News for hackers. Stuff that matters.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by kmeisthax on Friday September 08, 2023 @08:56AM (#37432879)
The OS vendors refuse to implement lawful intercept capability because there is no such thing as a lawful intercept capability. There is only intercept capability for any purpose because ROM bootloaders and secure enclaves cannot vet the lawfulness of a request to subvert their owners. You can make a phone relatively secure against people trying to break into it, but only if it has unique access keys for the owner. If you give any government a second key for intercept capabilities, that key will be a single point of failure for the entire system. Eventually it will leak and your phone password will be effectively useless.

I don't even need to invent a scenario for this: you can buy the TSA master keys off Amazon right now. The only reason why it's not a huge problem is that TSA locks are a special thing you buy and use solely for airline luggage that is already in TSA custody anyway. If you use TSA locks on anything else, however, you're just asking for it to be stolen because the locks don't actually provide any security.

The shady clients will get their hands on any intercept key provided by law enforcement, because it's legally unreasonable for Apple or Google to only provide intercept capability to some of the countries they operate in. e.g. if you give the US and UK a decryption key you also have to give it to Saudi Arabia[0]. Hell, in some countries the shady and legit clients are part of the same government - e.g. you can't give the key to just the FBI but not the NSA or CIA.

[0] The Saudis have one very big lever they can use to force the west to do what it wants: gas prices.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by trogdor on Friday September 08, 2023 @10:58AM (#37434366)
>The Saudis have one very big lever they can use to force the west to do what it wants: gas prices.

The United States gets most of its petroleum from Canada.

Saudi Arabia accounts for only 7% of U.S. petroleum and crude oil imports.

Source: https://www.eia.gov/energyexplained/oil-and-petroleum-produc...

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by nannal on Friday September 08, 2023 @11:28AM (#37434849)
Gas and oil are fungible. Anyone dropping supply affects the entire market. You need to look at total global production percent.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by nojvek on Friday September 08, 2023 @01:35PM (#37436738)
The US is the largest oil producing country in the world. Mostly from Texas. https://www.eia.gov/tools/faqs/faq.php?id=709&t=6

2nd is Saudi Arabia then Russia. However it happens that US is also the largest consumer and their production doesn't meet the demand so they have to import from other countries like Canada and Saudi Arabia

So Saudi Arabia most definitely does have a lever, and so does Russia since the rest of the world including US allies like Japan, South Korea, Australia, NATO countries depend on their lovely black gold to have functioning economies.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by FrankoDelMar on Friday September 08, 2023 @05:24PM (#37439627)
I want to add that even if the US produced more oil, we currently don't have enough industrial refining capacity for the type of crude that we produce to meet our demand, so we would still need to rely on foreign imports.

https://www.api.org/news-policy-and-issues/blog/2018/06/14/w....

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by philistine on Saturday September 09, 2023 @08:37AM (#37444628)
> [...] so does Russia since the rest of the world including US allies like Japan, South Korea, Australia, NATO countries depend on their lovely black gold to have functioning economies.

Have you been following the news for the past two years? Russia's sanctioned up the wazoo. No NATO country is buying Russian oil. India is now their number one costumer.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by nojvek on Saturday September 09, 2023 @09:24AM (#37445091)
There is truth in that Europe isn’t buying directly from Russia. However plenty are buying from countries are buying refined oil products from India (and possibly others) where the source is Russian crude oil.

https://www.aljazeera.com/amp/news/2023/5/16/eu-to-curb-indi...

If the US was like Saudi Arabia where they exported half of their oil, and could supply most of the world at competitive prices, Russia would have really felt the Sanctions.

But right now Russia doesn’t feel the Sanctions. They’re more isolated and Putin’s propaganda has somewhat worked at making the general population anti-west and support the Ukraine invasion.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by easterncalculus on Friday September 08, 2023 @03:19PM (#37438142)
You can also 3D print the TSA master keys - here's the link https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys