Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/146 Thanks!
So, yeah, Claudio is an independent
security researcher.
And meanwhile, Morgan is
a volunteer at EAF
and a senior security engineer
at Google.
At least that's what I read from your
biography.
I think
there was talk about the militarization
of the internet.
So, yeah, the stage is yours.
Good luck.
All right. You do it.
Hello. Hello.
All right.
Yes, so this talk is
to protect and in fact, and it's about
the militarization of the internet.
I'd actually like to take a moment right
now to dedicate this talk to my friend
Conor, who passed recently.
So.
Let's talk comes with the standard
disclaimer opinions
represented in this talk are not those of
my employer.
Most of the work that I did for this was
actually done via the Citizen Lab out of
the University of Toronto.
So without any further.
What are we going to talk about?
So we're going to talk a little bit about
mass and targeted surveillance, which
are topics that I'm sure everyone has
heard a lot about recently.
Mass surveillance, as I'm pretty sure
everyone knows, is as frequently sort of
carried out using deep
packet inspection technology.
There's sort of a variety of companies
that sell this one that you're probably
familiar with is Norris.
This first came to fame
or infamy because
AT&T technician by the name of Mark
Klein was
and was involved in installing a room
using this technology for the NSA
at the Folsom Street
Exchange in San Francisco.
AT&T
Recently,
there's been a whole bunch of revelations
about the NSA's massive intercept
capabilities.
This is an illustration
of a key score, which is the technology
used to intercept internet traffic
and so forth. As you can see, they have
a lot of interception points all over the
world, as you would expect from
the world's best funded spy agency.
There's a lot of technologies
that are used all over the world, though,
to perform this type of intercept
the editorial ization of the blood and
the slide was actually not added by me.
And this is a French company,
and they were found to be selling the
massive intercept capability that
was used in Libya.
Turns out, people were not entirely
impressed with this, and
they were investigated
under the auspices of being complicity
complicit in the torture of the regime.
Another company that I want to emphasize
doesn't necessarily sell technology
that one would prima facie call spying
technology.
Bluecoat sells
technology which can be used for
real time monitoring of your network.
However, they have also
attended surveillance conferences
and pitched their gear as lawful
intercept.
You might remember in 2011,
telecom discovered that blue coat devices
were being used by the regime in Syria.
There was a big Wall Street Journal
article about this. It was a very big
deal and people got very worked up
shortly after that.
I remember reading that people
suspected that Blue Coat was being used
in Saudi Arabia and being a
security engineer. I thought like, Well,
why are we wondering whether
it's used in this country or that
country? Surely the solution would be to
sit down and check it out everywhere.
And then we would just know.
So we did that.
And so this came
out at the beginning of this year.
What this shows is
the black is places where I did not find
these devices.
That does not mean that they're not there
just means that I didn't find them.
The gray places where the devices
were found, but I decided I didn't care,
and I decided that I didn't care
based on the type of networks
they were found on.
For instance, if they were found on
corporate networks, the
best practice of most corporate networks
is to run them as draconian a manner as
possible.
And so it's like, well, there's a kind of
his best practice. However, what I
decided I didn't care about was networks
where I found them on infinite exchanges,
ISPs and provider networks.
So as you can see here, we found this
sort of liberally used
everywhere, including Qatar, UAE,
Bahrain, Saudi Arabia, Kuwait.
And one of the reasons why I found this
sort of interesting was because the
proxy S.G. device they sell offers
what they would describe as SSL intercept
capability.
They obviously don't give you a
certificate.
You have to find one of those yourself.
But if you do, then you know this is sort
of a choose file dialog.
You can upload your set and then start
intercepting bits of traffic, which
is obviously worrying. So this was
published in The New York Times.
And what was useful is shortly after
this, mainly as a result, I think of
Telecom X's efforts.
The government agency responsible for
investigating this sort of thing decided
that it was not cool that Blue Bluecoat
gear had been found used in Syria, and
they were fined a reseller that they were
using was fined $2.8 million.
And that was that.
But then something really interesting
happened and it was called the internet.
Since us, you guys might remember this.
