Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1339 Thanks!
[Music]
the eye on the Nile Egypt civil society
under attack I believe that a lot of
people only in the year 2011 became
aware of the Egyptian state attacking
activists and survey them and use
technology for that but of course there
was civilians of activists before and
after that the government has changed a
couple of times since then but
surveillance of activists has not and
this talk gives us some insights into
how these state actors work how they
survey and target activists and it's
actually going to be super interesting I
believe because there was an object fail
and nothing is more interesting than
object fails especially when our enemies
make them and our speaker is Steve KL
and she's a malware analyst
she studied computer science and she
researches cyber attacks in the Middle
East so basically she's who I want to be
in my next life super cool please have a
big warm round of applause for a seal
and enjoy the talk thank you very much
imagine you live in a place where you
witness corruption all around you you
see innocent people being thrown into
prison over made of charges newspapers
being censored and shut down their
websites becoming inaccessible and the
worst part is you have to be silent
about it because each word you say each
social media post you share and each
action you take can and will be used
against you that is the reality people
face daily in Egypt hello everyone my
name is a sale and thank you for coming
to my talk the eye on the Nile like
nigel mentioned I am a malware analyst
at checkpoint a few words about me I
work in the threat intelligence
department and I am mostly interested in
researching advanced threats and
state-sponsored attacks and cyber
attacks in the Middle East region
so it's not surprising that reading this
report that was published by Amnesty
International back in March
discussing phishing attacks against
Egypt civil society got me really
curious and the phishing attacks
discussed in this report are not your
typical ones because basically in this
case the attackers set up third-party
applications for popular mailing
services like Outlook or Gmail or yahoo
mail and they would send links for those
applications to the victims to fix a
security issue in their account but the
third-party applications were to request
permissions to read write send and
delete all of the emails in the victims
inbox so basically if the victim grants
the app the requested permissions the
attacker gets unlimited access to their
inbox later on some of the victims
received official warnings from Google
telling them that government backed
attackers are trying to access their
accounts and the report mentioned that
the attacks were mainly targeting human
rights defenders and prominent civil
society members staff in Egypt and
reading that I knew I wanted to get
involved in that research I knew I
wanted to contribute to it and they
didn't know how how do you investigate a
wave of attacks after it is over now
Amnesty International didn't really
share a lot of technical information
about those attacks but luckily they
shared a list of websites that they saw
were operated by the attackers and that
appeared in those emails and naturally
looking over at them after a while they
were all dead they were down and I
started gathering in that case and
trying to see the information I can get
about the history of those websites how
they were used any public information
about them and soon enough I noticed
that a lot of them had subdomains that
mentioned the services they were trying
to impersonate so things like Outlook or
yahoo mail or assigning services to try
and appear more legitimate in those
phishing attempts
and I saw that there was one sub-domain
that stood out and looking at that at
first it might appear to you as if this
is a random combination of letters and
numbers but really each character in
this sub domain corresponds to a letter
in Arabic and writing that in the right
order from right to left because Arabic
is from right to left results in a
phrase called the popular movement and
looking up the English translation that
appeared in the sub domain led to one
result only in Google a telegram channel
using the same name and promoting an a
popular movement in Egypt and that
channel was sharing messages like these
which were basically telling the members
you should go out on the streets
you should get angry you should start a
second revolution
you should join this popular movement
but most importantly make sure you
contact the admins and provide them with
all of your information or they will
contact you so at a very early on stage
of my investigation of this
infrastructure I knew that it was
devoted to try and target or to locate
people who are possibly interested in
opposing the Egyptian regime or possible
dissidents one other thing I noticed
while looking over this infrastructure
is that a lot of the websites resolved
to the same IP addresses and those IP
addresses were in the same range or in
the same net block and I started
monitoring those IP addresses and I saw
on your web sites being registered and
resolving to the same addresses and one
of those websites that was associated
with such an IP address also followed
this same naming convention as the
malicious web site so again using the
words mail and login to appear like a
legitimate mailing service but what it
was really special about this website is
that it had an open directory indexing
so I was able to see everything that the
attacker is stored on this website
which was nice for me now the folders in
this web site contained mainly PHP
scripts which as you would probably know
if you're accessing the open directories
in the browser you cannot really view
the source code but there was a zip file
that contained the exact same folders on
this website that I could download and
view all of the PHP source code and they
did and looking over the folders that I
found in this archive I saw that each
one had a different purpose the first
one that I looked into called WS served
as a control panel for the attackers of
some sort so the attackers could send
