thank you very much thanks for the
introduction and I'm glad to be here on
this wonderful stage um and today I want
to talk about um basically the topics
which came up in my area of work in the
last couple of years in my experience I
had um there um working for media
companies and um therefore I prepared
this topic who am I I've done my uh
Masters in it security and forensics and
I worked um for different companies
mainly in the um Media or broadcasting
um field in the last couple of years in
the zck or blue team area um I also
wrote a book about Wi-Fi security and
currently I'm working for RF which is
the public Swiss radio and
television and today um I'm going a
little bit throughout the cyber security
framework and trying to um give you some
topics um mapping to the different
fields there so we are talking about the
situation we have here in Switzerland we
are also doing a little bit of threat
modeling or how to threat model and um
and I will have some like best practice
defense mechanisms for you prepared and
then we are going to the forensics
part so how is the situation here in
Switzerland this is the um freedom of
press index it is released by reporters
Without Borders every year and we are
currently in ninth place out of 180
countries so it definitely could be
worse
um yeah um but it doesn't mean
everything is perfect we are still
colored yellow instead of green so um
yeah we also have room for improvement
there and um I mean journalist don't
only work here in Switzerland so
therefore we have definitely a lot of
different
threats um we all know about a lot of
different government which is
professionally made by companies to
supply governments Secret Service police
for fighting crime um but we all know
that this is not always the case and it
got sold to um States in if um like more
autocratic regimes and it has several
cases there are several cases where um
not only like um human rights Advocates
and activists have been attacked but
also
journalists and this is the thing
broadly spread around the world um and
the probably most famous software in
this area is pigasus this is um a
spyware government spyware made by the
Israeli company NSO group and that is
known for being able to still circumvent
all the security measures from even
upto-date iPhone and Android systems um
and this one is broadly used around the
world um and we know since um a couple
of years back that this is also a case
of the that they are using it here in
Europe um we know of 16 countries here
in Europe where pigasus is currently in
use and then back then when this article
was released Switzerland was not on the
list but that changed quite uh some
years ago in
2021 we had some whistleblower from
probably the Secret Service talking
about it confirming that they're using
pigasus and back in uh spring this year
there was another whistleblower um
confirming it and that they are still
using it
today so what are the different kinds of
surveillance we have here in Switzerland
on the one hand hand we have mass
surveillance this is all the um broad
surveillance measurements which can be
done without any judicial decision and
um which is used to surveil basically
everybody so we have the C off clear
which could be translated with like
cable reconnaissance probably and this
is a fairly new law which was made to um
intercept and um yeah e drop on all
outgoing connections all the data
traffic going out of Switzerland because
um the argumentation was um no we will
not try to spy on Swiss people is if two
SS people are communicating with each
other you don't want to spy on that but
everything which is going outside of the
country this is definitely an area for
interest of interest for us and
therefore they made this law
the problem about it is if you think
about it um they are allowed to um
reconnaissance or they allowed to e stop
on every connection going outside and if
two Swiss citizens are writing an email
between each other you using Google mail
this will definitely go through some
servers outside of Switzerland as well
as nearly every other communication or
like every app use some cloud back end
which is probably not hosted in
Switzerland or most of the websites are
not hosted here so even Swiss citizens
will probably get the majority of their
um data traffic um being e dropped
on then they have we have the
forer um the data retention or data
retention law which is a law dating back
to 2002 and it was made for um
like reconnaissance for law enforcement
for phone calls SMS
MMS um and it
basically um enforces that every
ISP um has to save all the metad data
they get um of all calls SMS Ms for a
period of 6
months um that means they are getting um
like a phone number um in the May uh
date and time of the connection but um
through
the uh through triangulation of um how
far and how good the connection to the
nearest cell towers are they can also um
triangulate your
position um later on that was also
broadened that emats are also um falling
under that law and this is all being
done without any judicial decision um
and it's still in place
today how about targeted surveillance
here in
