Remix.run Logo
VWWHFSfQ 4 hours ago

>> Further validating our finding of targeting, our forensic analysis shows Kouloglou received multiple Apple threat notifications about targeting with mercenary spyware on three occasions: March 2, 2023, August 29, 2023, and April 10, 2024. It is important to note that threat notifications from Apple and other companies are not real-time alerts. They are typically sent to users in batches, often months or more after targeting takes place.

>> Kouloglou reports to us that he did not recall receiving the Apple notifications we observed.

Am I understanding this correctly that Apple sent him notifications that he was being monitored and he ignored them?

pmontra 4 hours ago | parent | next [-]

"he did not recall receiving the Apple notifications" so he didn't notice them.

bawolff 3 hours ago | parent | next [-]

That is kind of surprising given he is on the comittee investigating pegasus. I'd assume someone on the comittee would be paying much more attention to this than a normal person.

I wonder what triggered him to suspect he was hacked then. Since presumably something triggered him to have his phone forensically investigated.

tyre 2 hours ago | parent | next [-]

Or that Apple could either run searches on the names of affected users against publicly known members of government or have close relationship with governments to flag exactly this.

DANmode 3 hours ago | parent | prev [-]

If he knew he was compromised, and was okay with it for one reason or another (like money or other coercion), this is what his cleanup would look like.

Not saying this is likely. Just another possibility.

arka2147483647 4 hours ago | parent | prev | next [-]

Could those have been intercepted or suppressed somehow?

stavros 3 hours ago | parent [-]

It's possible, if the attacker controls the device enough. I don't think a big "you're being targeted" warning is something you don't notice, or forget.

chatmasta 3 hours ago | parent | prev | next [-]

Do they send them via notification infrastructure or email? Personally I almost never check the email associated with my Apple ID so I would miss those. But if all my Apple devices were notifying me and I had a badge in Settings.app, I’d notice.

Then again, you’d think that’s the kinda thing malware developers would spend some time learning to hide from the user.

captn3m0 4 hours ago | parent | prev | next [-]

Do we know how Apple sends these? Is it just a notification, or also email?

krackers 4 hours ago | parent [-]

https://support.apple.com/en-us/102174

>A Threat Notification is displayed at the top of the page after the user signs into account.apple.com.

>Apple sends an email and iMessage notification to the email addresses and phone numbers associated with the user’s Apple Account.

You can see what it looks like in https://reddit.com/r/iphone/comments/1c10jai/i_have_received...

I wonder how they detect it, is it for known IOCs that they've already found elsewhere, or do they have heuristic detection that flags things that might need further investigation.

lostlogin 3 hours ago | parent | prev [-]

I could be wrong here, but I can’t see any way of viewing old notifications.

It isn’t hard to accidentally dismiss one then wonder what it was. Why there isn’t there an interface for looking back?

Edit: below it says there are emails and notices on web login.

saintfire 3 hours ago | parent | prev | next [-]

I mean his device was pwnd completely. Its not a stretch that attempts to warn are suppressed.

That or he didn't notice or could have assumed the notice itself was one of many phishing attempts against large orgs.

If I saw a notification that my account was compromised by Pegasus I'd personally assume phishing.

stavros 3 hours ago | parent [-]

Kouloglou is a famous investigative journalist, not you and me. Yes you and I might think we're being scammed, but someone who actually spent a lot of their life getting death threats probably would pay more attention.

benjiro29 3 hours ago | parent [-]

Fairly sure that if anybody using a advanced piece of hacking software, they are also going to delete any messages that are related to detection of such hardware.

PC viruses used to do that stuff going back so many years ago. Suppressing any notification under Windows, by disabling the AV software, its notifications, windows notifications related to it.

So it will amaze me that this is not done by any modern espionage software. Especially as the notification methods are known. Given that his device is hacked, that means a lot of avenues are under control of the espionage software. Even mails etc ... So impersonating the end user, to confirm they read a warning, is extreme easy.

I find it rather odd that people are so fixated on the idea if Kouloglou read it or not.

stavros 3 hours ago | parent [-]

Maybe the software can only exfiltrate information, rather than change it.

benjiro29 3 hours ago | parent [-]

If i was going to write software on this level, that will be used by governments. There is no way, its going to be a nice little program that only extract information.

Its going to have every trick in the book (and outside it), to stay hidden. And it will have payloads to alter its behavior, updates, etc...

Nobody is going to pay you big fat money envelops for software that anybody can write in a afternoon. You want it to be as capable as ever, and you do not want it found!

stavros 3 hours ago | parent [-]

I mean maybe the exploits they found weren't good enough to allow them to do whatever they want with the phone.

EA-3167 4 hours ago | parent | prev [-]

That seems to be the case, although he claims to have somehow missed them. Overall this is one of those stories that's obviously an outrage, except for the fact that every country on Earth spies on the rest, and quite a few private entities do as well. Still the way the game is played if you get caught you have to act ashamed, and the people catching you get to gloat.