this control panel remote requests and
with an action called parameter or with
with a parameter called action they
could specify certain tasks where this
control panel to perform on the server
so again they would be able to gather
certain statistics from the data that is
stored there they could delete certain
things or certain information the
disorient server and so on and so forth
and there were a few interesting moments
in this control panel code for example I
could see the credentials for the
attackers database so I could see the
username and the password that they set
and I also saw that the attackers
defined the default timezone of the
server to be that of Cairo interesting
the control panel would also count the
amount of requests that are perceived
and it would check them at the total
amount of requests over three hours and
if that amount exceeds 30 requests it's
considered to be a bit high so they
think there might be some suspicious
activity or someone is trying to mess
with the server and in that case an
email is sent to this dev D a gmail
account telling them hey of which in
Lion coming and take a look at and
taking a look at the server something
might be off and so seeing that I
realize that this gmail account is
probably again affiliated with the
attackers that were created by the
attackers
you might also notice that the code
snippets I'm showing you have a lot of
comments these are in Swan these aren't
ones that I've added these were left
there by the attackers documenting
almost every line of the code and
telling what it does which was really
helpful for me going over all of this
PHP code and trying to understand what
it does so it helped me analyze that in
a way but mainly a lot of the comments
had very very bad English so they would
make a lot of mistakes and a lot of
spelling mistakes and grammatical
mistakes and so on and I think my
favorite mistake that they made was this
one when the attackers misspelled the
word buffering and instead wrote
buffering now if you know Arabic you
would know that we don't really have the
letter P in the alphabet so a lot of us
would confuse the letters P and B and
that's a classic mistake we make sorry
and I think this tweet really explains
this better than I do by Hamid Sudan who
says well if you know anyone from Egypt
this typo is conclusive evidence that
whoever wrote this code is Egyptian next
up another folder on the server served
as a link shortening service of some
sort that was called shorten me and
basically the attackers would send this
script long URLs usually phishing URLs
this script would generate a very short
token add that to another link creating
a much shorter URL as it promises now
the attackers decided to store all of
the long URLs they've submitted to the
service in a database and in database
the database was stored on the server
and I had access to everything on the
server so I could see all of the long
URLs that they've submitted and the
first one that was there was apparently
a test of some sort and the email and it
mentioned the gmail account that we have
seen before and this was apparently on
the attackers jet testing out this
script
but then the following entries in the
database had other email addresses real
accounts Hotmail and Gmail accounts
which I have redacted in this case but
looking them up led me to the real
identity of the individuals behind them
and it was able to identify more than 30
targets that received those phishing
links or that were targeted by this
attack and all of those targets were
lawyers journalists professors NGO
members and prominent figures from Egypt
and while I do not know if those attacks
were successful and if their accounts
were compromised again it could just
mean that they were targeted and
received those links but not really
clicked them or were a victim of the
actual attacks I do know that some of
the victims I was able to identify in
this list were arrested months later for
criticizing the Egyptian authorities and
the remaining folders in the server were
devoted to setting up phishing apps or
third-party applications like the ones
that were seen in the Amnesty
International report so again the
attackers would set up those third-party
applications and links to the victims
and in return gain access to everything
in their accounts and we saw such an app
for Outlook said was set up back in 2018
and again you can see it requesting
crazy permissions for the victims inbox
or email and there were also two other
applications and in this case they were
targeting Google Drive so again we also
see a shift of the attackers not just
trying to monitor messages or emails but
also trying to see which files are
stored potentially on the victims drives
and in Gmail clicking the third-party
applications name would show you
information about its developer and
clicking both of these names showed the
same gmail account was great was you
to create both of those applications the
same account we have seen before but the
screenshot also shows that the apps are
supposed to redirect the victim after
they grant them the permission to a
website called Drive backup co and this
website wasn't known anywhere else
before it wasn't seen in a malicious
content context whatsoever and when I
saw it in the configuration files of
those other third-party applications
when I tried to access it once again it
was down and while I was trying not to
get frustrated again and find out more
things about this website I came across
an interesting finding an Android
application that was submitted to
virustotal
and that communicated with this website
Drive backup code so plot thickens and
just in case you're lost at this point
let's recap what we've done so far so
we've started out with an old
infrastructure that led us to a new
website male login dot live that we
believe are operated by the same
attackers this website was used to store
phishing applications and third-party
applications that redirected to drive
backup co this website and now we have
an Android application in the equation
contacting this website so the question
is what the hell is this Android app and
is it related to that other side to try
and answer that question I install the