Switzerland um there are a couple of
laws regarding that and to put it in a
nutshell um there is the possibility to
confiscate your phone to confiscate your
electronic devices and to go through it
um and also the use of a government
spyer is permitted here in Switzerland
but all of this has to be uh presented
to a judge first and he will make a
decision if it will be allowed in that
case or not so it will be some specific
targeted
surveillance um and this is also the
area where pigs would come into
play um thanks to the leaks we got in
Spring of this year we also know the
price tag which the Swiss we service has
to pay for um targeting um or for E
stopping on one device with pigasus and
I think it's about 3,000 to strengths
per month per
device and um this kind of enforces them
to not use it as a measurement of mass
surveillance just out of economic
reasons so we can be sure that they are
indeed only using that um when they have
a definite suspicion of somebody
um yeah let's start with thread modeling
I don't want um want to recommend like
security measurements which are that
restrictive that you have
to um like like your daily working um
experience will be quite bad with your
devices and I don't have to recommend to
everybody that you do the snord move and
cover yourself with a blanket every time
you type in the password so therefore
you should do your own thread model to
see on which kind of uh risk level you
are and the most basic thing would be
basically uh risk analyzis um having an
basic risk Matrix here you have your um
xaxis with your uh country you're
operating in or you're doing your
research in and you're having your y AIS
with the risk level of the topic you're
researching and that also pretty much
correlates because not every topic would
be the same risk level in every country
like for example if you're researching
some some scandal in the car industry it
would be a high-risk topic for example
in Germany where there's a big Lobby and
a lot of money involved but here in
Switzerland it wouldn't be that much big
of a thing because they don't produce um
a lot of cars here um and if you're
doing the same thing in banking it
probably would be a highrisk topic in
Germany too but it would be way more
risky here in
Switzerland um and how can you identify
the risk level of a country that is
quite easy if you just use the freedom
of press index from reporters Without
Borders and they are releasing it each
May um of every year and they are
ranking 180 different countries so all
the countries they can get like uh
sensible uh or usable dat data from um
and they are doing it with five
different factors they have the
political indicator the economic
legislative social cultural and a
security indicator and they're basically
taking the average out of those five and
giving you a global score and ranking
you um towards all the other
179 uh
countries and as you can see here in um
Switzerland we are doing quite good and
all the northern Central and Western
European countries are doing quite well
while um yeah we have quite the lack of
a lot of Eastern European countries and
basically the rest of the
world um so you can get a feeling of
your risk level just using
that if you want to go a little bit
deeper you can do some more advanced
thread modeling using a framework like
stride there are different Frameworks
available but this is quite an easy one
to use it is just um categorizing your
threats into six categories spoofing
tempering
repudiation which is that you can claim
that you didn't do something which you
did
um information disclosure denial of
service and elevation of
privilege and um you can categorize your
threats using these categories and then
mapping mitigations to each on one of
them so how would it work you basically
paint yourself a diagram of your um
commonly used it infrastructure you you
work with in your daily life as a
journalist um um and you like you have
your entities you have your processes
you're maybe um doing
some trust boundaries and then when you
have your like a context diagram you use
it and Define threats or brainstorm
threats for each of those entities and
processes you have um and then you
identify mid possible mitigations for
each of those threats do some uh oh
do we have some AC here
maybe um and yeah it is a process which
you do we have to do
something maybe someone
blows
okay then I will improvise okay let's do
it um have do you have to do everything
by yourself and manually know there are
some tools available and you could just
um go to the website of reporters
Without Borders and they have an online
tool like an online wizard guiding you
through of it um which would be an easy
and quick method and if you want to do
it a little bit more in depth you can
use the over threat Dragon which is a
tool mostly used for threat uh modeling
in bigger Enterprise environments or
even business
threats um but you can definitely use it
if you are a
journalist so let's step on before the
Beamer will burst Up in
Flames um how do you defend I mean it is
definitely this is a topic with which is
um
definitely um something related to your
