While I have no doubt Apple want to stop any research they don't control NSO are not just offensive researchers. They crossed a line selling the malware to various ever so slightly dodgy groups and organisations. As such Apple have a legitimate reason to sue here.

Indeed. Vitaly missed a golden opportunity to shut his mouth.

The NSO is not your garden variety of software developer. Conflating NSO state-approved malware writers with "software developers" in general is just muddying the waters.

Shame on you, Vitaly.

And of course Apple/Google/Facebook/etc won't use any NSO decision to prosecute people who find vulnerabilities in the future - because they are all such nice friendly companies.

In my opinion it sounds like Apple has created ability for services to spy on its customers and now are upset that private company is also using these features?

Surely instead of "declaring a war" they should just patch the holes?

Surely instead of "declaring a war" they should just patch the holes?

They did. [1]Here , [2]here , and [3]here .

[1] https://www.theregister.com/2016/09/02/macos_safari_security_update/

[2] https://www.theregister.com/2021/09/24/apple_zero_day/

[3] https://www.theregister.com/2021/10/12/apple_ios_15_0_2_zero_day_patched/

Well, given the lawsuit, you can't really trust these patches don't ship new set of holes for services to use.

But the fundamental elephant in the room, which people never want to seem to accept, is that humans are fallible. There will never be perfect, uncrackable computers without vulnerabilities. Ever. From hardware to software there will always be something soft, and if all else fails they'll just social engineer the wetware to get what they want.

Patch holes? Absolutely! But then another hole will be found, the patching will never end. The issue is state-sponsored hacking - we have it bad enough without the governments that are supposed to be working for their people hacking those very people's computers for selfish 'benefit'.

Entirely sure I care. I mean there are low tech ways to organize against your government. I believe that if you are going to do that, no matter which government we are talking about, using your iphone, or any device with GPS features, is just looking for more trouble than you originally intended. That is what burner phones are for.

And good luck apple getting any money. By all mean take it to trial, I can hardly wait to see the 'discovery' phase..

Yes, but in this case, the spyware was used against legitimate journalists, world leaders etc. doing their normal day-to-day business.

But one of two things are likely to happen. 1) somehow it goes to trial and there is a discovery phase, and some very seedy relationships with the worst regimes in the world are outed 2) NSO Group goes out of business, because everyone that doesn't want to be classed with the thugs in Thailand or the people who bonesawed Khashoggi will refuse to do business with them.

Sure its a shell game as there are other companies like NSO Group and you can't get rid of them all, but at least you can force the ones trying to operate as legitimate companies from doing business with the worst of the worst. There will probably still be criminal organizations selling such services on the darknet, but the authorities will go after those like they always have.

Sure people can say "where do you draw the line, should you do business with the US government since their hands aren't clean either" but I think when you support those murdering people with bonesaws that's a line everyone can agree on.

Between searching for flaws and responsibly disclosing them compared to using them to sell to high bidders for some very nefarious purposes that have possibly led to the death of some people and quite probably others being detained 'for the good order of the state'.

In other cases the threat of not being able to make a living is certainly an issue when the state is getting its hands on literally everything of interest in the phone and its surroundings.

The surveillance of politicians and press by certain governments is quite well documented elsewhere when they use NSO's wares.

Certainly Apple might not want pen testers from outside rooting through their kit (no pun directly intended) but that is not something they can really control.

So overall, I really can't see Vitaly Kamluk's comments as being the case.

>Between searching for flaws and responsibly disclosing them compared to using them to sell to high bidders

Yes one enables people to search for vulnerabilities as a full time job.

If you ban selling exploits then Apple/Google/Facebook can just offer 1c rewards for each exploit, and threaten to sue anybody else.

As a result only criminals have exploits. No exploits are ever made public and so all computers must be secure.

Just offer a life-changing bounty to anyone who provides exploit details that NSO is using. Indemnify them against any legal action re: stealing trade secrets. Get them on a plane and out of the reach of Mossad. Drop flyers all around NSO's HQ announcing the $bignumber bounty. You'll have the code within a week

Doesn't Mossad have a reputation for "extraordinary rendition," though, meaning nowhere is really safe?

Hmm... Good luck with that.

We should start from an axiom - law enforcement agencies require to be able to access communication and data storage for investigations - which could be wholly lawful and to combat nasty crimes. Of course the same technologies can be used to commit nasty crimes - it's not different from guns. And even common people do employ surveillance cameras that can be used to protect people and properties, or to peep.

NSO still made the huge mistake of selling to the wrong government and agencies - and in some cases it can amount to a crime, and I'm not going to say that all governments and law enforcement agencies are wrong - although the more power they get the more accountable they must be.

Still these tools are here to stay - unless we want to see more government pressure to cripple cryptography, provide interception facilities, and require access to data stored by companies. But maybe that's what Apple & C. exactly want? Because that will put THEM in charge of what information can be accessed by law enforcement agencies, under their full control.

For example a spyware could hit - let's imagine for wholly lawful reasons - Tim Cook iPhone. And Apple would have no way to control it. But if law enforcement agencies have to ask Apple to graciously provide access to that, they have the power to decide what is accessed.

Just like banks offer ways to customers who can pay for it to get a far higher degree of "secrecy", I wouldn't be surprised if that happens or will happen in the comm/data storage arena....

In my opinion, Apple wants offensive researchers out of the field - said Putin-controlled spokesperson for Russian "anti-virus" company thats been banned from dozens of government systems due to integrated "vulnerabilities".