schneerson, and Idan Nurick and Igor Bogudlov, who served in the unit, together with former prime minister Ehud Barak.”
- Paragon will sell to customers in 39 countries which have to be “enlightened democracies”.
- Paragon has “American DNA” and money from Battery Ventures
- Paragon “has grown to 110 employees, most of them people recently demobilized from the IDF who served in 8200’s cyber units, and the rest former employees of companies like NSO, Check Point, Cobwebs Technologies, and Cyberbit.”
Now what is that game again? Oh, right: Dominoes, a blocking game, right?
Stephen E Arnold, February 2, 2022
The Gray Lady Rides the NSO Group Pegasus
February 1, 2022
Quite an image right? The New York Times, the flabby dowager of real news, is riding the Pegasus. ‘”FBI Secretly Bought Israeli Spyware and Explored Hacking US Phones” reveals that like most investigative units in the world tested the specialized software and services available from organizations once shrouded in secrecy. No more. It seems that NSO Group’s secrets are more widely shared that Minnie Mouse’s hip new blue jump suit.
The Gray Lady states:
The F.B.I., in a deal never previously reported, bought the spyware in 2019, despite multiple reports that it had been used against activists and political opponents in other countries. It also spent two years discussing whether to deploy a newer product, called Phantom, inside
the United States.
Are you frightened yet? I am not. I expect government agencies to acquire, test, and implement tools necessary to obtain mission objectives. Most of the tested specialized software and systems is discontinued. Some useful tools are never used because the budget no longer permits assigning a full time employee to remain current on a system.
The write up is less about the research done by government agencies and more about the outrage that some feel. My hunch is that the Gray Lady’s “real news” professionals are among the most put upon by what is a routine function.
And the news? The Gray Lady wants to ride the Pegasus, but the tired, old, beaten down Pegasus is not able to get the flaccid passenger aloft.
Stephen E Arnold, February 01, 2022
Palantir Technologies: Will the Company Soar?
February 1, 2022
Palantir is an intelware company that specializes in search technology with consulting services layered on top. According to Seeking Alpha, Palantir might not do well in 2022: “Palantir Stock: Bullish, But Downward Pressure On Price.”
Palantir’s stock has dropped considerably in the past six months. People who purchased stocker before October 2020 are doing all right, but November 2020 buyers lost their money. Palantir is projected to have growth an that appears to be the only bright spot at the moment.
The stock market is experiencing inflation and it is suspected to last longer than six months. Value stocks will benefit the most in this market, while growth stocks, like Palantir, will suffer. Macroeconomic factors will impact growth stocks. Palantir might not be doing too well, but it is doing better than it was last year.
Also there is more positive news:
“What’s especially good is that PLTR continues to “weave” itself into very large organizations. Obviously there are the military partners, which most investors know about. But PLTR is getting closer with commercial partners, left, right, and center. For example, IBM (NYSE:IBM), Amazon (NASDAQ:AMZN) and Rio Tinto (NYSE:RIO).
Quite importantly, this news isn’t just flowing from PLTR press releases. Sure, some of the distribution is fluff, hype and related PR. However, what gets me excited is that these tie-ups are showing in presentations, case studies, earnings reports, and much more. Again, PLTR is becoming a critical part of the fabric, not just simple player, or dashboard provider.
Third, PLTR regularly provides real-world updates, useful research, plus case studies. This is a strong positive for hiring, and keeping the talent pool aware of PLTR, but it’s also good for designers and developers in other companies that could be doing business with PLTR.
Palantir is definitely going to see upheavals in 2022, but search and intelware technology has always been a challenging sell when repositioned for business use cases.
Whitney Grace, February 1, 2022
NSO Group: Yes, Again with the PR Trigger
January 31, 2022
I have no idea if the write up “NSO’s Pegasus Spyware Used to Target a Senior Human Rights Watch Activist” is spot on. The validity of the report is a matter for other, more youthful and intelligent individuals. My thought when reading this statement in the article went in a different direction. Here’s the quote I noted:
In a tweet, Fakih showed a screenshot of a notification she received from Apple informing her she may have been the target of a state-sponsored attacker.
Okay, surveillance. Usually surveillance requires someone to identify something as warranting observation. the paragraph continues:
Though others versions of Pegasus software uses text messages embedded with malicious links to gain access to a target’s device, Fakih said she was the victim of a “zero-click attack” that is capable of infecting a device without the target ever clicking a link. Once a target is successfully infected, NSO’s Pegasus software allows the end-user to surveil the target’s photos, documents, and even encrypted messages without the target ever knowing.
The message is that NSO Group continues to get coverage in what might be called Silicon Valley real news media. Are there other systems which provide similar functionality? Why is a cloud service unable to filter problematic activities?
The public relations magnetism of the NSO Group appears to be growing, not attenuating. Other vendors of specialized software and services whose very existence was a secret a few years ago has emerged as the equivalent of the Coca-Cola logo, McDonald’s golden arches, or the Eiffel tower.
My view is that the downstream consequences of exposing specialized software and services may have some unexpected consequences. Example: See the Golden Arches. Crave a Big Mac. What’s the NSO Group trigger evoke? More coverage, more suspicions, and more interest in the methods used to snag personal and confidential information.
Stephen E Arnold, January 31, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
