Loading summary
Transcript98 lines
- [00:04]
A
Hello, everyone. This is Tom Uren and I'm here with the gruk for, well, the first recording of 2025. G'day, Grok. How are you?
- [00:13]
B
Good day, Tom. Good. And yourself?
- [00:15]
A
I'm well. This week's episode of between two Nerds is brought to you by Resourcely. Resourcely makes it easy and safe to deploy cloud infrastructure. Check them out@resourcely IO so today I wrote a little bit about Paragon, which is a spyware company, Israeli indigenous spyware company that was actually bought by an American private equity firm.
- [00:45]
B
Hang on, let me guess. It was started by some 8,200 veterans and a VC in Israel.
- [00:55]
A
So way back a couple of years ago, I wrote about Paragon as a compare and contrast with NSO Group. NSO Group got into a lot of trouble because it was selling to whoever who was using, like, different countries. And I mean, is whoever with very loose standards about targeting people, and they were using that spyware abusively for human rights abuses to, you know, perpetuate regimes, stomp on advocates or human rights advocates, that kind of thing. Now, Paragon, at the time, the perception was that it had taken entirely opposite approach.
- [01:37]
B
Right.
- [01:37]
A
And it was deliberately trying to stay on the US Government's good side.
- [01:43]
B
Yeah. That they were doing, like, a threat assessment and they were vetting their customers to make sure that, you know, they were not. They weren't selling to, like, the devil who just happened to have $10 million and wanted to buy it. You know, they were taking some effort. That was the. That was the impression, at least.
- [02:01]
A
Yeah. I quoted the Financial Times and the. I'll just read from that quote. The company sought a list of allied nations that the US wouldn't object to seeing deploy Paragon's product, which is called graphite. People with knowledge of the matter suggested 35 countries are on that list, although the exact nations could not be determined. Most were in the EU and some in Asia.
- [02:29]
B
So I'm going to guess that it was like the eu, Singapore, Taiwan, India.
- [02:36]
A
I've never seen a list. But what's happened in the last couple of weeks is that WhatsApp has announced it's disrupted a Paragon hacking campaign. So there's lots of questions in my mind about what's been going on. And so we thought we'd talk about a couple of them. Now, coincidentally, you sent me a tweet, a very long tweet in Hebrew that we'll talk about as well, that contains some like.
- [03:07]
B
It seems to have insider info.
- [03:09]
A
I don't know if they're True or not. Yeah, it could be. I don't know.
- [03:15]
B
It's certainly plausible. And it's even. Even if it's wrong, it's worth talking about because they're interesting points, I think.
- [03:24]
A
Yeah. So how should we kick this off?
- [03:27]
B
So one of the things I think is interesting is how apparently it was sold to. So, like, they sold to the Singaporean Intelligence Agency, but they sold to American intelligence agencies. Right. And so that's sort of like. That's kind of one of the interesting things about the US is that the intelligence community, the IC, has got, you know, like 18 agencies or something, and they're each like their own thing. So if you're selling one, like one copy to nsa, CIA is going to want one as well, and then DIA is going to get their own one, and the FBI is not going to be left out. So you're able to sell the same technology over and over again to essentially the same client.
- [04:16]
A
Yeah. So that's, I guess, part of the strategic decision, like, do we keep our noses clean and we have the US Market, or do we forego that and try and get a lot of money from less savory countries?
- [04:30]
B
So I think, in a way, like, there aren't 18 countries that will buy as willingly as there are 18 agencies in the U.S. right.
- [04:41]
A
Yeah.
- [04:42]
B
You know, because they're obviously much richer than most of these other countries as well.
- [04:46]
A
Yeah.
- [04:47]
B
So, yeah, it makes very strong economic sense to just focus on the US and maybe a few European countries.
- [04:55]
A
Right. So that makes me wonder how you hold countries to a standard. Right. When you're selling a spyware product. So NSO Group, in its defense, said, yeah, well, we had terms of service that said that countries shouldn't do this.
- [05:14]
B
It seems like that's pretty ironclad right there. I don't.
- [05:17]
A
Well, yeah, exactly. That's the problem. Right. But Paragon has also said we have terms of service that prevent that. And so I was thinking about it and I was going, well, terms of service are not that strong, but then you've got customer selection, so they've got that. Like the Financial Times talked about an allow list of 35 countries that you could sell to. So presumably trustworthy. I'll use air quotes, because how do you trust a country?