This was a project by which someone
used
various scanning technologies to create
probably the most comprehensive map of
the internet that we've ever seen.
And it allowed us to see inside networks
that. Previously had been close to
us, so it seemed like a good time to make
another map and
made this one.
And as you can see, we actually managed
to fill in significantly more of the
globe. And what becomes interesting here
is that we found this
technology in places like Iran and Sudan.
Now, Bluecoat is an American company
based in Sunnyvale, and
Iran is an ultimately embargoed country,
so it is actually illegal for the IAEA to
be found there.
The Washington Post published an article
about this in July this year, and
investigation into this is still ongoing.
Now, the ubiquity of mass
surveillance is actually not a new
concern, right?
This should not be news to anybody.
People would be worrying about this for a
very long time.
For those of you here that remember the
90s, well, there was a movement of
cypherpunks that people cared a lot about
this area code.
And the interesting thing is that
if you were a cypherpunk that fell asleep
in the 90s and woke up right now, various
things might actually lead you to believe
that would. One
of the world's largest
operating system vendor now includes full
disk encryption with their product.
A whole bunch of large web mail
providers provide encrypted
login.
The Tor project not only still exists,
but has been heralded as being
a major force for social change all over
the world. And there is now
free code that will provide you with
encrypted takes, messaging,
encrypted voice and so on.
However, surveillance has changed
too.
As it turns out.
There was a fantastic article that came
out a little while ago in foreign policy.
In fact, more revelations on this that
came out today in Der Spiegel and I
haven't had time to really read
about the NSA's tailored access
operations division.
And what this pointed out was.
Much of the code breaking that occurs in
the NSA these days is actually not done
by the much vaunted football field of
mathematicians, but actually
by a team of hackers,
largely because it is much easier to
break into things and steal keys than it
is to actually break crypto.
The NSA are not the only people doing
this. As you guys are probably well
aware, there's been a lot of press about
Chinese government hacking, theft of RSA,
seed tokens, et cetera, et cetera.
And this takes exactly
the format of activity that you'd expect
exploitation of a target into
implant, steal stuff,
data keys, communications and so forth.
And in fact, this is actually become
recognized to the point where Microsoft
and this is actually very important.
Microsoft described US government
snooping as an advanced, persistent
threat.
And this is Microsoft's general counsel,
Brad Smith. So, yeah, this was a big
deal, right? Like
in the world's largest operating
system provider calls the government
advanced persistent threat. I think
things are changing a little.
Obviously, this has been going on for a
while.
We we found out about this sort of thing
through the CCC, who released
an analysis of a German government Trojan
in 2011.
And and the
the thing is that I think we have to
recognize what we're going to start
talking more in depth about targeted
surveillance. This is that it's not just
malware, right?
Because this has a lot of connotations
because we've used all sorts of different
words to describe it.
It's better to think of these things.
The total surveillance solution.
Right?
This isn't just sort of a rootkit code
that someone has a proof of concept.
And generally with this, you actually get
a full suite and we'll talk about that
soon.
So around May last
year, I was contacted by a group
called Bahrain Watch, a woman
called al-Shaabi, who is a British born
Bahraini activist and a London based
economics lecturer, and received this
email. Now she actually gave
me great hope for user education
because she said, I've got these dodgy
emails and I think it's a targeted
Trojan.
It's like, Well, it's
pretty well done.
And as it turned out, I sort of had a
look at the malware and I expected it to
be something kind of boring.
So the first thing I did was run it into
the dynamic analysis engine and it just
disappeared on me. I was like, Well,
that's interesting.
And looking at it more
in depth, there was actually a
myriad of obfuscation and
ante analysis options,
which actually just made the malware more
and more interesting and found in the
memory of
one of the malware processes was actually
this card,
which was finished by V2.
Now, the only Claudio
talk a little bit more about why that's
important.
Yeah, so, you know, that's
Christian was actually, you know, pretty
helpful for us for different reasons.
First of all, because, you know, pretty
easily told us what we were dealing with
turns on a teen by, if some of you
didn't ever heard of it, is a part of a
larger commercial suite of surveillance
software and equipment sold by
a company called Game International.
