[beermonster]

From the article: “.. a port knocking backdoor with multiple targets such as Solaris, Linux, FreeBSD, HP-UX, JunOS, OS X”

So this was far more reaching than Windows.

To answer what ordinary users can do: Against a well funded adversary hell bent on getting access to your systems/data - probably not a lot! In the case of NSO group even a fully patched iPhone wasn’t going to help you.

However, on reading this article my first thoughts are if this method evades detection by not having a listening port that a network scan or locally using ss/netstat can detect then perhaps you would still be able to benefit from egress filtering (only allowing outbound connections to things you need and blocking the rest). On a router most connections are through the router (FORWARD table) as opposed to directly locally originated and outbound (OUTPUT table).

[Sebb767]

> To answer what ordinary users can do: Against a well funded adversary hell bent on getting access to your systems/data - probably not a lot! In the case of NSO group even a fully patched iPhone wasn’t going to help you.

Well, you can - you just need to live a mostly offline live with few, highly hardened devices and enter you passwords under a blanket. Edward Snowden does manage, after all. But you'll have to skip on a lot of enjoyment - new software, games, even Netflix - forget it.

The real question is, is it worth to you to live such a live. Probably not.

[aborsy]

The NSO could get root on anyone’s device knowing only the phone number.

If NSO does it, so could the intelligence agencies of dozens of countries. Looks like a hopeless situation, where a small percentage of population have access to anyone’s data (but not conversely).

This is posing a threat to the democratic society.

There ought to be a way to make a secure device.

[hnthrowaway0315]

I think one way to add the difficulty is to conduct everything offline. Since they don't have a full profile for you online, they have to mobilize field teams which are scarce and expensive. On the other hand, if they can sniff you online, it's going to be automated and almost free.

But again, maintaining an offline life could be very tricky given that the society as a whole is moving everything online. For example, if you earn salaries like me, there is no way to avoid a bank account and a mobile number.

[Jerrrry]

This is correct, and why many lawyers do not maintain online presences, and do not conduct business online, in any capacity.