- [05:49]
B
I wouldn't say trustworthy so much as it's less trustworthy in that the US doesn't categorically object.
- [05:57]
A
Right. Yeah.
- [05:58]
B
Right. Like, they're not, like, you can't say, like, DPRK is trustworthy, for example.
- [06:04]
A
Well, you can absolutely trust them.
- [06:07]
B
Hypothetically, you could absolutely trust them to abide by terms of service, however.
- [06:13]
A
Well, I mean, you can trust them to do whatever's in their interest and if the terms of service align perfectly with their interests, you've got no problem.
- [06:21]
B
This may only be used for stealing cryptocurrency. That's right.
- [06:25]
A
So I guess another way of thinking about it is that that list is in a way, a one time get out of jail free card for Paragon where they can say they were on the list. So we thought it was okay, we'll never sell to them again.
- [06:40]
B
Yeah, it's that he's your friend. You introduced me.
- [06:45]
A
Yeah.
- [06:45]
B
Like, you can't blame me for something he did. You know, I'm not going to do anything with him again, like, I've learned my lesson.
- [06:52]
A
Yeah. So it seems like to me terms of service combined with the list has an effect for Paragon.
- [07:01]
B
Right. So I mean, I think there's a sense of, you know, making fun of just the terms of service thing. Right. Like, yeah, you've got a piece of paper that says you're not allowed to do it. Ha ha ha. That's going to stop a spy agency. How? But I don't think that's the full view. I think that there is actually weight behind that. Right. Because if you're, if you're a spy agency and you're spending, you know, $10 million to buy a license for something, you're not doing it for three months.
- [07:32]
A
Yeah.
- [07:32]
B
Like that's still.
- [07:33]
A
Intelligence requirements are enduring. They don't go away just because you can get onto someone's smartphone.
- [07:40]
B
Yeah. Like you need to get those, like you need to get that information this week, you need to get it next month, and you need to get it next year and the year after that. Right. So when you're buying a capability that's offering access to a smartphone or access to an instant messenger account.
- [07:55]
A
Well, magic, really.
- [07:56]
B
Right, right. You want that. Right.
- [07:59]
A
And you don't want the magic to go away.
- [08:02]
B
Yeah. Like they have continuing requirements, like it's never going away. They don't want the magic to go away either. They're going to abide by the terms of service because it's going to keep the magic happening. I think is.
- [08:15]
A
And that only changes once it, like political masters override that. So it's almost, it's, it's almost against their better judgment, perhaps.
- [08:26]
B
Yeah, we'd like to think. Right. But it's absolutely correct. You could say, yeah, we've evaluated all this stuff. We shouldn't be Going after these targets. And when the boss says, but I want it. Yep. You know, like, yeah, what are you supposed to do?
- [08:43]
A
Hello, everyone. I just wanted to jump in at this point and say that almost immediately after Grak and I had finished this discussion, news broke that Paragon had actually ended its relationship with Italy for breaking its terms of service. Anyway, back to the show. Yeah, so I guess the terms of service and the list is a mechanism for Paragon to be able to sell. And it's, it's, you know, if it works with a particular country, that's great, and if it doesn't, well, they just say goodbye and move on. Anyway, let's move on to that tweet. So it's a very long tweet. It's in Hebrew. Like, the thing I found most interesting about it is that there's this section in the middle which talks about the technical details of what's going on. So I'll read out some of that, then we can talk about, like, can we actually trust a random tweet in a foreign language that's machine translated? So there's some strong caveats on this. I just thought it was very interesting. So the translation Paragon, unlike most offensive cyber firms, does not install spyware on devices. Instead, its capability relies on exploring vulnerabilities in instant messaging applications, allowing them to breach WhatsApp Telegram and Signal using only the target's phone number. Rather than infecting the device with spyware, like most market solutions, they effectively steal unique identifiers akin to usernames and passwords. With these identifiers, they exploit a vulnerability in WhatsApp's main servers, impersonating the target device to intercept all incoming messages. Think of it as a sophisticated version of WhatsApp web that secretly connects to a target's account without their knowledge or consent.
- [10:35]
B
So that sounds very plausible to me. It also sounds like a clever way of doing things in that, like, you're not leaving anything on the device. Right. Like, if, if someone says, I think I've been hacked and they hand their device over, it can be examined, you know, forever, and there's just nothing there to find. I mean, there's going to be some traces of the exploit for some short amount of time, but that's going to get erased.
