[Applause]
this is my talk and this is the agenda
in a very briefly everything is still be
white so if you want a live stream it on
Tick Tock if that's your thing then go
ahead
a very brief condensed resume pick from
this what you find interesting
um small disclaimer I live in Greece at
the moment Greece had a big spyware
scandal going on affecting politicians
journalists
um I don't do any work on Greece and I'm
not going to talk about that but that's
definitely a big thing
um since February of last year I've been
working for internus which is a large
International NGO non-governmental
organization most of what we do is
supporting media Independent Media
around the world
um capacity building trainings Etc
um most of the work is not directly
linked to cyber security in any way but
we have a small what we call internet
freedom and resilience teams about 20
people working on various topics related
to digital security and I work on
digital threats against this
the communities and that's what I'm
talking about
um Civil Society is is one of these
terms that you know it when you see it
and yes I know that's a reference but
something else but
um it's basically the glue that makes
society that makes a healthy Society
work um that's not the government or the
private sector so
I think media plays a very important
role in a healthy Society but also
organizations that support various
rights of of various marginalized groups
trade unions not everything in Civil
Society is necessarily political or
controversial
um but many of the organizations
especially in more authoritarian parts
of the world are
um rest of the world which is the Durham
I invented to to basically mean
countries that you don't normally hear
about here at dot coms
um a related term is is the global South
um or in the past the third world but
that doesn't really include uh Eastern
Europe and I do want to include Eastern
Europe because there's very um
interesting and important things
happening there as you probably know
I think it's good to
understanding in what context Civil
Society operates in the rest of the
world
um for example censorship and internet
shutdowns are very common internet
sometimes shut down because there's a
protest going on that's also what makes
it different from say here in France I
know there were really big protests I
don't think the government even for a
second considered shutting down the
internet to prevent people from
from protesting
misinformation disinformation that's
really big in some parts of the world
that's also why good media is important
members of Civil Society groups are
often harassed groups also have often a
very complex relationship with the
government sometimes it's very
adversarial but some that it's more
complex they work well with certain
government departments and are harassed
by others sometimes they're slightly
concerned about their own government but
even more about the foreign government
for for reasons and yeah some face very
serious non-bigital threats including
people are sometimes skilled for there
for this kind of work
so more context network connections are
unreliable one example there is that in
some parts of the world it is very
common for even government websites not
to have proper certificates as in they
have certificates but they're
self-signed or outdated as a consequence
people just know how to bypass this and
I think you can imagine what that means
for the security of the internet if
people
mindlessly know how to bypass
certificate warnings um correct software
and generally poor security hygiene are
very common in general in many parts of
the world
um and as you probably know cracked
software often comes with things like
key loggers and other kinds of malware
um
it's even crack software is sometimes so
common that organizations use cracked
software even if they have the money or
even the license keys and I've seen
cases of that that's pretty sad to
realize that and yeah there's not a lot
of funding and
this work can be really traumatizing and
sometimes also traumatizing events
related to say what the government is
doing leads people to do this kind of
work and I'll talk a little bit about
trauma later
before I go to the the core of the talk
I want to take a small step back
I grew up in a western country I've
lived in in sort of Western countries
all my life
I've never had to worry about being
arrested for my work I've never had to
deal with with proper censorship
um if you want to understand what this
work really means try really try to talk
for someone from the rest of the world
but for various reasons it's much harder
for them to come here than it is for me
so yeah
but that's I think an important
disclaimer for me to make
so digital threats so this is what we're
going to talk about Pegasus because
you've all heard about Pegasus
but actually and maybe sadly if you're
here for the the very apt stuff
um most threats that that we deal with
are really mundane there
account takeovers of Facebook of
Instagram of Google and related to that
YouTube
these accounts are often really
important for people there are parts of
the world where Facebook is the internet
and it's also much harder for
governments to censor these platforms so
journalists are on Facebook or on
Instagram or
um
a TV channel is basically on YouTube so
if they lose their YouTube account they
basically
um can't do anything
um many account takeovers are not
particularly targeted or not targeted at
all it's just
something's also very mundane like
simple phishing people don't have do
away
um but if your threat Model includes
your authoritarian government that's the
first thing you think about
um related slide about that but