threat modeling right but over the years
there are some general tips and tricks
or some best practices which uh came
into play which I try
to uh collect here so I don't want to
bore you with the basics like do your
updates and use a VPN if you're on
public Wi-Fi and obviously tofa
everything it's Etc um so I want to move
on quite quickly also like encrypt
everything use LS for Linux and
veracrypt for Windows and ssds and if
you have some cloud storage in place um
which is definitely uh promising you
very well being very well encrypted
don't trust it use Krypt tomato as nor
Source um endtoend
encryption to additionally encrypt it
but also keep in mind um about your
target audience if you're doing it
security stuff for journalists don't
expect everybody to be super tech saavy
so sometimes you have to go with the
second best option um if someone doesn't
want to bother with this tools and uh
you just have to give them like a crypto
USB stick which has a keypad on it um to
easily encrypt and decrypt
it there are no open source open
Hardware um tool TOS like that I know of
at least so I wouldn't recommend doing
it unless um you have to but yeah
sometimes it's
just um business
need also thankfully since the security
measurements of smartphones got quite
better in the last couple of years um
persistent mware gets more rare and
there is quite a lot of more or spyware
which will get delet needed by a reboot
as funny as it sounds so reboot your
phone regularly also maybe don't use
like your business smartphone or iPhone
your employer gives
you but um
okay but use an alternative operating
system
instead I think we are taking off here
okay and if you have an iPhone you can
also AC AC at the lockdown mode and the
lockdown mode is um mode made by Apple
which will quite restrict you in your
daily life so it's not recommended for
everybody but if you are a highrisk
Target or going to a high-risk research
project you can activate that and it
will basically um deactivate all
iMessage attachments besides pictures it
will um won't allow any MDM on your
device it will deactivate just in time
compilation in Safari will turn off 2G
and um it will also delete all kind of
metadata of pictures when you are
sharing
[Applause]
them another topic would be file
sanitization um not all the all the
fights you get are free of mware but but
also not free of the risk of doxing your
Source or your
whistleblower and I will come back to
that
later also there is the Google Advan
Protection Program if your employer
forces you to use Google there is this
mode which you can activate and it will
basically um do the best practice of
Security Options um activate them for
you like enforcing tofa uh and doing
deeper Gmail scans and uh restrict the
third the use of third party tools to
connect to Google
[Applause]
services if that is not enough for you I
have some more tips and
tricks and if you really keen on staying
Anonymous and your smartphone to stay
Anonymous just switching your Zim card
regularly probably won't help so there
is a method that you're just
deactivating all outgoing um like
interfaces like 4G 5G Bluetooth Etc and
you use uh Mobile 5G modem instead
because there are some modems where it
is possible to change your ime I may is
the identifier for the network interface
M for your Zim card um so have a set of
anonymous SIM cards you're switching
regularly and then have an a modem with
a changeable IM and only connect to that
modem if you want to use your
internet also try to check your hotle
room for bux and cameras which can be
quite
tricky um there is a method like a
stroboscope flashlight um turn off your
light in the hotel room and try to see
if you can see
lens glare in your room because camera
lenses will reflect the
light um but yeah bugs are quite hard to
detect you would basically have to uh
like disassemble all your power plugs
and everything so good luck for that but
what you definitely can do is unplug all
your iot devices you have in your hotel
room unplug your smart TV unplug your
probably your IP um phone you have in
your room and yeah if there's some Alexa
or smart light bulb um probably also
deactivate
that yeah so just to make a quick note
we realize we've lost the projector
we're really sorry about this um with we
are recording and streaming so hopefully
the content will be viewable at a later
point but I suggest at this point if you
just keep going try
to iterate verbally as much as you can I
mean we've got a screen the screen yeah
I can try maybe here but yeah if you
keep going we we're trying to fix it so
sorry about that guys
yeah now we lost the
screen um yeah I will just improvise so
the next um method would be a datman
switch you want um you probably want to
have uh some measurement if you get
caught or you are feeling that you will
soon be caught um to delete all your
stuff so um there is an app called
Ripple for Android and there is
also um there's also the possibility to
just go to a colleague and um give them
your logins so he and tell him I will
call or contact you every 5 days and in
the event I don't contact you um for
five days straight then log into my
