Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2834 Thanks!
[Music]
many of you have already heard about the
Israeli based NSO group and their
pegasos spyware Well turns out here in
Europe we have now a similar case with
the intellect Alliance a European based
surveillance
supplier the insights presented today
originate from the from the predat
Predator files leak analyzed by Amnesty
International in collab in collaboration
with the European investigative
collaborations Dona Carl the leader of
the mnst International Security lab is
now going to present us what they have
found Carol
thanks
[Music]
thank you for having me here
today this is Mr Chun Ki an independent
journalist based here in Germany in
Berlin he runs Tau one of the most um
prominent and popular Independent Media
organizations publishing on Vietnam he's
also Target of the Predator spyware
developed by the european-based in Alexa
Alliance
in this talk I will tell you two things
first I'll outline how we investigated
and documented the use of predators the
target Mr Lee and a number of other
activists and prent
individuals I'll also do a deep dive
into the range of technical products
spyware tools and surveillance equipment
developed and sold by the intellect
Alliance and used to enable such attacks
and finally I'll put the I'll put inexa
and these attacks in the context of The
Wider problem of surveillance misuse
both in Europe and around the
world my name is Deno Carl and I'm the
head of the security Lab at amesty
International we have a team an
interdisciplinary team of researchers
Advocates campaigners and lawyers who
work to investigate and document human
rights harms from emerging technology
including the misuse of surveillance and
spyware surveillance technology and
spyware uh as part of this work we do
research and investigations to
technically investigate and document how
spy being used we develop and publish
open source tools such as mvt to help
Civil Society more broadly investigate
and document these attacks and finally
we use this um research and
investigations to do evidence-based
campaigning advocacy trying to get
accountability for victims and to re in
the abuses from from this
industry um so this investigation arose
from a collaboration uh with the
European investigative collaborations
Network and particularly in
collaboration with disel a media pirate
who got access to a huge amount of
internal documents and information which
shown a light on how one particular
European spyware Alliance known as
intellecta uh collaborated together to
basically pull their
resources uh and and develop a whole
ecosystem of products surveillance tools
and spyware that they can sell to
governments around the
world the intellectual Alliance is
comprised of companies from across
Europe but in France in Germany in
Cyprus uh North Macedonia Ireland and
elsewhere uh we are as I said are acting
together to uh develop and compete with
some of the biggest uh surveillance
vendors in the
space this investigation also um
uncovered uh leak documents and
Technical brochures and marketing
material about specific uh Spyro
products developed by intell XA and
through analyzing these products we're
able to then show a light for the first
time of how these particular tools work
in practice and what kind of things
they're pitching to their customers to
try and meet the the needs and
objectives of their government uh
surveillance
customers um finally uh and our role at
amesty was to work with uh the Media
Partners to help both find how these
tools are being used concretely to
Target specific individuals and also to
analyze the technal technal technical
material to document how uh these
surveillance tools um work in
practice um before I jump into the
investigation first I want to give a bit
of an overview of how the Predator
spyware Works in practice so Predator is
a form of Highly invasive spyware
designed to attack iPhones and Android
devices and what it does is it uses a
series of of exploits often zero the
exploits which are unpatched and can
Target even the most upto-date devices
and he uses these exploits to kind of
burrow past the security mechanisms uh
in place on a device to be able to
install and implant land uh the Predator
spyware on the phone itself once the
Predator spyware is installed you can
then access everything that the user can
access on the device and more it can
read your photos it can read your signal
messages it can even turn on your
microphone or GPS sensors to record your
data uh your location and what you're
saying around your device so as you can
imagine this is is really highly highly
invasive and what's also interesting
about inexa is that they take something
that's extremely complex of is very
difficult to find and develop exploits
and surveillance techniques and they
package all of this up together in kind
of one userfriendly interface that then
any government customer who can afford
to spend 10 million or 50 million 15
million euro can kind of buy it off the
shelf get a nice uh point and click
interface as you see here to both Target
a particular device and then suck up all
of the data and analyze that as they
wish so it take something that was
previously highly sophisticated and only
accessible to a very small number of of