- [11:04]
A
Again, many caveats here. I was thinking that surely this has got to be one of the ways that WhatsApp engineers would think things could go wrong, like cloning a device.
- [11:16]
B
I mean, they've built in workflows for that to happen. Linking a device to your account. So it's, it's a thing that they obviously support. The question is sort of do they trigger on, you know, Israel showing up for the same IP for like, you know, 100 different accounts?
- [11:38]
A
Now the other thing I thought was fascinating is that this is basically kind of like what the, a couple of people from GCHQ proposed and as a lawful intercept sort of workaround for the proliferation of end to end encryption, is that companies like Apple, WhatsApp Signal, you know, if they were served a lawful warrant, would silently add another participant to a conversation. And perhaps I like that because, you.
- [12:10]
B
Know, I want to have more friends. So the more people that join the better. I need someone to read my messages.
- [12:18]
A
A practical implementation of that, presumably. What's the word? Inadvertent is the word I'm looking for.
- [12:27]
B
I mean to me one of the things that stands out is he says like WhatsApp signal. Right. And then it's sort of never mentioned again. That does make me a bit nervous that they weren't exclusively targeting WhatsApp. Has Signal done an audit to see if this is showing up, which I think would probably show up as new accounts being added or new devices being added to accounts that are connecting from VPN endpoints in Signal.
- [13:02]
A
If you're using the web version and a device, it'll give you linked devices. But I was thinking that this was know in a way like cloning a device so it wouldn't appear as a separate one. I mean one of the things they mentioned was Telegram, where. Yes, this is a thing where you, you can log on to Telegram but because it's not actually end to end encrypted.
- [13:23]
B
Right. I mean it is except that one of the ends is a cloud server and the other end is your device.
- [13:30]
A
Yeah, yeah, yeah. So to me this is like if this was true, it would be very interesting. I don't know if it's true. And the question I asked you when we were talking about how much trust should we put in this tweet?
- [13:43]
B
Yeah. Who are you going to believe? A random anonymous, automatically translated tweet from an account that no one knows about?
- [13:53]
A
Well, I mean it is an issue statement and it's an Israeli company. So you know, there's that.
- [14:00]
B
I mean the thing is like there's so much like this vitriol of like someone is genuinely upset. It's, I don't know, like 2,000 words long or something. It's huge.
- [14:10]
A
It feels a bit personal like because it's, you know, why is someone not doing something about this. These famous people are making money out of it. They're not doing the right thing.
- [14:20]
B
These are all the things that this guy is doing wrong. Why isn't the Ministry of Defense doing anything about it? Like, it feels personal. I think you're right. Like it's. This is probably, this is probably the guy who tried to get a job at Paragon and was told it was a culture fit issue or something.
- [14:38]
A
And it seems strange to just make up that stuff because it, it seems like a bizarre, like what's, what's the point?
- [14:46]
B
So, and it's internally consistent. Right. Like if it was someone just making things up, it would be like it would have points that don't make any sense or it would be sort of completely weird. But all of it seems internally consistent.
- [15:03]
A
Yeah. So here's a good example. One of the founders, I think was Ehud Schneerson. And so later on he said Paragon believed their software would be nearly impossible to detect since it wasn't installed on the device itself until they were exposed. As usual, Schneerson's characteristic arrogance played a role.
- [15:30]
B
You know, that's exactly what I was thinking.
- [15:33]
A
So yes, it's an example of it being kind of personally very.
- [15:38]
B
It's someone who, it seems like insider knowledge rather than.
- [15:43]
A
So yeah, like kind of this dissection of it makes you think more plausible than not.
- [15:49]
B
Yeah, like the level of detail it goes into as well I find very interesting. I mean particularly some, like some of the anecdotes. Like they've got this one which like it cracks me up. So one of the ways that an intelligence agency does operations is they will create a test environment that mimics that sort of like that perfectly replicates the target environment. And they will test their stuff in that environment to make sure that it works, to see what artifacts does it leave behind, how reliable is it, all these different various things. So they set up this test environment, they tried it against an iPhone, presumably they decided it was functional, whatever. And then shortly afterwards they get a message from Apple on that iPhone saying device has been targeted by a nation state attack.