app on an Android device and the
displayed name for the app was I allowed
200% now when I installed this app
it had no icon so it looked like this
and also the file name where the APK
name was v1 dot APK or version 1 and
these two things can tell us that this
app is probably still in early
development phases and the app would
show the user messages that their
ringtone is 100% louder
whereas in fact it did nothing with the
ringtone at all if the code so digging a
bit deeper into the code of this app I
saw that the internal name or the
package name for it was a route not
allowed I wrote and that it requested
permissions for the devices internet
connection location and to be
automatically started after the device
is rebooted and what it did with those
permissions is that it constantly
monitored the device's location and it
did that by contacting drive back up CO
and constantly uploading the device's
coordinates local time and battery
statistics to that website and if the
user would try to stop the application
from running or stop the service that
does this it had a persistence mechanism
to start over again and make sure that
the device is constantly monitored and
its location is known so again this is
ideal for someone who wants to know
where a device is at at all times and
because it was impersonating this
different service and pretending to be
this ringtone app whatsoever this
started to look very very bad and to
make matters more complicated
I saw from virustotal that this app was
downloaded from a website called index
EDA org and going into this website I
saw that it was still there
for once something is up something is
active not only that there was also an
administration panel for this app on
that website and here it was referred to
as AI track so again it has three names
now now I didn't log into this panel on
this website I didn't do that but poking
around this website I saw that the
Styles directory of this panel is
exposed so while I could not log in and
see the data that was stored there I
could see the layout of the panel after
the admins login in which pages they get
and I saw that a bootstrap template was
used for the design
this panel and that this directory in
this open directory was used to store
the default images of the bootstrap
template which looked like this lovely
pictures but there was just one image in
this directory that was not part of the
default bootstrap template and it was
called logo dot PNG and it looked like
this and seeing that I was like hey I've
seen that word before and you've seen
that word before I don't know if you
remember but it was used in the
credentials for the attackers database
from the open directory so this really
gave me a nice connection between the
phishing apps for the emails and the
mobile application besides them both
being connected to drive backup co but
now index e dot or I started to look
very suspicious to me and I wanted to
find out more information about this
website and once again looking stuff up
about indexing org I came across a
mobile application that communicated
this website but in this case the mobile
application was downloaded from Google's
Play Store and it was called indexing
and this index II had more than 5,000
downloads on Google's Play Store and
while it could have been downloaded by
anyone the description of the app and
also the default settings of it showed
that it was mainly aimed at Egyptians
and that was the audience that was
interested in and it was supposed to
provide a service that is similar to the
known through caller app so again you
would look up a phone number and you
would find out their owner's name and
you would look up a name and you would
find out their phone number and to do
that it requested permissions to the
users contacts and call history which
again is fine if you're setting up a
service that is similar to trueCaller
because you want to improve your
database and you want to have as many
phone numbers as possible what is not
fine is that once again there when it
there was an administration panel for
this app on index data org
and once again the styles directory was
exposed so I was able to see what was
being done with that data after it is
collected and I saw that there were
multiple pages in that admin panel that
were storing the statistics and going
through them and basically I saw that
the users data was being monitored and
inspected and there were logs of cross
country communication so basically
trying to see which user is calling
someone from abroad for how long from
which country and what is the duration
of that call and what is that phone
number and that looked bad and so we
recorded that to Google and the app was
taken down from Google's Play Store and
it is no longer available for download
so we've been through hell and back
we've covered a lot of things and a lot
of layers for this deck but I think
we're still missing some pieces or some
information and we didn't look in-depth
into the index C source code or the
application source code and we won't I
promise but there were some interesting
things in that as well
I saw that some of the messages that
this app logs were tagged with the word
Shindo and in the About section of this
app in a different window there was
another website that was mentioned serve
gates com
in addition to index data org and this
website unlike the rest of the websites
we have seen so far had Whois
information so I was able to see who
registered this website and it was
supposedly
an individual from Egypt who had the
last name XI now II and Shin know is a
very common abbreviation for that last
name and the email address that was used
or that appeared in the Whois
information here
was used to register other websites and
one of those websites that it registered
was called
TX tips and it was supposed to be this
technical blog to provide developers
with tips when they're using certain
programming languages like oh if you're
using MySQL here is this bit of code for
you if you're using PHP here is this and
that and all of the posts in this
website were added by Shindo and there
was one post in this website that talked
about using google's api to maintain