accounts and uh remote wipe everything
remote wipe the phone
Etc you can also do it it with a
technical measurement um there you could
like get a phone number and if you call
that number you can even do it out of
prison um it will activate a remote
wiping mechanism which will um yeah
remote Vibe your Cloud Drive and your
iPhone and everything you have set
up I mean I don't have to no no please
please do keep going because for the
stream they will see it so keep going
thank you okay um now you have to
imagine a picture of a screw with some
paint on it and this is the the warranty
paint you may know if you open your
laptop and you see like a drop of paint
on your screws um they want they try to
tell you if you unscrew that your
warranty will be voided in a country
with good consumer protection laws it
won't be the case but they're to still
trying to do that but you can use this
kind of paint you can order it on Amazon
or Ebay or whatever for a couple of
bucks and um you can paint it on your
scoo yourself because there probably
will be some time frame where you leave
your devices unattended right you will
leave your laptop in your hotel room or
you will um you want will go over a
border where the Border guards have the
legal possibility to search your stuff
out of your eyesight so your electronic
devices might be a thank you very much
might be um
might be compromised there so to see if
somebody tempered with your device Mark
all your screws maybe even the um yeah
everything which can be opened basically
so you will know when somebody
with
it
um you okay next topic will is what kind
of smartphone do I
recommend
um our smartphone operating system there
is this thing called graphos and I mean
you have the always the problem if you
are using a custom rom does it really
improve security and the answer is not
not always um it will probably leave you
with an unlocked boot
loader um it will um leave you verified
boot Etc and um this will not always
improve your security but there are
alternative ROMs or custom roms which
are focusing exactly on that
and um graffino S is doing an Al source
project it is made by some NGO um with a
big Community behind it um donation
based and they are having um privacy in
security Focus smartphone operating
system made for especially such
purposes um and it has no direct
connection it's like completely deg
Googled and it uses some different
security measurements ments like the
Hardware security module it has a long
update life cycle um
and has a locable boot loader and
verified boot which most of the custom
rooms
don't it's fully open source and
freeware and you can get it easily by
the website that's another point if you
tell a journalist yeah flash your
smartphone with L Os or some other
custom ROM uh you have to somehow
find vulnerability to unlock your boot
loader and then flash custom recovery
and then uh put the alternative OS via
ADB on your phone and they will go crazy
so graphos s on the other hand has an
easy web
installer and uh therefore is
and therefore can be done by a non-tech
savy journalist
himself okay and
[Music]
it I'm sorry guys
we are all
professionals yeah uh I can't see my own
screens
it's okay as we have a coffee break into
next thing we can still overlap and give
you the time you need that's cool but uh
yeah just bear with us guys apologies of
course for that uh yeah we're doing the
best we can as quickly as we can
maybe while we're waiting I don't know
if anyone does anyone have any questions
already at this point we could maybe
already ask a few things if anyone does
please raise your hand and we can
uh keep engaged whilst we wait
here uh I have two questions for you if
you
hear yes yes so the first one you me
mentioned that the uh companies in swi
zone have to retain emails for a certain
amount of time thus uh for example
proton mail has uh have to actually
retain the emails for that period of six
months as yeah are they legally bound to
do
that yeah there are exceptions for small
companies and as far as I know proton
male is still small enough to um be
under that exception and they also F
fought it illegally with their lawyers
and as of now they don't have to do it
as far as I know also um the for data
retention law is only regarding metadata
so they can't uh even if they would fall
under that law they don't have to
publish the content of
emails thanks and the second question um
you mentioned that the location is being
corrected by the train of the phones uh
are you saying that the telecom
companies are required to provide this
information at real time to the
intelligence services or is it more like
based on the metadata of the previously
collected uh like SMS messages uh as you
said before and then somehow made
assumptions based on
that um I'm not sure if I got everything
it was a little bit uh so the question
is basically whether the uh uh telecom
companies are required to uh provide the
information on the basically location of
the phones real time or is it just based
on the uh subpoena uh access to the SMS
messages walks something like
that um to be frank I don't know I don't
know if there's like an APA in place the