technical States and makes it available
toas any uh government who has the money
and ability to buy
this intellectual Predator spare is
typically developed is typically
deployed as a wood click attack so wood
click attack is where there's some user
interaction required from the end user
and most often this is done by sending
the target a malicious link to a uh
Predator uh linked domain name you can
see example here on the right of a of a
f link sent over WhatsApp that was
discovered by citizen lab in 2021 and
just by clicking on this this link um
the phone's browser will navigate to the
militia website it'll load an exploit in
JavaScript for example and that code
will be enough to start bypassing the
security mechanism the phone and
eventually to install the full spyware
system so now that we know a little bit
about how Predator works I want to dive
into to how we discovered this uh system
being uh used in the wild to Target uh
journalists and Civil
Society uh as part of the work of our
team we're always trying to understand
what surveillance companies are out
there what kind of products are being
used by governments and ultimately
trying to figure out who might be
targeted by these
attacks we regularly for example go to
trade conferences to figure out what
companies are out there we'll try to
talk to sources and we'll also do
technical um scanning measurements to
identify particular uh infection servers
or spyware servers being used by
companies such as
inexa from this ongoing kind of
intelligence gathering work we
identified uh a number of domains being
used to deliver uh intell access spyware
and from this we through some Googling
um found that one of these domains
unexpectedly was showing up on Twitter
um you'll see here on the bottom left uh
a tweet by an account named Joseph
Gordon written Vietnamese claing this
link uh link to
news.co and kind ofun a URL with a
random section at the end so we knew
this domain was already linked to
Predator based on our our information
gathering and so here we saw what
appeared to be somebody trying to infect
users publicly on Twitter uh with with
spyware this uh this tweet is actually
being sent in reply to Tau which is the
the website being run by Mr Lee who I
mentioned uh in the first uh in the
first slide and if you if he or anyone
else for ex for that matter had clicked
on this link when it was when it was
active that alone just one click could
have been enough for the spyware to
burrow itself uh into his
device uh as you can imagine this is um
this is quite unexpected normally we see
these links being sent over signal or
private messages and it's very unusual
to see it send so publicly so this is
I'd say quite a Brazen attack uh some
may say um yeah quite a foolish way to
spread an exploit and try to Target
somebody as here almost anybody could be
target targeted or infected by this if
they clicked on the
link but the first at least from our
point of view this is something that
okay it seemed to be an attack and we
wanted to investigate it further so as
we continue to to look at this we saw
other tweets sent by the same account
targeting people working on on security
and Maritime issues in the in the South
China
Sea uh later we saw um the same account
sending Tweets in Spanish uh talking
about uh EU yellow card which is is
basically something to do with how the
EU is regulating illegal fisheries and
we we learn later is also um relev to
this investigation and then I think most
shockingly or most um kind of brazenly
we saw that this same account uh began
to Target uh senior European politicians
uh on top left we'll see Emily Haber who
at the time was the German ambassador to
the US uh being targeted on her Twitter
account with a malicious uh Predator
link uh here at the bottom we see the
European commission's official Twitter
account itself being targeted uh with
The Predator uh and on the right we'll
see Roberto metsola who at the time was
the president of the European Parliament
again being sent these export links uh
and just just to remind you how
dangerous this is it just simply take
one click from either the the
politicians themselves staff members and
that could be enough for the operator
behind this pazas customer to get all
the data and infect their
devices uh finally we even saw them
targeting uh some heads of state in this
case targeting um the president of
Taiwan as well as a number of senior US
Congress people and officials who are
also included in in these tweets and who
also got sent the the attack
links so I think this is quite um yeah a
reckless attack but I think what's
helpful here is it does
show um kind of a snapshot of the kind
of people that a customer of predators
is targeting they say it's only being
used to Target um criminals and
terrorists but here we'll see that
they're targeting a range of people from
independent journalists uh maybe
political allies or political opponents
who don't want to get information on and
using a tool of intelligence gathering
very far from the you know potentially
legitimate purposes that they they claim
these tools are aimed
for so how did we go about uh
investigating and unraveling these
attacks so at this point uh it was when
the collaboration with uh European
