> Graphite belongs to the same category of commercial surveillance technology as Pegasus, the better-known spyware developed by NSO Group. Both are classified as mercenary spyware, meaning private companies develop and sell them to government intelligence and law enforcement agencies.
This buries the lede a bit. These companies play their part in trans-national organized crime networks, spanning countries like the USA, Russia and Israel. In Russia, it is often hard to delineate between organized crime and the FSB, because these networks overlap and they are often well established within the structures of the state. The same increasingly applies to the USA.
ICE is becoming a paramilitary force, "immigration control" is clearly not its only purpose. I cannot unsee this from the massive purges in the military, rooting out the most competent leadership. The parallels with Russia can't be ignored.
there are many if these companies and toolkits. too many to mention. more than 150 countries spend over 10M a year on _offensive_ cyber. generally making use of such toolkits if they lack inhouse capabilities, which is pretty much all of those countries because the people creating the capabilities will refuse to work for them, so they can sell their tools.
"In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware."
Zero clicks are cheap if NSO can afford to go after students.
When a company sells a 0-click exploit like that, they don't sell the actual malware/exploit, they sell access to a service or product. The contract will likely have a certain number of attacks with additional infections having a set price of $XXk.
That is how companies like Crowdfense can pay up to $5 million for an exploit. The sell it to some service (or have the service themselves) and generate revenue off of that. The person who sells that exploit gets some of that revenue, they're not getting $5 million up front.
> Researchers have confirmed Graphite attacks through WhatsApp and iMessage, although the complete method remains secret.
unsurprising that it's closed source software which is vulnerable like this. LLMs can now decompile binaries very efficiently so it's not even security by obscurity anymore.
you really have to screw up to not carefully trace the path of incoming messages to ensure they are processed safely.
for people that don't understand how bad ICE is, here is a brief selection of _recent_ news about ICE, this isn't even like the product of an extensive search
> ICE Deports Milo Yiannopoulos, to settle some intra-MAGA feud
This is probably the one valid thing they did. He's truly vile [1]. He's also illustrative of how most undocumented people aren't "sneaking across the border" as the media claims but are simply visa overstayers. Still, Laura Loomer shouldn't have the power to advance his deportation. The story goes that he was in removal proceedings and he didn't show up for his hearing before an immigration judge so was ordered deported in absentia and then ICE picked him up.
Milo Yiannopoulos is just not a hill I'm ever willing to die on.
I’m sure we could come up with a better system than paying extreme amounts of money to detain in terrible conditions non-violent people who were following the rules that were previously given to them.
They’ve been doing this for a while. And actually there’s a pretty great episode of darknet diaries that talks about how they were directly targeted by 8200 agents (taken out to dinner in New York IIRC). They were trying to find dirt on the guy.