offline access to users accounts and
this is the code snippet from this
website TX tips and this is the code
snippet from the open directory of the
third-party phishing applications and
the both of these look very very very
similar so again this kind of shows us
that everything is connected and really
whoever wrote that code is also
responsible for the code of index e
which is related to everything else we
have seen so far but I wasn't really
able to find out anything about this
Shindo person or individual or if
they're really a real person to begin
with but maybe I was asking myself the
wrong questions maybe I shouldn't have
been asking who is this person but
rather where is because what I forgot to
mention intentionally is that the in the
admin panel of the I loud application
there was a page that initialized the
map that was supposed to collect all of
the coordinates that this app got and
for that map to be initialized it had to
zoom in to a default location to default
coordinates that were hard-coded in the
script see where it might be problematic
and those core
Mnet's didn't just point to Egypt and
they didn't just point to Cairo they
pointed to a very specific building
there and seeing that again for the
first time and knowing how densely
populated the city of Cairo is like well
it's looks a bit weird like this
building this unnamed building that is
walled off and surrounded by those fancy
gardens bit suspicious and I didn't know
what this was before or if it is
affiliated with the attackers but later
on we were able to find out that these
are actually the headquarters of the
Egyptian general intelligence services
so that might show us again that this
attack is originating from Egypt and
mainly targeting Egyptians for
surveillance purposes trying to track
their emails their location their
communications calls you name it and if
you think that's bad if you think that's
an invasion of people's privacy Egypt
has just started a new practice where
people walking down the street can be
stopped by officers be asked to unlock
their phones and be inspected to see if
they were planning to participate in a
protest if they shared a post on
Facebook criticizing something or if
they saw a video that they shouldn't
have so why bother build a mobile back
door when you can do that when you can
inspect people's phones and exercise
that power on them and if someone
opposes to that like the woman in this
video did if you fail to comply there is
bad as someone who was found with
incriminating material on their phone
and if it's just again
normal people random people anyone
walking on the street being this
violated it is no wonder that
journalists lawyers and activists people
who are supposed to defend and stop
those violations it's no wonder that
they're being targets to such an attack
that we
scene and with that thank you
thank you for the phenomenal talk thanks
for taking us along on this super
exciting ride now we still have some
time left for questions and answers so
if you have any questions you can pile
up at the microphones first people are
answering that call so let's start with
a question from microphone number one
please I thank you for a super
inspirational presentation so my
question is that we've seen the home
grown and home build a technology has so
many loopholes which you were able to
find but I do you also know if the
Egyptian government is also importing
the tech which you know might not be as
simple as this or simple as this from I
don't know European providers and if yes
like are you able to detect like to what
extent the journalists and dissidents
and activists are being targeted thank
you
I don't think there are public records
of Egypt using any imported technology
or abiding any offensive tool of that
sort but it really wouldn't surprise me
in that case and we've seen other
countries in the Middle East doing that
Morocco for example recently so it
wouldn't come as a shock microphone
number two thank you for that amazing
talk I too wants to be you in my next
life okay well my question is personal
it's aren't you afraid that this might
backfire on you now you yeah you have so
much data and so much information in
your mind and on paper yeah yeah yeah
you know what it's uh I I considered
that and everything especially going
through this material and other research
I've done in the past and but this
pissed me off like I thought you know
what I'm just gonna go ahead and report
it and say it as is and I'll just take
the risk I guess don't don't kill me
okay
stay safe
I wholeheartedly agree with that scene
applause microphone number one please
thank you for also the amazing visuals I
really didn't like that your narrative
was very long and you had expiration how
you presented it but I'm very curious
how did that feel you mentioned being
frustrated but it to me sounded like a
miracle that it's really okay and that
is exposed and that is exposed and I can
just search through it how did that
process really feel did you have
collaborators that also work through it
or did you go through in two days can
you extend a bit on the process
definitely
excellent question it was an absolute
chaos
pun intended just seriously going
through all of the material and
everything and especially when you're
going through the raw stuff so you don't
know what's interesting and what's not
what the hell is this PHP code and
what's not so I was going through
everything sometimes fighting things
honestly by mistake some of the things I
found were not planned at all and the
thing that helped me most I think was
also consulting with my colleagues a lot
of the times of just like have them come
in and ask me questions and make me
doubt everything I have and then I would
kind of make sure that I'm not sounding
like a crazy person and also would get
their confirmation that I'm on the right
track as well so that really helped
thank you microphone number two please
hi thank you for your amazing talk this
might sound like a crazy question given
that you are exposing everything you've
done but while doing it did you use any
precaution like obscuring your IP
address why yeah so yeah everything was
