Discussion

• @jsrailton John Scott-Railton on x

  Wow, @WhatsApp just dropped a bunch of hacking group NSO's IPs in their latest filing. Notably, these were servers located in the USA. THREAD https://twitter.com/...

• @shanvav Shannon Vavra on x

  NSO Group, the Israeli software surveillance firm accused of spying on over 1,000 WhatsApp users last year, has used American-based servers to launch its attacks, Facebook/WhatsApp alleges in latest filing. Read more at @CyberScoopNews https://www.cyberscoop.com/...

• @billmarczak Bill Marczak on x

  WhatsApp out with new filings in their case against NSO Group re the famous “missed call” hack. Some new info: in 3 cases, the malicious code delivered through WhatsApp called back to IP 54.93.81.200, which was clearly part of NSO corporate infrastructure https://twitter.com/... …

• @jsrailton John Scott-Railton on x

  Ah! Another interesting detail, @WhatsApp engineers observed 723 NSO attacks on users in which phones, once exploited, reached out to NSO-owned servers in California (104.223.76[.]220 - @QuadraNet & 54.93.81[.]200 - @amazon) https://twitter.com/...

• @jsrailton John Scott-Railton on x

  The meat of these filings is @WhatsApp's rebuttal of NSO's claim that because they sell to foreign states, they should be immune to prosecution. “Here, NSO is a for-profit commercial company - decidedly not a foreign state https://twitter.com/...

• @jsrailton John Scott-Railton on x

  Non-denials like “we don't operate the software for clients” are irrelevant. NSO could be doing the device exploitation, then handing off phones to customers, who then operate the C2 ‘software’. cc @shanvav https://www.cyberscoop.com/... https://twitter.com/...

• @leeferran Lee Ferran on x

  I heard once that some foreign cyber actors use US servers to muddy the legal waters when it comes to NSA surveillance, since the bar is higher for spying on anyone reasonably believed to be a US person, etc. https://twitter.com/...

• @gregotto Greg Otto on x

  Hard to claim NSO doesn't have an operations plan in the U.S. when they are renting server space in California https://twitter.com/...

• @campuscodi Catalin Cimpanu on x

  Facebook-NSO lawsuit: Hundreds of WhatsApp attacks linked to one IP address. Facebook fights to keep the lawsuit on track after NSO filed a motion to dismiss the case earlier this month. https://www.zdnet.com/... https://twitter.com/...

• @shanvav Shannon Vavra on x

  As @jsrailton tells me, if NSO Group is running these servers, it means it has the ability to collect those logs detailing what its customers are doing. https://twitter.com/...