sometimes websites get hacked in various
ways and spam is posted and people also
think oh maybe it's the government the
hack my website but it's just you know
outdated WordPress plugin that link to
uh
um and some massive campaign but if if
that's what you're worried about then
it's more of a concern
um
session hijacks are also very common and
feel the same as an account takeover
um as you probably know that there's
like invoice dealers and Rogue browser
extensions that make it very easy for
cyber criminals to high-tech sessions
um I've seen seen a lot of that and in
this case if even if you have like
strong to have a your session and
through your feeling your account still
gets attacked
um accounts often get blocked as well
um if you're many governments have
supporters or if not to have botnets
that can just report say a journalist's
Facebook account
and Facebook
I know they try but they're not always
very great at moderating these things
like oh we get a lot of reports that
just block the account of a journalist
that's hard and frustrating
um
last Autumn just after Elon Musk took
over Twitter he banned six American
journalists from Twitter because they
wrote things that he didn't like
um that made a lot of news all over the
world but especially in in the west
um
and rightly so and also rightly so they
got their accounts back but yeah people
all over the world get that journalists
all over the world to get their Twitter
and Facebook account band all the time
and that never makes the news that it
was a little bit sad
um I know of one case where
a journalist or at least a someone who
is very critical of the government and
very public Facebook account hacked and
child sexual abuse image was was posted
by the hackers which let an
understandably to an automatic block and
it was all very frustrating to get that
back
um one small thing about takeovers of
WhatsApp signal and telegram which I
should probably know are linked to uh to
a phone number
um and therefore to SMS if you have
access to SMS you can go for someone's
WhatsApp account for example if they
don't use a password to protect it and
governments often have access to SMS
through corrupt isps or just to Legal
powers and yeah I've seen that happen
um and telegram is kind of worse because
telegram doesn't use encryption which
means that if you take over someone's
account you get their chat history as
well
um
there's also a lot of cyber crime
targeting organizations
that you know just because you do really
good work doesn't mean that people are
not trying to steal your money this was
a business email compromise scam I
helped
solve or recover some time ago
um
there was a small NGO doing something
very non-political uh receiving
um money from a western donor to buy
Goods for the thing that we're doing and
the donor was supposed to send the money
to their supplier and the supply
wouldn't send the goods to the NGO
um what happened is that the ndo's Yahoo
account got hacked this NGO only used
Yahoo that's not uncommon it was also
not probably not very well protected the
account might be phishing might be
password reuse
pretty hard to find out what the real
root cause was
um and that's enough because emails from
the donor were filtered there was a
filtering rule set up we also found out
that emails were sent from the supplier
from what was supposed to be supplier
but a slightly modified domain that made
it to the
to the Yahoo inbox and maybe they were
actually block the spam initially but
you know if you have access to the
account you can move them from spam to
uh to
um to the Inbox and mark them as unread
and therefore kind of control the whole
conversation and
the amount involved was really small for
BBC like a few thousand dollars but it
was also really big for this this NGO
um on the
on the right you see the the properties
of the
Word document that was sent by by the
scammers That was supposed to prove the
new account uh last state by carti
tradings which I looked up which is a
company based in Nigeria
which if you know a little bit about BAC
scams is probably relevant
um a slightly more advanced actor is
Mustang Panda also known as Earth prata
and some other names I know Nick Dai is
going to talk about
tomorrow and I'll leave all the
technical details to him
um it's an actor linked to the Chinese
government
does fairly broad targeting it's not
extremely targeted and it basically just
intelligence gathering
um and they've targeted ngos and media
organizations and I have supported a few
cases where someone was targeted with
Mustang panda
and then and then you get questions like
so what does it mean that we were
targeted this is an organization that
was
working on the very authoritarian regime
what they were very much supposed to but
they also knew from public report that
their government was also targeted with
Muslim fund like it's very confusing and
what does it mean and also
technical questions like
um
does antivirus detectives you know the
particular email that that I helped
analyzed that wasn't uh opened or at
least uh executable it was the yellow
hijacking was never run so that was okay
but you know they assumed that other
people within the organization were also
targeted maybe never reported
can we just scan a machine with
antivirus I know it does some some
persistence like some some register Keys
it sets
um how do you clean a machine do you
really need to reinstall operating
system is there any chance that if one
computer in the organization is infected
that Autos are too you know these
organizations are small they usually
don't have full-time I.T stuff they
definitely don't have a sock and I read
a lot of reports on Mustang Panda and