And you know, it's a traditional
governmental and intrusion system
of that has different components,
including this part, which is a Trojan.
Just just out of curiosity.
How many here I've never heard of in
Fisher or Fin Spy before?
Nice.
So
this is after, you know, all I came out
with with a sample and, you know, Morgan
was able to analyze it and we started
working together, that was actually the
first time where we had a concrete
example of an attack referenced by
an unfinished future.
We knew about the company before, thanks
mainly to, you know, some protest through
Najib that found some alleged documents
of relationship between the Egyptian
government and government or national
detailing a prospect sale of their
software. But nobody actually ever so
that that specific software before we
never had any samples of the malware, so
we didn't exactly knew
what he was looking like and what kind of
capabilities it had.
The documents were pretty interesting
because I suggest you go online and find
them because it lays out exactly how much
these kind of technologies cost and
what type of specific components that
constitute the whole suite.
But, you know, it's one of my whole
operation.
It does a lot of different things.
This is actually taken from one of the
official brochures of the company.
So it bypass antivirus systems
and our communication tools, got
monitoring, intercept calls, chat, spam,
transference and no thing records
communications through email chat voice
over IP.
You can do like environmental
surveillance through webcam and
microphone,
gone through tracking, you know, all
sorts of interesting things, keylogger
and so on.
So this was helpful.
We kind of knew what we were dealing
with.
Does that an extent?
The screenshot was also funny because
I don't know if you noticed, but a string
is actually linking to an open source
library, which is GPL code
and turns on. It's not actually the only
ones that are actually using plenty of
open source code into the software,
which yeah, it was interesting to
observe.
So after, you know, I actually came out
and realized that she was being targeted
and after we realized also how the spy
looked like, we knew kind of how to fund
it and it was not an isolated attack.
We started seeing more and more things
actually coming out at the beginning,
especially from Iran, also from towards
other targets.
You know, this was another example
similar strategy to try to send some
emails through to the person of interest
and that some files to the email
and then they hope that basically they
opened them and in most cases
actually would means by the typical
strategy is that as you see, they will
attach an archive and these archives will
contain a bunch of pictures.
Some of them are actually legitimate
pictures and some of them are not.
And it worked perfectly for them,
especially in Arab countries, because,
you know, Arab and windows systems need
to have left the
right override to be able to read from
right to left. So to use the same tricks
to override the file name, so they will
look like a JPEG, although the Excel
prompt, it's kind of suspicious.
And some of the files containing to these
archives would actually be an executable,
which would be the final spy
backdoor.
But as I said,
it's not. I mean, it's not an image.
When open and executed, it will display
an image, but also execute some code in
the background.
And these are some of the pictures that
were attached to it.
The nice thing about this, this strategy,
is that it helps us a lot to know the
context of the attack and who actually
might be targeted.
And yeah, these were some examples, some
alleged arrest for people in Bahrain,
people being tortured in Bahrain,
other groups being targeted.
This was 15 February youth group in
Bahrain.
So it was pretty prolific in the last
year.
But while analyzing the command
control server and you know, the
structure of the of the of the attack,
it came out pretty incidentally
that if you would connect to the command
and control server a spy and you would
given just even a malformed H-2B request,
you would always got these patterns are
saying other stuff.
It's unclear at this point who is stuffy,
but we were like, Oh,
you know, so
taking this into account, we started
thinking, OK, we would actually might use
this. And what we did was we scanned the
whole internet and we tried to do these.
These requests and C would respond in
that way.
And we published the results,
which were kind of interesting, and we
got that in a moment. But despite
the fact that nobody ever acknowledged
the fact that this was being spy, after
we published the report, all of them
suddenly started changing their behavior
and a fingerprint was fixed.
Reason why we change also strategy.
So we actually
used several different techniques to
map out offense by command and control
servers around the world.
One of the things that we did is we
actually replicated the initial handshake
that a client performs when contacting
the server.
Now we've actually heard there's been
there's been some great advances in fast
scanning and Holdens, and it's scanning.
