NSO considering killing Pegasus spyware under financial & lawsuit pressure

Posted:
in General Discussion
NSO Group, the security firm behind the Pegasus spyware used to attack iPhones used by journalists and government critics, is allegedly considering bailing out of the scandal by shutting down the unit in question.




The Israel-based NSO Group has faced considerable criticism and fallout after the discovery its Pegasus spyware was misused by governments to spy on journalists, human rights activists, and other people of interest to oppressive governments. So much so that it is apparently looking for an exit from the situation completely.

The company has allegedly been in discussions with investment funds to potentially refinance or sell the company, anonymous sources of Bloomberg claim. Advisers from Moelis & Co are working with NSO Group on the matter, while unnamed lenders are being advised by lawyers from Willkie Farr & Gallagher.

While unidentified, the potential buyers include a pair of American funds, that would control and shut down Pegasus following the transaction. In return, the funds would theoretically provide some $200 million in capital to NSO Group, which could help refocus the company's IP and technology to make it a purely defensive security firm, one that could also expand its drone technology effort.

NSO's deliberations follow after the U.S. Commerce Department blacklisted the company, despite claims by NSO that its "technologies support U.S. national security interests and policies." Apple has also sued NSO Group to prevent it from using its products and services.

Pegasus used various exploits and vulnerabilities in iOS to install intrusive spyware onto iPhones, with the software intended for use by governments and law enforcement against criminals. It became a scandal after the discovery that it was used by some authoritarian governments against potential dissidents and critics of oppressive regimes.

The security company is also in a position where it needs to pay back approximately $450 million in debt. A loan NSO issued in 2019 traded in November at 70 cents on the dollar, but bids on Monday were at 50 cents on the dollar.

NSO is already seeing a drop in revenue of 8% from 2018, with sales in 2021 expected to lie at around $230 million. With the shutdown of Pegasus, that revenue is expected to be cut in half.

Read on AppleInsider

Comments

  • Reply 1 of 14
    About time. They -- and their kind -- are a menace to everything Democratic, transparent, and free.

    Thank you, Apple. Seriously. 
    Alex_Vbloggerblogscstrrfviclauyycwatto_cobrabyronl
  • Reply 2 of 14
    I would rather Apple actually fix flaws like these instead of hiding behind the censorship of lawsuits.

    Maybe if they actually paid their security researchers properly, they wouldn't have this problem... a 0-day, no-click infection on the latest software should easily get a payout of multiple millions considering what black hat agencies would pay for it... and all Apple pays is $1M, and that's assuming they don't find some reason to de-escalate the level of severity in order to pay less...

    Apple should be paying more than black hats, not saying they will pay a certain amount and not even paying that (or fixing the flaws)

    Apple really dropped the ball on this.
    edited December 2021 MplsPwilliamlondonbeowulfschmidtxyzzy-xxxanantksundaram
  • Reply 3 of 14
    amar99amar99 Posts: 181member
    Let's get real, it's not like they didn't see this day coming. The money grab they could afford politically and legally is coming to an end, but it doesn't mean they haven't earned plenty from law enforcement and govermnets in the meantime. This isn't some "big news" or "shocking revelation". Just the predictable demise of an unscrupulous group of people.
    williamlondonwatto_cobrajony0
  • Reply 4 of 14
    MplsPMplsP Posts: 3,999member
    I would rather Apple actually fix flaws like these instead of hiding behind the censorship of lawsuits.

    Maybe if they actually paid their security researchers properly, they wouldn't have this problem... a 0-day, no-click infection on the latest software should easily get a payout of multiple millions considering what black hat agencies would pay for it... and all Apple pays is $1M, and that's assuming they don't find some reason to de-escalate the level of severity in order to pay less...

    Apple should be paying more than black hats, not saying they will pay a certain amount and not even paying that (or fixing the flaws)

    Apple really dropped the ball on this.
    I completely agree but at the same time there will always be holes and always be people exploiting them. The fact that Apple had to resort to a lawsuit tells me they either couldn't find the hole or couldn't plug it.

    This whole deal strikes me something like a ransomware attack - NSO creates a nasty bit of attack-ware, then says "for $200 million we'll drop it." Seems like the ethical thing to do would be to drop it without asking for $200  million. 
    scstrrfwilliamlondonStrangeDaysviclauyycwatto_cobra
  • Reply 5 of 14
    GeorgeBMacGeorgeBMac Posts: 11,421member
    Like all hackers and those who enable them, these criminals should simply be locked up. 
    bloggerblogviclauyycwatto_cobraAnilu_777jony0
  • Reply 6 of 14
    lkrupplkrupp Posts: 10,557member
    Read up on the development of the atomic bomb. Once the scientists produced it they immediately started regretting it and started lobbying to not use it. But the nuclear genie was out of the bottle and there was no putting it back in. Same goes for programs like Pegasus. That genie is also out of the bottle and the bad guys (governments, etc) are not going to just stop using it. 