Secret Service can just get all the
information in real time
um but I think
that they will get it quite quickly if
they want to but that is I'm not sure if
that is publicly known if there's like a
time delay between message send and
delivered to state secret service or
police I'm not sure about
that great we will still have time for
questions more the end we have a small
screen thank you Tech guys we got show
love we Lage you thank you very much
so we will continue sorry for the guys
at the back I hope you brought
binoculars otherwise again this is being
recorded and stream so we can catch up
but uh yeah we hope we can continue to
finish now thank
you okay um yeah I basically talked
about my recommendation about the
smartphone operating system and um yeah
be very aware which apps you put on it
um since every app basically could be a
way of um like data
loss so probably use open source apps
from the FID store and do some due
diligence so look into it if there's
some public bu tracing on GitHub of
those app of of this app if it gets
updated regularly if there's some
Community behind it developing it um
and yeah be aware that Pro like the less
apps you install on it the less um
possible vulnerabilities or um there are
um also there is the possibility to
activate Google Play services if you
want to and that totally depends on your
threat model and your business needs so
um it is a Sandbox Google Play services
which you probably can get kind of
anonymously running with an anonymous
Google account um but yeah this is for
you to decide if you really need it or
not
um another thing which your journalist
probably needs in a daily basis is a
whistleblowing platform how can a
potential Source contact you securely
and without exposing himself or doxing
himself there is an industry standard
it's called secure drop and it is an
open source solution for whistleblower
submissions um it was developed by
firstly Aaron Schwarz and then the
freedom of press foundation and it's
used by a lot of media companies
worldwide like uh the ndr not the
guardian theong BBC but also
srf it's open source it's freeware it
had several security audits uh done um
cure 53 did one back in the days and
there's also bu Bounty program in place
so it's not the worst thing to
have yeah that would be great if it
would be bigger but let's try so
um this is your whistleblower your
Source who wants to drop some data he
will connect wire tour Services um here
is an internet gateway and you couldn't
make it a normal um router or some 4G 5G
modem and behind that you have a
monitoring server and the application
server and see monitoring server is
doing uh what the name says it will send
you an email if something breaks and the
application server is another Ubuntu
Server running the segmented toad
services and which is the interface to
connect for your journalist uh for your
for your sources but also for your
journalist because the journalist will
also connect via tour um to download the
dropped document ments and these
documents are still
encrypted and you have to transport them
to an air gaped device where the
encryption keys are stored um to prevent
them from ever being leaked um decrypt
those things do your um like uh file
sanitization some like virus virus scan
Etc and then you can put it on another
USB stick and trans import it to your
Enterprise infrastructure infrastructure
to work with
it f
sanitization um you don't want to drop
your files you get from your sources
immediately on your Cloud Drive or on on
your uh file system storage you want to
defend
against those three different threats um
malware metadata leakage and document
tracking um we have some self-built um
measurements in place which are
unfortunately not yet like publicly
released or open source so I will just
show you the basic um scheme of it um we
do it that way that we have a
laptop and you put in your USB drive it
will do a basic mare scan and then start
either virtual machine or some um some
Docker cont container and do the
sanitization and you get your clean
fights put them on another USB drive and
then you can work with it um and the
software we are using for it um I mean
for mware scan you can use your moreare
scanner of choice um clammer fall would
be an open source
possibility and for metad daa leakage
you just use exive tools um and then for
more sanitization there are different
tools for different file types and they
are also defending against hidden
tracking
mechanisms there is a story about the
ttip leaks from 2018 where a
whistleblower gave Green Piece the
secret ttip um contract documents which
were like top secret and only Au
Parliament um people could look into it
and this document got leaked and um
before they published it they found like
strange spelling mistakes in it very
obvious ones um strange dots Etc and
they did some analysises in this were
probably tracking mechanisms that every
um EU Congressman got an dedicated copy
which had different tracking patterns so
in case of leakage of the document you
can trace back who leaked leaked it and
to prevent the source getting leaked
they have written off the whole 1,000