Recently, there was a talk a couple
of days ago by the ZMapp guys.
It's fantastic Mastcam.
However, since we were actually
attempting to replicate this handshake,
we weren't actually able to take
advantage of this sort of technology.
So we found 36
different. We found command and control
servers in 36 different countries
around the world.
Now there was actually a bunch of
problems with doing this type of
scanning. As I mentioned, we were
actually trying to replicate a handshake.
It was very noisy and very slow and sort
of 18 billion packets later.
I believe we were thrown off for service
providers.
There was there was one of them that even
sent me a mail saying, You're in breach
of our terms of service, and I'm like, I
am definitely not.
I read your terms of service and it
doesn't say we can't do this at all.
And it's like, Oh
yeah, we're still not going to let you
down. So
I finally found someone who he managed to
explain to them exactly what we were
trying to do, and they sort of hemmed and
hawed and then accidentally shut us down
again once we finally got through things.
And so we
managed to make this map of sort of
servers. I would like to emphasize that
finding a command and control server in a
specific country does not obviously
offer prima facie evidence that it is
being used at the country servers being
found in, for instance, all of
North America is lit up there, but also
half of the world exists on Amazon EC2
instances anyway, so it's a draw your
own conclusions.
And in addition to the sort of scanning
and mapping the use
of this around the world,
we analyzed the entire suite
of mobile backdoors that are provided
by finfish and
found Android backdoors.
BlackBerry backdoors.
Windows backdoors.
I respect those,
and in fact, they even had a simian back
door.
And so the laughter laughs,
you know?
And so this this sort of goes back to
what I mentioned before when I said, you
need to sort of think of this as not
simply like a piece of malware, but this
is a total surveillance solution, right?
Like when you pay hundreds of thousands
of euros, you get people to show up and
train you to use it.
You get support calls, you know, et
cetera, et cetera. This all talks.
The same format goes into the same thing.
And so this mobile spyware provides
all of the things that you would actually
probably like when you're earning
someone's phone.
It allows you to intercept their calls,
log who they call and
who they receive. Calls from allows
you to intercept their Islamist messages,
track their location,
obviously steal their contacts.
The one that I found the most disturbing
was actually something which is
referenced in the code as spy corps.
And what this was was when the malware
is installed, the
implant instantiate
an outbound call from your telephone.
The hardware of your telephone is
controlled, so you don't actually see any
of this, and it has this sort of
persistent outbound call sort
of giving a microphone
of what you're doing of what you're
saying sort of proximate to the to the
actual device and
it enables call waiting.
So that means if an inbound call comes in
control of your device returns, ring ring
device shakes flashing lights, you answer
the thing, you talk to your friend, you
close down the call and then the outgoing
call re instantiate and you have the
invisible microphone going again, which I
found was actually very creepy.
Yeah, so we never we didn't stop on that
point, so we started investigating even
more. We started receiving a lot more
samples.
People started getting interested.
And, you know, new things
started coming out.
One of the latest attacks that we found
using Kingfisher was actually used in
Ethiopia, and this was the image on
the sample that was use.
And again, the image actually helped us
quite a lot understanding what was going
on and turns out that, yeah, we
discovered it in early 2000
and actually should be 13.
Yeah,
and it shows map. And the image shows
some pictures of a member of seven, which
is a political opposition group
of an Ethiopian region, but based in
Washington, D.C., which is being
recently labeled as terrorist by the
Ethiopian government, which
a lot of human rights organization
criticized.
Not alone.
After I consider one report, we found
out to them during the scanning of the
internet, we found some things in
Malaysia, and a lot of things actually
went wrong in that case that
some Malaysian newspaper reported this
news and said, you know, there's
the Malaysian government using spyware
against some citizen.
And it reported another article from the
New York Times.
And apparently, the Malaysian
government actually got quite mad about
it.
What happened is that if I remember
correctly the
shut down to website for like 10 days
because of that.
And when it came back up,
the I guess, forced or asked
them to add a note appended
to the article where they were explaining
that these were not true and that
allegations were not funded by any sort
of evidence, and that
they would also suggest that people would
be careful of what they say or the way
they might be prosecuted.