    About time. They -- and their kind -- are a menace to everything Democratic, transparent, and free.

    Thank you, Apple. Seriously. 
    Democratic, transparent, and free? Nice goals but like peeing into a hurricane. We are already living in the surveillance society where privacy and transparency are just words. Just in the last few days we learned that up to 20 journalists were spied on by the DHS. Name one ‘democratic’ government that is truly transparent and respects privacy. And those governments are supposed to be the good guys. 
    edited December 2021 viclauyycGabywatto_cobra
  • Reply 7 of 14
    GG1GG1 Posts: 483member
    I would rather Apple actually fix flaws like these instead of hiding behind the censorship of lawsuits.
    I agree.

    But I actually think that if the NSO Group stopped selling Pegasus, the source code would be eventually sold to someone and proliferate wildly on the dark web. (Then maybe Apple could buy it and really harden iOS against these exploits.)

    williamlondonwatto_cobraanantksundaramAnilu_777
  • Reply 8 of 14
    lkrupp said:
    Read up on the development of the atomic bomb. Once the scientists produced it they immediately started regretting it and started lobbying to not use it. But the nuclear genie was out of the bottle and there was no putting it back in. Same goes for programs like Pegasus. That genie is also out of the bottle and the bad guys (governments, etc) are not going to just stop using it. 
    They've already demonstrated that they can revoke the license which turns pegasus into a useless paperweight.
    watto_cobra
  • Reply 9 of 14
    strongy said:
    lkrupp said:
    Read up on the development of the atomic bomb. Once the scientists produced it they immediately started regretting it and started lobbying to not use it. But the nuclear genie was out of the bottle and there was no putting it back in. Same goes for programs like Pegasus. That genie is also out of the bottle and the bad guys (governments, etc) are not going to just stop using it. 
    They've already demonstrated that they can revoke the license which turns pegasus into a useless paperweight.
    If you mean that Apple demonstrated that they can revoke a certificate needed to install some software, well that is not the way Pegasus works – so it can't be stopped this way. At this time the KNOWN Pegasus exploit has been fixed by an Apple security update, but nobody knows what other exploits exist...
    williamlondon
  • Reply 10 of 14
    It'll just pop up again under another name, in the hands of another company.  Or maybe they've already provided it to one of their current client countries.
    thtAnilu_777
  • Reply 11 of 14
    I would rather Apple actually fix flaws like these instead of hiding behind the censorship of lawsuits.

    Maybe if they actually paid their security researchers properly, they wouldn't have this problem... a 0-day, no-click infection on the latest software should easily get a payout of multiple millions considering what black hat agencies would pay for it... and all Apple pays is $1M, and that's assuming they don't find some reason to de-escalate the level of severity in order to pay less...

    Apple should be paying more than black hats, not saying they will pay a certain amount and not even paying that (or fixing the flaws)

    Apple really dropped the ball on this.
    You misunderstand the lawsuit. It isn't to get them to stop using Pegasus. It's to stop them from using Apple developer accounts & resources, since they created the accounts fraudulently and in violation of the terms of the agreement. It is a fair response to the violations of the terms of the developer account agreement. NSO isn't a security researcher looking to be helpful, they sell commercial products to exploit 0-days. Since they lied in order to do this, Apple is closing that loop by suspending their accounts and holding NSO accountable to the agreement they broke.

    No, nobody "dropped the ball", not any more than the fact that security defects exist in all software due to human fallibility. 0-day exploits exist for ALL platform, and nobody disputes that. 
    edited December 2021 williamlondondavenwatto_cobraAnilu_777jony0
  • Reply 12 of 14
    Apple should buy them to keep them to continue finding exploits, but also tell how did they it so Apple can fix those security holes. 
    jony0
  • Reply 13 of 14
    robabarobaba Posts: 228member
    So they stop marketing this stuff publicly and instead focus on further weaponizing drones?  Yeah, pardon me if I don’t find that very “defensive” in nature.
  • Reply 14 of 14
    And when the US has it do you really think they’ll just shut it down without taking a peek  or two? If you think that you’ve got your head in the sand. NSO should shut it down itself and destroy the research. 
    jony0
Sign In or Register to comment.