page um bureaucratic language document
by hand to be really
sure you can do that if you have um the
Manpower but if that's your daily
business and um you getting a lot of
documents regularly probably build some
Docker container those tools to do it
automatically for
you so you have done all of this
different techniques tips and tricks and
you still think you might have gotten
infected what can you do about it
especially since government spyware is
not easily recognizable by a normal
virus engine
right um so there is this is the
forensics part and there is the mobile
verification tool kit which is a toolkit
released by The Amnesty International
Security lab and it was developed a
couple of years back for detecting
Pegasus spyware and since then it had
been continued to developed and now it
can also detect other spyware because um
the indicators of compromise for Pegasus
um are similar of other spyware too so
now you can broadly use it for recognize
um different spywares
it works very well for iPhones and it
works not so well for Android phones
because of the lack of lock data they
can get from it besides having an rooted
Android device um then it's basically on
the same level but it would um it would
be a security risk to run around with a
rooted Android
device so what do you have to do um you
basically create your iPhones backup
iPhone backup via iTunes you uh install
the mvt toolkit or you install python
lip USB the mvt toolkit and then you
have mvt minus iOS for uh your iOS
commands and minus Android for your
Android devices so you decrypt the
backup and then you could analyze it
with check minus
backup or you can download um pre-made
indicators of compromise
from the amnesty GI GitHub account or
any other source of ioc's and um let
them do the work a little bit for you
but it's still checking through a lot of
different ioc's yourself it's still a
manual process so it can't give you like
a check mark virus free or spyware free
uh or uh infection detected it's a um
lot of manual
work on Android it can only um will only
go go through SMS and apks um but you
can use ADB then it as also access to
dump uh to
dump um or you have a rooted Android
device then it has a lot of La data
available and can basically the same as
for
iPhone um so maybe you can root your
device just for the analysis but be
aware that that also could uh Delete
some ioc's if you're doing
that to sum it
up do your threat model um do it for
each of your scenarios or do it when you
have a big change in your infrastructure
so you have the measurements mitigations
in place which are best for
you um also if you're working with
journalists don't assume everybody is
super tech savy so do Solutions which
are applicable for a broader audience
and which are easy to
use um and last of all there are a lot
of great open source projects for this
kind of software and there is a big
Community developing it so um go out and
look for those projects and um You
probably can avoid a lot of uh big tech
companies and paid services
yeah that's basically it um thank you
and I hope you could see at least a
little bit even with small screen and
I'm sorry for the technical difficulties
thank you thank you very
much great yeah thank you Rico once more
thank you so much for the patience and
bearing with us as we sorted these
issues uh what's great is yeah we're
still uh on time and we have still some
time for additional questions if anyone
has some still so please raise your hand
if you do and then next will be the
coffee break for roughly half an hour
before the final talks of the day and
then the closing ceremony so yeah before
we get there let's have some final
questions thank you for this interesting
talk um so you were mainly focusing on
Android and and iOS and you were also
speaking about the tech heaviness so do
you have experience regarding laptops OS
for example something like tail OS which
is not Windows and this is the first
thing and the second thing do you also
have experience with for example storage
on camera devices which should be
encrypted or something like this is this
how do you how do you do this with your
journalist okay yeah first of all there
are operating systems which I mean
there's this cubes OS which is an
operating system doing send boxing
different environments so you have like
your work environment private
environment or something for your
project and they are virtualized and
separated and therefore quite secure we
tried it with some journalists and uh it
was quite heavy to make it work
um because um yeah you need to be
probably like good in Linux and it is
quite a bit buggy still so we came back
to just let them use um windows or the
Linux distribution of choice
with um I haven't found yet an
alternative operating system which is
super easy to use and bug free and uh
will provide all the security uh
measurements which I would which I would
wish for
unfortunately and to your second
question
umam Dev yeah it's unfortunately
unencrypted on a normal Sony um DSLR it
will be unencrypted
but you can transfer it to your SSD as
soon as you can and um encrypt the SSD
with looks or verac crypt and then