It's silly, but it's a show the public never tires of.

healthworker 4 hours ago | parent | next [-]

In this case he was investigating misuse of Pegasus spyware specifically, and was targeted with it while doing so. That's obstruction of justice, morally speaking, and would feel very scary, in that it would make you feel that this company might be so powerful that investigating it is personally dangerous.

EA-3167 4 hours ago | parent [-]

That's certainly the feeling the story is meant to engender yes.

hammock 3 hours ago | parent | prev | next [-]

The US does not spy on Five Eyes government leadership or that of Israel. And perhaps more: in the wake of Snowden, which obliterated many diplomatic relationships the U.S. has with other countries, Obama issued a directive that the U.S. would not monitor heads of state and government of close friends and allies (even outside Five Eyes) unless there was a compelling national security reason. As far as we know that directive has remained in force with each successive administration as well.

They spy on most others though. Germany’s Merkel, successive French presidents etc all had their phones hacked by US there is widely reported news of.

leonidasrup 3 hours ago | parent | next [-]

US does spy on Five Eyes

https://en.wikipedia.org/wiki/United_States_espionage_in_Aus...

"In December 2010, leaked US diplomatic cables indicated senior New Zealand Defence Ministry officials had been spying for the United States, secretly briefing the United States embassy on Cabinet discussions about the Iraq War."

https://en.wikipedia.org/wiki/Foreign_espionage_in_New_Zeala...

aetch 3 hours ago | parent [-]

That’s pre-Snowden

benjiro29 3 hours ago | parent | prev | next [-]

> As far as we know that directive has remained in force with each successive administration as well.

People can state a lot, as long as your not caught.

Nothing prevent you from having the UK spy on the Germans, and feeding that intel back. Or Israel, or ... Hey, the US did not spy on a EU ally. Well, not directly and it neatly bypassed any official statements.

They might have simply gone to one of those secret court hearings and have it bypassed with a gag order in place. Officially its not done, unofficially, its been approved.

The whole "as long as you do not tell me your doing it" approach, and the politicians involve maintain deniability (even if they had the wink).

And you do not need to specific target the head off state. Plenty of side routes to still get information on meetings, that involve those heads of states. Even if your not "directly" spying on them.

So no, its a naïve way of thinking. Maybe in 20 years from now we find out, that they did spy on EU leaders. Maybe directly, maybe indirectly ... even with that directive in place. I will be amazed if they did not. Its the US we are talking about.

matheusmoreira 3 hours ago | parent | prev [-]

> The US does not spy on Five Eyes government leadership or that of Israel.

Doubt.

> unless there was a compelling national security reason

There always is.

EA-3167 3 hours ago | parent | next [-]

Absolutely, and there's the same compelling reason for them to spy on the on the US in turn. I can't emphasize this enough, everyone is spying on everyone else. Close alliances give the impression that they don't because they tend to handle scandals in-house, it's for everyone's benefit to do so in most cases. Snowden's disclosure was a very unusual event and put everyone in a position of needing to act shocked, appalled, and put on a big show for the public; sweeping it under the rug was impossible. For all that many here would wish otherwise, Snowden wasn't a watershed though, it was a blip.

hammock 3 hours ago | parent | prev [-]

> Doubt

Can you substantiate your doubt with even one piece of hard evidence?

matheusmoreira 3 hours ago | parent | next [-]

Sure. The NSA exists, and it routinely violates the rights of the USA's own citizens, the ones that actually have constitutional rights. The idea that it would suddenly draw the line on foreigners is just absurd.

jonnybgood 2 hours ago | parent [-]

Yes, the US has an intelligence agency called the NSA, which works with intelligence agencies in the five eyes. There is something called the five eyes agreement that does draw that line.

matheusmoreira 2 hours ago | parent [-]

> There is something called the five eyes agreement that does draw that line.

Believe such nonsense at your own peril.

https://en.wikipedia.org/wiki/Israeli_espionage_in_the_Unite...

> In 1951, Mossad and the Central Intelligence Agency agreed not to spy on each other and US and Israeli services cooperated closely since then.

> Nevertheless, there were strong indications afterwards of ongoing Israeli espionage against the United States, confirmed by the 1985 arrest of Israeli spy Jonathan Pollard, one of the most damaging security leaks in US history.

> Israeli espionage reached a high-profile peak in the mid-1980s, shattering assumptions that allies "do not spy on each other".

Hizonner an hour ago | parent | prev [-]

Can you substantiate your certainty with anything other than the public statements of people whose job is to lie about things like that?

Hizonner an hour ago | parent | prev [-]

> every country on Earth spies on the rest,

It's entirely possible an EU country did this; they're only vaguely guessing Belarus or whoever. In most countries, it's a big deal if the spies are caught spying on the domestic government.

> quite a few private entities do as well.

It's a risky game, doing that. You don't get any of the professional courtesies, and you're not usually eligible for the prisoner exchanges.