it's really hard for me to answer
questions based on the reports that all
go on a lot of technical details on all
the fancy dll hijacking and how plug X
is is loaded um
if you write such reports try to think
of the targets and how uh what they
would need to get out of this
um
you've probably no you definitely heard
of data breaches and you know how data
breaches where information is is leaked
publicly how damaging that can be for
for a company say after a ransomware
um this is a slight very nasty twist to
this
which is where people including some
some journalists were hacked
their emails were published but some of
them were manipulated before they were
published
um
which means that you have a very
credible
throw for documents of emails
some of which are just not true and
they're probably damaged their
reputation
um this was used in this particular case
is by fancy bear the Russian group uh
there's a public report by citizen lab
from six years ago
sort of relate to this and this is far
more recent there's a Revenge form or
non-cancelable non-consensual sharing of
intimate images
um in this case in Azerbaijan where
Intimate photos and audio recordings
from a number of anti-government
activists were published government of
course denies it you know it was just
Anonymous Twitter account sharing it and
that they happen to be trending in the
country
um there's a possibility that these
images and recordings are obtained
through spyware we know Azerbaijan uses
Pegasus
um
but we're not really sure it's also not
quite relevant nor is it relevant
whether
maybe somebody's images or recordings
were manipulated like that in this case
you don't even want to ask that question
but that's uh very damaging and it's
also an example why
uh this work is
is probably even harder for now it's
definitely even harder for women another
marginalized Clips there's a good report
by occrp on this particular case from a
few weeks ago
um it's also good to keep in mind that
you know as you know digital threats are
digital they don't really care about
borders
many Civil Society members need to flee
their countries to live as refugees
often in in Western countries
um the targeting continues there are
many known actors and this list is
definitely not
exhaustive of government access that
Target the aspara community
um really good paper by citizen lab from
last year I think on the psychological
and emotional impact of
such such transnational repression in
this particular case of people who fled
to Canada
you've probably heard of mercenary
actors or hackers for hire these are
companies sometimes somewhat public
sometimes very well hidden that you can
just hire to to hack to do a malware
combined to basically to gather
information through this kind of means
and governments hire them a lot
sometimes private companies do too maybe
not directly but you know they hire
a consultancy firm who hires an another
consultancy firm who didn't hires the
mercenary actor some of them are very
low skilled
um script Kitty but that's often enough
but sometimes are also really Advanced
some of them are linked to cybercrime
um they might do also do cybercrime
um like financially motivated crime
someone I'm also very close to
governments
and it makes hacking and Inspire
um available
at any level to any any actor the
government doesn't need to have a team
of hackers it just needs to have enough
money and most governments
apparently have enough money for this
kind of thing and Civil Society is
commonly targeted by mercenary actors
some examples and this list is much much
longer than the five examples here
um
environmental activist groups were
targeted by dark base in a few years ago
that's an actor
I think it was all citizen lab who gave
them a name
um and there's some suspicion that's
Exxon the oil company was somewhat
responsible for it but probably not
directly and they also believe that the
actual mercenary
company that was hired is an Indian
company called belt rocks hacking team
is a very big name at least like a
decade ago there's an Italian company I
don't think they're still active
um they were selling their services to
governments around the world including
Mexican journalists Mexican journalists
are probably in this space the war is
targeted they're targeted a lot by a lot
of different things and they do they
also face a lot of Mexico is also
extremely bad when it comes to murders
of journalists so
huge respect for people doing that kind
of work there
um Togo country in Africa activists
there were targeted with the Do Not
spyware which is also linked to a
different Indian company
um a few years ago there was a lot of
attacks going on in Uzbekistan
it's fishing spyware I believe some of
them use even use zero days
and and of course Pegasus which I'll
talk about in a few seconds
but first I want to talk a little bit
about team
and it's not related to you
um
the important
was published the information on them
was published about two months ago or so
it is a very mysterious very shady and
very well hidden Israeli company that
basically sells services to governments
where they can say we can swing
elections for you
um because most government even if
they're not very Democratic they still
hold elections
um
and we don't really know what they do we
assume that they include hacking
accounts because there were some some
examples of that but it's really hard to
tell
what they do and and unfortunately the
reporting and also understandably but
unfortunately the reporting was based on
leaked marketing material like they
pretended to be potential customer and
they just reported what team was trying
to sell them and
of course they were probably overstating