- [16:47]
A
That part sounds very plausible. I can, oh my.
- [16:49]
B
Yeah, like I can see that happening. So, you know, and like it seems too real, like to not be true. That's just, it's too funny to be fake. That's my stance.
- [17:06]
A
The funny thing is, at least in the translation, it's not written in a funny way. We think it's funny, but it's like pretty straightforward down the line.
- [17:16]
B
They play it straight and they're outraged. Absolutely outraged.
- [17:20]
A
Yeah. There's another section where it talks about how Sheerson is a former Unit 8200 commander. So 8200 is Israel's kind of signals intelligence and cyber espionage unit, is my understanding. And it basically, the tweet complains about him luring away so many staff that it's dismantled one of the unit's most critical divisions. So that's the sort of bitterness of someone who's potentially been left behind.
- [17:56]
B
Exactly.
- [18:00]
A
Because that money, in the end materialized, it says.
- [18:03]
B
Yeah, right. He lures everyone away with the promise of riches and they got rich. Bastard. I mean, it feels personal. It really does. Like there's some, like, he got left behind, or he's a competitor who has not had the same success with sales or. I mean, there's a real sense of, like, personal investment in the story or a really, really good author that should, you know.
- [18:36]
A
Yeah. So I keep on going back to the. Well, you know, surely this is something that you would really try and make sure didn't happen, like. Like that kind of vulnerability from a WhatsApp engineering point of view. But I guess there's been, like, similarly amazing vulnerabilities that shouldn't exist, like, you know, opening lock screens and stuff like that.
- [18:54]
B
Yeah, well, like, there's actually. There's an amazing vulnerability that just got patched where a renderer process in Chrome can move the mouse and make it send clicks. And so you can literally have an exe and you can have it click the exe and run it. So, I mean, you can use the mouse to do the human interaction part.
- [19:26]
A
Right.
- [19:26]
B
Which is, you know, you'd think, why. Why is that allowed? And I think. I think maybe the other thing to bring up as well is, like, it is a vulnerability. Like, they didn't intend for this to happen. They just had an oversight where they didn't prevent it. Right. Or they, you know, it. Like, it is.
- [19:46]
A
Assuming the tweet is correct.
- [19:47]
B
Right, Assuming the tweet is correct. And I mean, the thing is, the. The technical details that have come out from other sources, they don't preclude thin on the ground.
- [19:57]
A
Yeah, yeah. So I actually went and looked and, like, what other sources were saying. So no one else has reported that this is the way it works. They've said that there's an implant called graphite. So let me just read out what WhatsApp said. So this is from TechCrunch. WhatsApp said it had disrupted a hacking campaign. WhatsApp said that the hacking campaign used malicious PDFs sent via WhatsApp groups to compromise targets and said it had pushed a fix to prevent this mechanism. The hack did not require any action by the targets, according to the company. So that to me doesn't, doesn't spell it out either way. And so this is a paraphrasing by TechCrunch, WhatsApp. I've not found a public statement about it on anywhere. So I think they reached out to media outlets. And so, you know, it's sort of Chinese whispers. Right. I doubt that WhatsApp would say, oh yeah, people can have their conversations mystically stolen with no interaction from you, don't worry about it. And also from a paragon point of view, it makes perfect sense that they would say, oh yeah, we have an implant like everyone else and it works the same way as everyone else's, except.
- [21:17]
B
Ours is invisible and you'll never find it because it's that much better. We leave no trace behind.
- [21:23]
A
So it's. Having an implant is a very good cover story if you have that capability.
- [21:29]
B
If you have that capability and if that's the only capability you have. Because if you're a one trick pony like this, when WhatsApp catches on and fixes it, you're done.
- [21:43]
A
Yeah. And if it works in signal, they'll tell. Signal.
- [21:47]
B
Yeah, that's it.
- [21:48]
A
You'll still have Telegram.
- [21:52]
B
No matter what. We'll always have Telegram. Yeah. So I don't know how much you can trust a random tweet from essentially an anonymous account that's been machine translated from another language, but nothing stands out as being untrustworthy.
- [22:14]
A
You want to believe, don't you?
- [22:16]
B
Yeah, I'm just, I'm going to tell that anecdote from now on as if it's true.
- [22:23]
A
So, you know, thanks a lot, Brock.
- [22:27]
B
Thanks a lot, Tom.