collaborations and media parent Spiegel
really began to shine as they had access
to a huge amount of internal information
showing how the company is operating so
when we
started with the information we had so
far we began to suspect that most likely
Vietnam is the is the customer behind
the attacks we see the Vietnamese
journalist being targeted we see kind of
relevant um um neighboring countries in
in uh East Asia being targeted and so
this is what our sual but we didn't have
enough yet to really conclude if it was
a government customer if it was somebody
else using it if it was potentially a
neighboring country using it um so we
began to work with the journalists from
EIC uh digging into the their data and
that was uh immed L quite
revealing so I the first uh clue we saw
was um contracts and documentation uh
that ESC and media Parn covered which
showed that in 2020 next technology
which is a component company of the
intell alliance uh did a deal with
Vietnam's Ministry of public security
for what they termed infection Solutions
so it doesn't take a lot to understand
that infectious Solutions probably or
most likely means uh spy work
uh at the time we saw that this um deal
was done through uh intellect alliances
um s company in the UAE uh country is
often used to kind of broker deals and
try to maybe sidestep some of the
existing EU
regulation um this this steal uh was
termed Cod named um angler fish and was
valid at 5.6 million EUR so it's quite a
substantial amount of money for to deal
with this this customer
as we continue to dig into um this
particular customer uh with with the
Media Partners we managed to find other
information that really helped to
substantiate then the deal was done with
Vietnam uh we found another contract
that shows in uh February 2021 uh the
same Advanced Middle East systems entity
uh had an agreement with delson's Hong
Kong Limited a separate company that's
acted as a broker for these kinds of
surveillance deals uh to
again for inspection Solutions and
spyware um I don't think anyone here
will know delson's Hong Kong but uh when
we started looking into them we realized
that they were also previously linked to
uh other spyware sales in the past uh a
leaked emails from hacking team shows
that delson's Hong Kong had previously
uh engaged with hacking team and trying
to buy their hacking team uh spyware uh
in that time in the in the original
emails they even said that they were uh
working for uh a Target which is the
ministry of public security of Vietnam
to try and procure hacking team emails
hacking team um spyware and here again
we see that um they're likely trying to
procure new Predator spyware on behalf
of the same same
customers I think the the final piece of
evidence that helped us uh conclude that
indeed Predator was sold to to Vietnam
is uh independently we found shipment
records um which publicly document uh a
shipment in late November 2021
uh of something that they call mobile
phone monitoring modules belonging to a
professional Software System from
manufacturer as which we believe is
Advanced systems and so this was kind of
the The Smoking Gun that indeed the
spyware was indeed supplied to Delson
and then Dallas as a broker supplied it
to uh this agency in Vietnam who's also
working with the the ministry of public
security so it's very very seldom that
we get so much kind of documentation
material to show the full chain of
contracts suppliers brokers and
eventually how this spyware is being
used
um so here is the the ministry of public
security who we believe is uh is linked
to the purchase and use of this this
spyware um particularly there a
department called the Department of
Professional technology which is the
Cyber intelligence or technical
surveillance department and the
mops uh we know from other records that
uh the intellect group of companies and
NEX group had previously done deals and
worked with um units of this department
including units a a70 and
a71 we also um conferred with uh
researchers at Google's TR analysis
group who's independently investigating
this attack and their findings through
their technical research also found that
the Spy were and the Spy attacks
targeting Mr Lee and the senior
politicians uh was attributed to a
government actor in in
[Applause]
Vietnam so so I think we have a lot of
understanding of how this how this sale
actually happened I unfortunately we
still have a number of open
questions uh one particular open
question is we still don't know um who
authorized the sale of the spyware any
sale of spyware from Europe is meant to
go through a dual use regulation product
process and it should get an export
license which basically uh determines
that indeed the Spy is being sold to a
government in customer and that the
government and customer agrees not to
use it illegitimate to Target rights
Defenders or to impinge on human rights
unfortunately with the conglomerate of
companies we saw here based in France in
Greece uh in UAE we are not even sure
which company was officially responsible
for getting the export licenses NEX
group said they didn't get the export
license the U said they didn't Grant the
export licenses so we suspect you know
Greece maybe have granted the export
license but here we see a problem where
