Apple Alerts Exploit Developer That His Iphone Was Targeted with Gov Spyware

> 'I never thought leopards would eat MY face,' sobs woman who voted for the Leopards Eating People's Faces Party.

* https://twitter.com/Cavalorn/status/654934442549620736

If you are actually security conscious, the only setup that works is have a public facing phone and a private phone that is custom rooted, de googled, and you control everything that runs on it.

Does that really not make sense?

Another reason not to work at places like this.

First line says "personal phone". I presume MDM on a work phone could do most of the things they'd be interested in, without the risk of setting off an alarm like this. Anyone have speculation about a reason for an employer to pwn a phone that's already on their MDM?

It very much does matter. If more people refuse to do this type of work, it eventually won't be done to the required standard. People would cut family ties and this would stop fast.

Slippery slopes don't justify anything. You might not care enough to make a difference, but many people do and your justification rings hollow to everyone that's potentially a victim. You wouldn't say this about nuclear proliferation, so why make a carveout for digital mercenary work? Because it's "harmless"?

I don't know what your goal is with this statement but it certainly doesn't make me feel any better. If you're this emotionally invested in the topic, it might be best for your own optics to not chime in.

However I don't agree with the repercussions of this, which are the same ones that make all reasonable people, security experts included, oppose EU's ChatControl or the UK's backdoor requests: There is no way to ensure and protect the people that need protection, as there is no way to ensure that only "the good guys" have it.

We tend to bullshit ourselves into believing that because spyware software like Predator are weapons, meaning that only countries would be allowed to buy them and use them (same way that Jeff Bezos cannot buy and use an F-35 for example). We see though, that certain individuals _can_ get their hands on these things and use them however they want.

For example, 3 years ago someone adjacent to the greek government bought and used Predator against MEPs, journalists, army generals, mafia bosses, MPs of opposing parties and even MPs of their own, ruling, party. The greek government of course denied that they did it, and they said that this individual did not act under the instructions of the government (though they then changed the law to prevent anyone for learning details about it, but that's a different story).

So, apart from adopting the same approach as with ChatControl and encryption backdoors, i.e. banning them, I don't know how we could protect ourselves against them.

The OP did say "...for resale in good conscience."

I personally read that as the commercial companies that allows anyone to buy the product off the shelf for the right price -- including governments, but also rogue elements. Bad actors, groups, or even people engaged in abusive domestic practices (customers without the time, experience, or resources to do it in-house). Not the people who work directly under government agencies developing these things for State level intelligence/ops

you, sadly, internalized a state humanity adopted after wwii, were the anti red propaganda told everyone that of you could illegally burn a forest down to then buy a Ferrari, it was the best course of action because if you didn't do it, someone would.

thankfully people like you are being ostracized, albeit too slow, and pointed out as what you really are: agentless weak oportunists.

Tell that to Epstein.

If you develop weapons, physical or digital, don’t be surprised if you end up on the receiving end.

1. This guy was targeted by spyware.

2. This guy was an iOS 0-day exploit developer and is involved with a bit of drama with his previous employer.

Everyone seems eager (including himself) on connecting the two, but why would the ex-employer go after him using illegal methods when they've agreed to a settlement and termination? Unless there's more to the story (which I strongly doubt) it seems to be combined mix of legitimate but misplaced paranoia and lashing out.

Not going to lie, this subject line would fit right in with the phishing messages and 419 scams in my Spam folder.

A better mechanism would surely be a push notification to the device, or one of the alert-based notifications used for earthquakes etc

The point was at this level of expertise and size of market ("detection of iOS zero day rootkits"), there simply isn't a pool of "experts" you can draw on to do this a-la contract work. It's a tiny world and everyone is fumbling around and asking for help independently. And as a member of that tiny world, Gibson surely knew who he needed to call already.

But that's not the way the article framed the interaction, which implies to me that there's more context at work here.