All right. Well, this was not
particularly pleasant.
However,
shortly after this thing happened, we
actually found an attack in Malaysia.
We found some exploits and some samples.
The documents contained were
written in Malay.
The document dropped Vince by and is
actually listed a number of candidates
for the Malaysian general elections
that were about to go off in May 5th.
This was actually kind of a pretty solid
proof that they weren't flying and that
actually were using Kingfisher.
And and when we discovered it were like,
Well, I feel we might drop it before the
elections, which was quite
fun as well.
Right, so
obviously, you've been looking at various
samples of mapping the use of this
technology for a really long time,
and on May 1st of this year,
we published a report called
for their eyes only the commercialization
of digital spying.
There were sort of various effects of
publishing all of this stuff.
I think
it got on the front page of the New York
Times, which was actually useful
in that a group of people started to care
who are actually far crazier than
hackers, which are investigative
journalists.
And they ended up digging
into the funding
and and commercial practices of
Gamera International.
And it was found that they had offshore
accounts and Cayman Islands and things
like that.
In the end, the U.K.
government was
decided that they weren't entirely sure
about the exporting of this technology.
And so they decided to
stop the sale of this sort of software
sort of pending further investigation.
Yeah, another outcome was that the people
on government and national were not
particularly happy, and this was one of
the complaints a day.
And Glenn?
So this is Martin Moon, who is one of the
key individuals the company producing for
the future. And, you know, he expressed
his frustration on an article at
Bloomberg, which was linked below.
And you know, we really, really sorry
about this, Martha, and we didn't we
didn't intend this to happen.
Another funny thing that you might not
have noticed is that it actually has
a sticker on his webcam.
So he's obviously privately concerned,
which is good.
So this was a
government of national anything for sure.
It's just one of the company.
There are many others.
If I can find the cursor.
Oh, oh, yeah.
So there is another company, which is an
Italian one that produced similar
software, and we don't need a better
introduction than their own introduction
to we have audio.
Oh yeah, right?
Do we have audio?
Yeah.
You have new challenges today.
Sensitive data is transmitted over
encrypted channels,
often the information you want is
not transmitted at all.
Your target may be outside,
your monitoring domain is
passive monitoring, you know.
You need more.
You want to look through your target's
eyes.
You have to hack your target.
You have to hit on many different
platforms.
You have to overcome corruption
and capture relevant
data.
Being stolen and untraceable.
Deploying.
Exactly what we do.
The hacking suite for governmental
interception.
Rely on us.
So, yeah, I don't think they need further
introduction.
OK, I'm going.
So, yeah, basically
we thought, OK, we worked a lot on
on film Fisher recently, and if full, we
must be impartial and also take care of
other people too.
So hacking
team their own introduction there.
Where were they?
Where is this actually being used?
So the first public sample of
hacking team
that came out was used to target
a Moroccan citizen journalist
organization known as Man for Science.
Now, Men for Kinch received
the Global Voices Award for Free
Expression Online.
They were outspoken about some
of the draconian policies of the Moroccan
government during the Arab Spring and
and they were also the recipient
of a message that wasn't
exactly designed to congratulate them
on their strong efforts in the area
of free expression and civil rights
on their web portal.
They had a field which said, you know,
please contact us about various groups
and that sort of thing.
And so they received a message which was
in French, which sort of said
roughly, Look, I don't want to
be involved. I could get in a lot of
trouble, but you really need to follow
this up. And then there was a link to
something usefully called a scandal
doc.
Now, as it transpired,
a Scandal Doc Doc carried
a payload which turned out to
be hacking teams Trojan.
This possesses similar in functionality
that we described earlier with Van
Fischer after after
this was discovered investigated,
another individual actually came to us.
His name was Ahmed Mansour.
He was a member of the UAE, five
to five individuals that were imprisoned
under the charges of insulting the
ruling family of
the UAE.
He contacted us after receiving emails
from a source
that called themselves Arabic WikiLeaks,
and now the document
that he received contained
and exploit.