we don't even know where we should go to
ask to see who should be accountable for
overseeing this company let alone if the
if the government has actually enforc
these rules or um enforce proper
regulation in
practice so while we talked a lot about
you know spyware one click attacks what
I want to make clear is that this is not
just a technical problem it's not just
about surveillance or privacy impact but
these digital threats can vary um very
often and have in many
cases enabled concrete phys IAL threats
and physical violence targeting
individuals uh in the case of journalist
Jamal kogi who was murdered in the Saudi
Embassy in in Turkey we found that his U
his wife was targeted with the uh
Pegasus spyware in the months leading up
to his murder and we found that other
family members just days after his his
brutal killing were also again Target
and hacked with with pegas so we see how
States tarian states are not just using
these to gather information but in many
cases can and will use these as part of
uh other more serious and more gruesome
um series of threats that they were
trying to um use against their opponents
and their critics we've also seen
similar um correlation and attacks
happening in the case of kar Kima who's
the daughter of a an outspoken Rwandan
uh activist who was uh detained and
transferred to Rwanda against his will
and around the same time Karine who was
campaigning for his release was also
targeting targeted Brad in Belgium with
the spyware and used to track her and
get her information about their case and
their
defenses uh in the case of Mr Lee
unfortunately this is not uh also out of
the rounds of
possibilities uh we know the the German
government have said that uh the
Vietnamese authorities have kidnapped uh
individuals from the streets of Berlin
and transported them to Vietnam
unlawfully uh Mr Lee himself for his
journalism work is currently under
active police protection due to the
amount of threats uh of physical
violence trust that he receives so I
think it's not beyond the POS the
possibility to imagine how States like
Vietnam or Saudi Arabia or others can
use these kinds of surveillance tools
developed by an EU company to go and
Target dissidents activists and critics
abroad and potentially to use that to
track them and kidnap them or do worse
to them and all these tools you know are
not just used for surveillance but
enable a whole host of harms uh to
critics around the
world so now shown you you know how
these tools are used in practice I want
to take a chance to dive a bit deeper
into the whole ecosystem of surveillance
products both predator and accompanying
tools that the intx alliance offers to
enable their customers to carry out
these kinds of attacks and
surveillance as I mentioned uh intellex
is typically a one-click spyware um
normally sent to a Target via uh a URL
sent over SMS or
Whatsapp um One Click can be very
powerful all takes is one opening the
link to infect the phone but they also
have a number of
limitations so one limitation is firstly
the target needs to click the link if
you are somebody writing them out of the
blue people suspicious maybe they don't
click the link maybe they think it's
spam so it's not guaranteed that you're
going to be able to infect the target uh
it also has the risk that if the target
is um cautious or or careful about these
kinds of threats they may SP L say this
is something I'm worried about not open
it and shared with researchers like
other amnesty or others which couldn't
help expose the the TRS their facing so
what's uh what most customers are really
demanding and what they really seek are
zero click attacks because these just
the kind of goal standard the the best
they can get a zero click attack is is
basically any kind of exploit uh or
digital threat that let you uh
compromise a phone completely remotely
without necessarily having any user
interaction from the target itself so
these are EX ex reliable uh extremely
difficult to detect on the other hand
they're also extremely difficult for a
company like int to develop or buy and
it can be very very expensive so we know
NSO group has has developed these in the
past but it's not something that every
every company can develop and it's also
takes a lot of work and a lot of risk to
try and develop these kinds of
tools however we do know that uh Intel
XA has some tricks up their sleeve on
how they can use their existing uh one
click exploits targeting andro and iOS
and turn them into a kind of you know
zero click exploit to compromise their
targets and so how they do this is they
offer uh a range of products that enable
what we call Network
injection so Network injection is a way
where a company or customer can take a
traditional browser exploit a oneclick
exploit and make it fully automatic uh
to silently infect the target uh and so
how do you do this is by redirecting the
the the target traffic if uh I'm a a
government such as for example uh
Morocco and I have control of the the
mobile phone operator I can install some
Hardware in the phone operator's network
uh and then for any victim who I might
want to attack I can root all of their
traffic through my my network hardware
and then all I need to do is wait for
the Target to browse the web browse like