their their abilities I mean I wouldn't
want to determine the ability of cyber
security products based on leaked
marketing materials from say RSA or
something like that like of course it's
going to be exaggerated
um so we really don't know much about
the ttps and what's actually possible
um and which
hacks account takeover a small word you
know I if you may have seen in the world
may actually be linked to this group
uh there is an interesting case study uh
published last month about a smear
campaign who a politician in Serbia that
is linked to this group but it's one of
the very few concrete cases that people
have linked to this group
all right let's talk about Pegasus
okay there's a embarrassing typo it's
the NSO group not NGO group I thought I
could call that typo um
NSO group is the company that everyone
loves to hate because they they got out
of the way of being evil there they're
based in Israel and there's a lot
written about them as a company I don't
want to go into that
um Pegasus is well known as being a book
written about it people have done I
think multiple podcast series on Pegasus
many articles I'm sure you've all heard
about it
um but just as a summary they use zero
day Zero click exploits on iPhones so a
fully packed iPhone where someone never
clicks on a link
it still can still be taken over
um people are going to click on links
anyway so that's probably not the most
relevant part here but if there's no
click there's also no Trace to the to
the Target to the victim so it's not
like oh yeah I got this weird SMS three
weeks ago or yeah I got this email or
suddenly I have to click OK and I just
clicked okay to click it away there's no
Trace in that memory even
um we assume they target other devices I
think there was a pegasus for Android
like six seven years ago the people have
analyzed but talked much since it would
make sense to Target other devices but
Android is
um a lot harder to analyze and it's a
very more complex ecosystem
um
Civil Society is targeted around the
world a lot so badly in so many ways in
so many places that any kind of
uh denial from NSO that they are aware
of this is just ridiculous and it's
really hard to defend against like
there's nothing you can say I know Apple
has done
um
it's added lockdown mode to iOS which
definitely mitigates things but yeah we
don't know what new exploits they're
finding or that maybe bypass
lockdown mode and
what I just want to want to share
because that's maybe something you don't
know that or don't realize is how
extremely traumatizing Pegasus or even a
suspicion of Pegasus can be
um I know about the journalist who uh
Got a notification from from Apple uh
that there was a suspicion at a phone
checked practices was confirmed
um on the one hand he thought yeah this
is a big story of me being targeted it's
a big story but also if I go public in
any kind of way no Source will ever want
to talk to me
and that's basically the end of our
career or at least that's what she
thought
um I've I know people who were targeted
with Pegasus uh who suddenly started
worrying about their family they were
like yeah okay I decided to become an
activist or journalist I take this risk
but
does that mean that my family is also
talking to that do I have to warn them
what should they do
um and get error cases where Pegasus was
used to Target a family member of of the
person they were actually interested in
um there's been some some very good
reporting on the traumatic impact of
Pegasus and if you're interested yeah
look for these articles
um if your board of packages so much
there's a new company to hate quad rims
there's a report the citizen lab
published yesterday and Microsoft also
published a bell or report
um
aquarium is also an Israeli company
doing very similar things to to NSO and
um
it has also a Cyprus link there
um but yes NSO and Pegasus are not the
only ones out there
um
so
what does incident response look like
for this community I mean many of you
probably involved in this response well
it's complex and it's hard
um I I'm not talking about trivialize
impotent response in an Enterprise but
there are definitely ways in which it's
different and possibly harder firstly
there's often very limited Telemetry
analogs like the the kind of products
the kind of settings that you use
they're not available
um Telemetry is also when it's it's
available in like antivirus it's often
turned off because trust and that's sort
of understandable
um limited Telemetry also means that we
don't always find out about threat I
mean good quote-unquote good spyware
hides from the user so you only find out
when there's some consequence of it like
I know of cases where someone's
YouTube account was taken over through
session hijacking and that's what led to
an investigation of what's happening on
the device and oh that was a key logo
they'd never realized
um EDR and MDR are hard to do in a
sustainable way it takes a little bit of
Manpower and therefore a lot of money
and it's not the sort of thing uh it's
hard to get funding for that than if you
get funding it's like temporary and it's
it's not the sort of thing that you just
want to turn off at some point so it's
really hard to do EDR MDR
um and that's also
understandable trust issues
um also my experience is that most
targets they just want to move on like
get my device clean get my account back
Etc and then move on
um if you do instead of response at that
Enterprise and you get some someone has
an infected laptop it's your job to get
that laptop and look at it they it's
their job they say yes here's my laptop
but that's not the kind of relationship
you have with with the journalists