And it had a multi-stage drop, the final
payload of which was actually
hacking teams backed off.
The exploit that was used
was if you if you Google for it, the
first thing you get is you get a company
called VPN.
Now VPN are a French company that still
exploits and claim to only sell them,
I believe, to native governments.
And now
they said that this was not their
exploit.
However, they were the first people to
publicly claim it as their own
exploits.
Very similar to this and structure are
actually still showing up.
One showed up very recently.
In December, it was only at the time of
discovery used sort of around
October November. It was discovered by
various parties and are structurally
very, very similar to this exploit that
was used to compromise Ahmed Mansoor
and draw up a hacking team's backdoor.
The compression is slightly different,
but otherwise there are a lot of
structural similarities.
It seems as though there
is some ambiguity over
who's selling this, whether it's VPN
or whether it's hacking team.
But fortunately and usefully, a lot of
these companies now are
adopting positive policies.
So, yeah, this is taken from hacking team
website.
And basically you're saying, you know,
we're concerned about privacy and abuses.
And, you know, we understand that it
actually might be abused in certain
ways and we actually
see contracts and start working with
governments in countries that actually do
this.
They also encourage everybody to mail
them in case we you find any abuse
of their software, which you know,
that's the thing. Well, we're not
actually might do that.
So what we did was actually before that,
we had this conversation at RSA.
Earlier this year, I was in a panel
discussion with Jacob and Curt from USF
and one guy from Argentina
where we tried to engage into this
conversation on, you know, what was going
on, how you guys deal with abusers, what
happened in Morocco, what happened?
Yeah, and nothing was actually very well
acknowledged, actually knowledge at all.
However, he remarked the fact that
they do take care of you this this
contract and, you know, react with the
customer.
So the thing is, you know, we already had
two documented attacks UAE and
Morocco, both of them clearly
abusive nature
and with clear evidence and strong
evidence behind it.
However, that was apparently not
enough to get them convinced.
So what we did now, similarly, as
we would for the future, we sort of
scanning the internet again or even
using public datasets that are readily
available, like critical real internet
sensors and scans or real.
And there was an interesting thing again,
apparently, you know, surveillance
engineers are not very good at
disguising their infrastructures
with hacking team backdoors, or at least
with a drop backdoor that would later
deploy their final one.
They disguise the command and control
server as an Apache server.
However, they failed at replicating
the actual behavior of Apache.
So things are actually missing or
responding in the wrong way.
And that helped us a lot.
So we realized that we could use these
again as a fingerprint and scan the
internet and see what would happen.
The funnier thing is that by Googling
around with the response that we would
get and we realized that we
think that the actual software
or at least the basis of the software
that they use for creating their command
control infrastructure, it's Open-Source
and it's available on GitHub account
of this guy who was the hacking team
employee.
So we scan the internet, and
unsurprisingly, we found thing there were
a little bit concerning.
We found a lot, a lot of
servers and a lot of different countries.
These are the ones that we consider more
concerning from human rights records
perspective and from, you know, our legal
and political perspective.
We found things in Mexico, Colombia
under everybody's eyes, everybody in
Kazakhstan, Uzbekistan,
Oman, Morocco again,
Sudan, Malaysia, Ethiopia and Saudi
Arabia and UAE, and a lot more.
So we're not even not considering
the fact that there is some pretty
nasty regimes into this list, even
just taking Morocco and UAE
from this, we were like, Well, guys,
this is kind of bullshit because after
one year after, you're still actually
selling to these countries.
As far as we are concerned,
that didn't stop. We actually found some
more attacks really to I can team
one of them we found in Oman some
months ago.
It was interesting again in
the narrative of the things
we see actually don't look very criminal
or thorough is nature to us.
The document that was embedded into the
attack was containing a logo
for a logo from the University of Zawar
of NISRA in in Yemen.
And the content was actually on that say
on him on his poetry, which, yeah,
could lead to some suspicion.
Another attack? We actually found about
a week ago.
So this is relatively fresh.
We found a new sample.
We, you know, started looking into it in
at some interesting indicators and things
that we recognized.