brows htps websites and eventually
they'll click a link that's HTTP only uh
once they click this HTTP link
the the middlebox hardware can see this
HTP request coming in un encrypted and
then they can reply with a redirect they
simply redirects the person's phone
silly not to the original website they
wanted to Target they wanted to visit
but instead to a malicious Predator
infection server uh so in this case you
know the Brows the The Target just by
browsing the web can unintentionally be
redirected to the militia's website get
exploited maybe they get a loading
message for 10 seconds and then
silently getting redirected back to the
original website that they wanted to
visit so as you can imagine this is also
very difficult for the Target to detect
it requires no specific action from the
Target and it lets a company like
intellex used already valuable and
difficult to develop browser exploits
that they developed to again silly
infect people um just by browsing the
web um so here you'll see how intellecta
uh offers this product so they uh sell a
product they call Myers which is an ISP
level Network injection system that
works and is built in to the Predator
spyware
system so you see here on the right they
talk about having the mobile phone on
the mobile ISP um the traffic is going
through the the ispt internet and
they'll talk about how the they have the
mar server here and the mar server can
then for specific targeted users monitor
the traffic and uh redirect them to the
the exploit links uh when they want to
Target and infect their
devices so this can be very powerful uh
and we've seen this being used uh to
deliver other spyware in Morocco it's
been used in Egypt to infect people with
Predator spyware it's been used in
Turkey to infect um uh Kurdish activists
with um with spyware as well and so this
is something that while
it's it's can be difficult um and
expensive to deploy initially once this
kind of physical Hardware is deployed in
the operator's Network it then becomes
very easy to Target people at scale and
it makes it very difficult for the
individual self to detect
this however this this type of approach
of of do injecting in injecting
redirects in HTP traffic has one
limitation so the main limitation is
that it only works for HTTP traffic so
if the person is only browsing um on
https links then it becomes impossible
for the um the spiral operator to infect
and redirect them so intellex has
actually come with quite a clever
technique to get around this limitation
and they call this product Jupiter and
it's an add-on for their their Mars
product um so we know about this from
looking at some of the leaked brochures
of this product uh unfortunately this a
marketing products marketing
documentation so they don't explain
exactly how how they do the attack but
we think we have a pretty good uh
understanding of how they likely do it
based on our analysis of the product um
so on the mobile operator side it's
basically the same they will redirect
the traffic of the targeted mobile phone
user um and and and and yeah basic do
they attack the same way from the mobile
side but what's really different about
this um Jupiter product is they offer
the ability to intercept uh encrypted
websites an important caveat they add is
that they can only intercept encrypted
websites which are hosted in the country
of the operator of the SP operator so
how we believe they do this is that that
they do uh basically a network injection
attack on the hosting provider of
particular websites so you can imagine
there is an independent uh media website
hosted in a country they will install
some Hardware in their hosting provider
network uh and then what they can do is
they can uh simply request a new TLS
certificate for that website if people
know how TLS certificates are issued um
something like let's encrypt will send a
HTP request to the the the website of
the that's requesting the certificate uh
in this case the attackers can see this
request coming in over the network they
can then redirect the verification
request from leton Crypt for example to
their own server uh validate the request
and then get their own TLS certificate
issued for another website that data on
control whether an independent media
website or others um they're can take
this TLS certificate load it back into
the mar system that they have deployed
at the the mobile ISP and then
anytime uh a person they want to Target
is browsing the web and browses to this
website that they now have the TLs
certificate for they can simply uh man
the middle connection inject their own
uh code silly into the uh into the
connection and and then again redirect
people to the Predator infection server
and infect the device so this is really
quite uh scary and it shows how
companies like inexa are developing
tools and products that allows their
customers to subvert the very basics of
Trust on the internet either to subvert
the TLs ecosystem to subvert our mobile
device um Securities and really put um
many people at risk and as I said once
you have these kind of tools deployed
it's very easy to Target more and more
people uh and very difficult to to
detect um so that was how they try and
enable their customers to Target people
at isps uh but they also have a whole