safely delete the SSD card by
overwriting the whole content just
formatting won't be enough but you can
override it like one or two times and
use C cleaner or your tool of choice um
to delete not only the index of the
files but the whole uh
storage great
another question awesome one
sec how do you prevent opsac
fails good
question um you have always the danger
of um people using Shadow it if stuff
gets too complicated right and um if
your security
mitigations meaning you have to give
them very techy very nerdy stuff that
will increase the possibility of them
just you doing it on their own way and
circumventing your security measurements
and therefore exposing maybe their
sources or themselves so yeah try to um
give them training on the devices try to
keep them easily usable for non- teex
saavy people and um spread security
awareness do your security awareness
campaigns um maybe some online training
maybe some um inperson training before
they are going on a more risky country
for their research
project
great um thanks for the talk and one
question for me um how do you detect if
you have been targeted by surance
because you mentioned the physical
question but on dig level do you have an
way to do that an idea or do you just
guess okay I mean if you cannot detect
it on a technical level what you can do
in many countries at least uh in the Au
you can um it's
called um there are data protection laws
in place which gives you the right to
ask about um things which are thought
about you
and in some cases you can even ask law
enforcement what they have stored about
you but it will only obviously work in
uh gdpr compliant countries and um if
you have been targeted by some Secret
Service of an autocratic State chances
are low that they are telling it right
so probably get a good forensics expert
uh and let him try to recover some ioc's
on your devices um to find out if you
have been targeted or
not great we still have time for one or
two more if we have any
here as a followup um do you have some
obac fail stories to
[Music]
share um I can't think of any which I
can or should tell you right now
that's okay we can move on to the next
one but we what we had we had an
incident where somebody indeed got
pigasus on his device and um that was
not due to NE nence of the journalist
but it was an zero click zero day
exploit from pigasus back in 2019 where
you could uh where the first um exploit
was an iMessage milit ey message and you
couldn't do anything against it um you
get like uh you see the message for like
half a second and then it will disappear
and your device is compromised um as an
initial attack Vector so this was not an
OBC fail but more like um yeah you
couldn't much do anything about
it uh you mention uh graphin OS which I
think is a great OS um do you have
experience with pure OS and the libram
five phone
or what's the name uh p on the Liam 5
phone which as Hardware kill switches I
think unfortunately not but I did
compare some uh custom RS um there is
besides graphos there is eos and there
is um what's it called CarX OS and both
of them ranked quite well um but not on
the level graphos um was operating like
they still had um the captive portal
check was still made by Google or via
Google server and like the time server
was still Google server so there are
like small differences um in those
operating systems which led me to
graffino and
um maybe the question is also which
devices you have available since graphos
s is unfortunately only running on
Google pixel phones you might have to
opt for another custom ROM um CarX I
think is also supporting Fair phones and
I'm not sure about EOS I think they are
supporting even more devices but
graffino deliberately only um targeting
pixel phones because ironically pixel
phones are one of the easiest to
degoogle and you can install an
alternative OS without um lot of like
exploit and installing a custom recovery
and unlocking the boot loer and leaving
it
unlocked um and you also have um um
what's it called a Hardware security
module which only is in pixel phones and
I think in newer Samsung phones but
those are really hard to to flash a new
operating system on so they are opting
for Pixel phones only to have all the
security measurements in
place great thank you final chance for
one more if not
you
okay so you talked before about FID I
was told by a very good friend never to
use FID because the signing key on the
push to devices is one key for all apps
so signal WhatsApp they all use the same
signing key or that was so in the past
has that changed or
I'm not sure about the signing key but I
will definitely agree on not just
installing the fdroid app and Le letting
your journalist download everything he
wants instead do your due diligence and
hand select or manually select the apps
you want to install for him um you could
also download them via their website but
this would uh have the challenge of
updating it regularly uh which is
something fdroid is doing for you so you
have to decide which yeah which which uh
horse to ride
there great thank you very much once
more Rico Round of Applause once more
thank you