done on like a separate Network for this
analysis and behind VPN and whatnot yeah
try to not attract it to myself as much
as possible okay another question for
microphone number two thank you oh it's
not from my side can you talk about the
victims
the targets since you said they were
identifiable by their email addresses
and did you take measure take action to
inform them or like deal with that
information and a second question would
be is you are you or your team like
working on on any guidance on how people
can like protect themselves or stuff
like that so basically with regards to
the victims we've had like I said a list
of victims and we worked on when we've
had everything and went through the
technical stuff as well we reached out
to the New York Times who then had
contacts in the region and were able to
even talk to the some of the victims
directly and make sure they know that
they were targeted in that case and as
for the second part of your question I
would say that if there is someone from
that region and you're working in those
sensitive positions just like watch out
for anything that you might receive via
email via text message watch out for
your phone and just make sure you like
watch out for those things sometimes
again it's it's not it's something that
you unfortunately cannot avoid
especially against if you're walking
down the street and someone stops you
but just be careful I think is the best
advice I I can give in that case yeah I
guess one thing that we learned from
your talk is OPSEC OPSEC OPSEC so
microphone number two again hi I was
wondering and we mentioned the location
in the day application how was it the
right thing the location was it from
base station triangulation or was it
switching the GPS on how was it what
kind of data was it the mobile
application yeah it was accessing the
devices fine location and then trying to
trying some methods I think GPS and if
it doesn't have access to that than
other things and uploading what it can
find and the method that I was using
microphone number one again yeah yeah hi
great talk thank you for that
a small remark I don't believe that this
buffer puffer mistake is a thing that
points to Egypt Egyptian solely because
in German look what also starts to the
p/y a Syrian friends to do the same
mistakes yes not exclusively Egyptian
yeah I do want to say that it's it's uh
oh my god how do I explain this without
being tricky it's uh it's an it's an
Arab mistake in general usually like in
my region for example it's mistaking a P
for a B but the other way around is a
bit more Egyptian in that sense so again
yeah I do agree not conclusive evidence
but it was a hint in a way thanks
microphone number two please hi thanks
for the talk just curious did you try to
write an email to the developer does it
give result online with this no yeah so
I looked it up I try to see if there was
a Facebook account may be associated
with that email nothing came up it was
just in the code I think and I think the
name dev D dot log something just says
that it's like supposed to be dev vlog
or developer logs I think that's what
the name might be hinting so it's just
used for that but no conclusive evidence
is there another question of microphone
number two perfect move on up thank you
for the talk I was thinking about
sending this talk to Egyptian friends is
it safe Yes No maybe question mark I I
am Not sure I'm not sure I would say be
careful if they're abroad than gladly
but be careful thank you
microphone number one so you've you've
been doing a lot of work to investigate
the infrastructure from a state
surveillance agency and there are other
institutions like citizen lab
amnesty that do a lot of work on this
and also don't always expose it so it's
ongoing
yeah have you shared the information you
have with them so they can continue
their own investigations yeah we
basically by work started by looking
over at the findings from MC
internationals report so yeah and we we
reached out to amnesty after we've had
those findings to try and cooperate and
we informed them of everything that we
found on this now have we reached the
end of your questions search your souls
are there maybe any questions left
because we would have another two or
three minutes yes thank you searcher
your question please
should Google have done anything better
to make sure that the apps weren't
uploaded to their place ttle hmm should
they have I'm not really sure because
they do have their mechanisms to protect
against if you've identified like
malicious patterns within the apps or
see malicious views right away in this
case I think it was a bit more tricky
because again if you're somewhat
providing a legitimate service than the
tricky things or the malicious stuff for
being done on the server side it's a bit
harder to prevent against that
supposedly there was even a new report
about this app from UAE Kotick which
appeared to be completely legitimate
might have been used for to gather
intelligence by the UAE government so
could they have known that I don't think
so not in advance microphone number two
you were able to look up every Whois
information of their registered websites
and my question is did the registrant
names match and were their street
addresses to their registrants because
in the Dutch who is if they're not
secured there well there's an address to
it usually yeah
so basically most of the websites did
not have Whois information this one
specifically did and there was I don't
think there was a street name but there
was a region name in Egypt or like a
town name so nothing too specific how we
know at the end
any more questions this would be your
last moment three-two-one
no so I thank you for all of you oh
there's one person just came to my mind
how did you figure out the place in the
map was the general agency for yeah so
like I said we talked to reporters from
the New York Times who had contacts in
the region and we're able to confirm
that all right thank you very much for
all of your very interesting
enthusiastic and engaged questions I
think that showed that you all
appreciate that the talk as much as I
did so please give us steel another big
warm round of applause
[Music]