And
yeah, and then I called Bill, which is
not a guy who works with us and is
reporting to us that, you know, from
these samples and it definitely is.
I can think back there is I'm not sure
exactly what he's targeting, but have a
feeling that it might be this.
And after realizing and analyzing a
little bit more, we we thought it would
actually might be. The case is
that is the target
is an independent media
that, you know, is engaged into
political opposition in Ethiopia.
And so basically,
you know, going to encountered a few
hours later with the organization and
by the end of the day, we identify the
attack and the victim and laid out
everything to be documented.
And what happened was that they first
tried to send over Skype and executable
with a PDF IGen.
And that led the victim to be a little
bit suspicious and said, Well, this is
not an actual article because the name of
the father was Article four is that
so that didn't work.
So they actually tried to send an
exploit, although it didn't work either.
However, this is just that these
are there will be a lot more things that
we still researching and documenting in a
better and structured way.
So look out for a report.
We'll actually have a report out very
soon on hacking teams specifically.
We do a lot more indicators on the
countries in the text and so on.
So we're coming to a conclusion.
This was not a work of just me and
Morgan. A lot of people were involved
into the research and the and the
reporting and investigations and so
on.
So, you know, I would like to thank Bill
Jacob Vernon John Seasonal, IBF
and Provost International.
If any of you guys are show invites you
to stand up and all of all of us to make
a round of applause for all of these
people.
Yeah, we can't emphasize enough that this
work did not happen in a vacuum, there
was heaps and heaps and heaps of people
helping us out, and they're awesome.
So thanks. Yeah.
And also thanks to, you know, the people
and you know, Allah and Ahmad and the
people have got the courage to come up
and, you know, be able to document that
there their surveillance attacks
and be able to use these cases to do some
advocacy internationally that Whiskey
IQ thing to.
Oh, you went really well.
I mean, even
before retirement costs.
OK, so is there any question?
Please queue on the microphones?
Yeah, there is an enormous queue on
microphone for us, so we start from
there.
All right.
Hello.
Yeah.
I found it very interesting that you
found some software linked into Josefin
for software.
And at least in the case of Lipschitz, it
seems to me like some blatant violation
of SEC new LG policy actually distributed
as part of that program.
What do you think about trying to sue
them over that?
So the offer of that
library actually asserted his rights
as an author for them not to use
it, and he released a blog post to that
effect.
I'm not sure whether that was efficacious
or not.
There has they?
There has actually. Mozilla actually sued
or issued a cease and desist against
Gamma International because
they were met.
Hey, can you please leave this room
quietly?
Thank you.
So the first company, I believe, to issue
a cease and desist against Gamma was
Mozilla.
There were samples that were masquerading
as the Firefox product, and so they sent
a letter saying We respect privacy.
We are not want to be involved in this
anymore. Please stop.
So it could potentially
be something that that could be taken to
court. I suggest you find
a lawyer that's good at licensing and
persuade them to give it a go.
Thanks microphone to.
Thanks a lot for your presentation.
So you may you may know that the European
Union is looking into
setting up export controls
on surveillance like mass
surveillance devices and
finfish like software.
And we also saw on your presentation
that basically, even though there was
an embargo from the US on Iran,
some medical devices were found there.
So my question is,
what do you think?
And would you advice anything regarding
what the EU is trying to
do? Like, what is your advice
on potential export controls
that the EU could set up to kind of
mitigate a little like this?
Thanks.
So so obviously,
we both security engineers
and not policy authors.
So I think that
there's been a lot of worry about
regulation because historically the
regulation of security technologies has
worked out really poorly for us.
As anyone who remembers the debacle of a
strong crypto.
Well, no,
I.
Having said that, surveillance technology
is is already regulated to a certain
extent, as
as you mentioned, just simply
ineffectually and a lot of cases.
I think as we generally sort of become
more aware of the sort of widespread
nature of surveillance governments using
these technologies and that sort of thing
that that will sort of get more
sane legislation and policy on it.
And I think that
what's what's sort of important is not
necessarily regulating the technology, as
I mentioned before, implants,
exploits and that sort of thing.
