If you’re unfamiliar with NSO Group, it is a company that has often been associated with attacks, despite maintaining a guise as a legitimate software vendor. In fact, the company has always claimed immunity from prosecution because it works directly with governments. Perhaps the most famous NSO Group-related attack was what the company’s Pegasus software was used in an attack on WhatsApp. During what was described as a sophisticated breach, attackers could place spyware on iOS and Android smartphones by just calling them through WhatsApp. Amazingly, the victim did not even need to answer the call. Of course, WhatsApp quickly dealt with the issue by patching its mobile app. Later, the Facebook-owned company took NSO Group to court. Facebook has also since accused the company of using Pegasus to target users. Recently, the group is said to be involved in a spy hack on journalists working for Al Jazeera. In response, Microsoft is one of a group of companies saying enough is enough.
Microsoft Hits Back
Tom Burt, Corporate VP of Customer Security & Trust for Microsoft, published a blog where he left the company’s position clear in no uncertain terms. He calls NSO cyber mercenaries and said immunity on the company should be removed. “[…] private-sector companies creating these weapons are not subject to the same constraints as governments. Many governments with offensive cyber capabilities are subject to international laws, diplomatic consequences and the need to protect their own citizens and economic interests from the indiscriminate use of these weapons. Additionally, some governments – like the United States – may share high-consequence vulnerabilities they discover with impacted technology providers so the providers can patch the vulnerability and protect their customers. Private actors like the NSO Group are only incented to keep these vulnerabilities to themselves so they can profit from them, and the exploits they create are constantly recycled by governments and cybercriminals once they get into the wild.” Microsoft is calling for private firms like NSO Group to be held legally accountable when they break laws. Tip of the day: Do you know that Windows 10 now has a package manager similar to Linux called “Winget”? In our tutorial, we show you how to install and use this new tool that allows the quick installation of apps via PowerShell or a GUI.