um and that's drama I mentioned trauma
before
um drama often leads to extreme distrust
like I know people that were
trying to help say some journalists but
they were not like oh no no I'm not
going to give you my my device I don't
trust you why would I trust you
understandable but yeah you need to do
something if you want to investigate
um I've also seen surprisingly many
cases of extreme Trust
where people are like oh my passwords
here's my device please do whatever you
need to do which is also
which is great from
for from a workflow point of view but
it's also not very advisable
um hyper vigilance or you know paranoia
is extremely common
also very understandable but it means
that any kind of malfunctioning device
people assume that it's that it's a
threat that it's an attack and not just
like a phone getting old or an app being
slightly buggy
and there's and I don't mean this any
judgmental way but trauma makes people
unreliable narrators I mean it's hard
enough from someone who is not
an expert on digital security to ask
them like what really happened to your
device when but
I've seen people
um
misremember certain events
for example one thing I remember once
something that turned out to happen like
once every six months doesn't matter
what it was it was like okay that's
that's normal but they felt like what's
happening a lot
um and that's really hard to if you
interview someone to try and figure out
what
what really happened it's really hard to
actually build a picture and try to
understand what what happened
finally
um
hopefully you you sit here thinking like
hey that's that's really cool that's
important work care about Civil Society
you don't just care about France or
whatever country you're from you think
is important all around the world and
you think that these are serious threats
and and um you want to help that's cool
so how can you help well
I know many of you are like more reverse
engineers
it's cool I've had people offer this
like oh we can revert engineered that's
cool it's not really what's in what's
needed like it's
it's extremely rare that I've been in a
case where
firstly there was more over involved and
secondly
to the level that you really needed to
reverse engineer that running it in a
sandbox didn't give you the information
that you needed to just protect the
community I talked about Mustang Panda
before
um
it was enough for me to run the assemble
in the sandbox to determine it was
Muslim Panda and I know from public
reports what I was doing so technical
answers that I needed to know about what
the more I was doing
um
I got them all from uh from reverse
engineering
um
if you can share threats if if you are
researching threats and many of you are
doing that and you notice it's affecting
some of these communities
um if you can share it that's great if
you can build connections maybe they can
tell you what they see that's even
greater
um iocs are rarely relevant because
very few organizations that not just
through in Civil Society can do anything
with like an IP address or something
dtps are more helpful because you can
build a story from them like hey this is
what's happening
um if you have licenses but product
platform licenses
like
uh threat Intel platforms yeah talk to
me because I'd love to hand them out to
other people
um if you do trainings
maybe some threat in though basic
training or something like that and you
have some extra seat that you want to
give away for free um talk to me
um working together on Research okay
maybe you say hey I want to write a
research report on some more right
that's targeting
a journalist in country X maybe you can
work with organization in that country
um happy to talk to you if you don't
know where who to talk to um
and I mentioned funding and I don't
mention funding just like hey if you
have money please give it to not just to
me no not to me but to these
organizations but actually you know keep
in mind that these organizations are
extremely underfunded
and so if you want to work together on
Research have that conversation saying
hey
maybe you need to pay them for their
work working together on the research
think about that
same with threat sharing like if they're
gonna provide information on what they
see
yeah please consider that they shouldn't
be doing that for free
um
that's it this will be about five
minutes four questions
thank you
[Applause]
yeah actually less than five minutes so
make them quick oh the boss
thank you very much for the presentation
I just had a question with us with
regards like uh if all cell phones get
hacked then do educate journalists to
use cubes or something like that would
that help
or it's too slow for them to communicate
um Cube so cubes is an operating system
that is kind of you know everything runs
as virtual machines it's super secure I
I like it I like the work on it I
I know people who work on it I'm
generally reluctant to recommend certain
tools because
it needs a certain experience to do
tools and not to make mistakes and
sometimes mistakes can be very costly
um
but also I don't know enough like people
have not done enough research like how
those two cubes work in in this
community like most people work on it
they're from Western countries they
have the capacity to to research to to
work on that
um I'm very curious if someone has
actually done that that work in that
research but yeah
no more questions
I'll be I'll be around I mean I'd love
to talk to all of you and say hey we can
work together and at least share email
addresses in case you you see something
or a case I see some of your reports and
say hey okay please tell me more about
this um but I'll be around the rest of
the week
okay thank you
so much