It's the fact that it sold commercially
is like a total surveillance solution.
And I think that's that's sort of what's
pertinent to remember when people try to
develop legislation around this.
As for the specific character of the
legislation, I'm like, Well, as I said,
I'm not a policy author.
So one thing that I might want to add is
that a lot of discussion has been done on
export controls and now we should
control, you know, what kind of countries
get access to these things, but not a lot
of people and not a lot of movements are
actually discussing how
these technologies are actually already
being used, even in our own countries.
Because personally, I still don't
understand how the fuck is possible that
these things are legally used despite
being against any sort of rule of
forensics.
Nobody ever justified that.
And I would like to ask the answer to
that.
There is a question from the internet.
It's on the very left near the camera.
Did the researchers provide snort or
Yaara signatures in the reports so that
we didn't check or protect ourselves?
I don't see.
What was the question?
He unlawfully provided Snort or
Yaroslavl.
Yes, we did provide snorting it.
The reason some of our publications and
in upcoming reports, it will be a lot
more indicators and more things coming up
to, you know, although everybody to
investigate further, for sure.
Microphone three, yeah.
Um, well, I have
a couple of things.
There was this list of
evil things that the speaker
who talked before talked about and
I wanted to say the military
base who controls the drones.
So not only one of the states, just one
in Germany to which she didn't
talk about was the speaker
before and then president
for profit, which is a topic
which would fit to all these other ones,
too.
Then I have a question really short.
In Germany, we had this Trojan to
from our government, and there was the
possibility to spy on
the Trojans and to figure out who they're
surveilling or stuff like this, or to
attack people because they have
unsecure software like this
Trojan. Yeah.
One to asked if that would be possible
with the other, with the other ones, too.
I've never really investigated the
industry, and so I don't know exactly the
details of how would that be possible?
The only thing we could come up come up
with was trying to map out who was really
using it, but it's very hard to get
actually into the details and finding the
specific victims.
What really happened to us as other
people come to us because they
read our report or we
find the malware
attacks in other ways?
Most of the times is just incidentally,
actually no.
All right.
So most of the attacks you describe
today in your talk seem to have been
targeted at business systems like all
these X-Files and the email archive
attachments of the Skype PDAF stuff.
So I wondered, so of course,
this is also possible for other operating
systems like Linux.
And I wondered if you have observed any
Linux or Unix like attacks.
So as you pointed
out, we actually
did analyze a whole bunch of samples
from mobile platforms as
well.
And I didn't actually mention this, but
the first hacking team
sample discovered actually
contain two backdoors one windows one,
obviously.
So, you know, the sort of an equal
opportunity thing going on there.
I don't think we've sorry, we have
actually published details about
obviously examples.
I don't think we've published any about
Linux. No, I
think that probably just speaks to size
of user base, though, right?
And that there's far more Windows
users and everything else.
Then then probably OSX.
And so you sort of see more based on
proportion of target.
OK, so you said it didn't publish that
doesn't mean you didn't observe it.
Yeah, we didn't.
We didn't find them.
I'm I'm pretty sure they have them.
But you know, also considering the kind
of targets that we see, most of the cases
are, you know, journalists or political
dissidents and activists.
And most of them, I assume, would use
either windows or sex in most cases.
So it's not it can't be excluded.
We think it actually it's absolutely
plausible. We just don't have the chance
to find some copies of them.
Um, yeah,
we have 30 seconds left soon.
Number four, not
just a question,
the attacks were always infected
emails or Skype messages,
right?
There were other factors as well.
So both hacking team and Gamma and all
the other companies provide a lot of
different ways to deliver the Trojan.
The most common ones we've seen,
obviously, were spear phishing attacks,
so attached to emails and so on.
We think we've seen some weird drive
by attack,
you know, but there are other things
other methods that they have for, for
instance, got off thing fly IASB and
Firefly Lane and other delivery methods
that I would recommend Googling for
WikiLeaks or probably some documents on
that. But yeah, in most cases, was spear
phishing attacks.
OK, that always answer to my question.
All right.
OK, perfect.
So thank you very much.
Just.