However, I'd also be willing to make a huge bet there is zero chance the FB CISO at the time was aware of who these representatives allegedly were or approved what they were doing unless it was threat intelligence. I don't think this will be the last muck thrown by this company.
We also have zero evidence the people this guy talked to worked for Facebook. He could have been duped. He could be lying. It could have been two curious employees acting on their own.
What we can say is this guy lacks professional integrity. Throwing potential or actual clients under the bus in public is a sleazy move.
Unless NSO reached out to Facebook to try and sell them something, that is highly suspect.
There’s not a lot of information out there about that incident.
You may think that case warrants an exception, but it sets a clear precedent and encourages the hoarding of zero-days.
I think it's extremely easy to believe Facebook would launch exploits at users because they already have.
[1] https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-fo...
Thanks for the downvotes appreciate it
Facebook bought WhatsApp in 2014.
Pegasus is built on a WhatsApp vulnerability.
Should Facebook have patched this 4 years ago, rather than try to pay a third party to exploit it?
Plus even soliciting a 3rd party gives you plausible deniability if someone comes asking you if you exploited the flaw yourself. Oh, to be a capitalist in the 21st century is to feel ALIVE!