Suite of what we call uh tactical
Network conjuction products so these are
designed for infecting and targeting
phones that are physically nearby to the
to the victim or to the to the operator
um one of the tools they can use for do
this is they have like a fake Wi-Fi
network or a fake MC catcher um that
will get nearby phones to connect to the
the Wi-Fi network once you're Target
once the target phold is connected to
the Wi-Fi network again they can wait
for the Target to make a HTP request to
make a regular unencrypted connection
then again they can redirect them to the
infection server infect the device um
this is particularly scary because you
can imagine um c c some government
operators deploying this for example at
a protest every phone that's uh nearby
at this protest connects to the m
catcher and eventually as they as they
browse they can get infected uh have
this spyware
installed we know um companies in the
intellex alliance provide U such systems
that are installed on drones for doing W
remote Wi-Fi interception they have MZ
catchers they have backpack based ones
they have even what they call like a spy
van that has all these physical Hardware
installed to again Target anybody nearby
and potentially infect them with with
with
Predator there's also one more um
particularly interesting product that we
uh see inexa offering from uh in their
product range and this is called
Triton uh and this is again a tactical
attack uh this time tarting the B band
of Samsung
devices um so this is very interesting
so this is maybe the one uh product that
we suspect or we we don't necessar know
if it's using oneclick attack or if it's
actually a full zero click exploit
targeting the phone itself uh but we do
know how it how it operates so the first
step of this attack is that the the
operator will use an M catcher to hook
uh the targets Samsung phone that's
again nearby once they've connected the
phone to the MZ catcher they then do a
downgrade attack where they move the
phone from 5G or 4G all the way down to
the Legacy 2G
network and then once the phone is is
talking over 2G they can use um a base
station or an SDR to somehow send uh the
malicious um payload to the phone which
then causes the phone to be
infected um so we don't know if this is
again a full a full payload but maybe
they were able to trick the phone into
somehow opening a malicious link orous
web page through the baseband and using
that to compromise the device um
unfortunately we we know what this
product looks like but we don't have the
full technical details to identify the
exact uh exploit techniques that they
have used so it's possible that this uh
attack against Samsung basebands is
still something that's un patched or
zeroed in the wild um I do think it's
just important to highlight this because
it shows that uh governments and also
mercenary surveillance companies are
beginning to use uh baseband exploits
and baseband attacks in the wild and in
practice
to um to Target people and en hack
devices so to um to wrap up I'd like to
put the what we've seen about intexas
products and the attacks against
individuals in the context of uh The
Wider ecosystem of surveillance
companies so with the pekas project we
saw how one company NSO had enabled
customers around the world to Target
thousands of people uh with SP including
heads of state uh and others um I think
it's important to say that you know this
is not a problem of one company it's not
one Israel company it's not anur group
but there's a whole ecosystem of
companies who
are um selling these kinds of products
and tools uh to enable attacks um by
governments around the world over the
last uh over the last year working with
uh Civil Society Partners such as such
as lab access now Frontline Defenders
and reporters about borders we continue
to find more more countries where these
uh tools are continued to be abused to
Target civil society and predictably you
know government critics and people who
are very much not legitimate
targets um if we look at inexa alone we
can see that from our own research and
investigations that inexa has targeted
or sorry inexa has uh customers in
approximately uh 15 countries uh around
the world uh including including Vietnam
so what I've shared earlier was just a
snapshot of one component of the attacks
from One customer of intell XA and we
already see that it's threatening many
um people in Civil Society at heads of
state here we see with one with one uh
company they have 15 different customers
all of whom could be targeting civil
society and putting people at
risk the almost total lack of a
accountability and transparency about
where these companies are selling their
tools and how these tools are being
operated makes it exceedingly difficult
for us to understand the full scope of
the problem almost certainly we're still
only seeing the very tip of the iceberg
uh and in the harms created by these
tools as we know inexa is a European
surveillance company but it's by far uh
not the only uh European company engaged
in this business we have companies such
as data flow security who develop
exploits sold to governments to help
compromise devices and potentially sold
to uh other uh surveillance vendors and
we also see other companies such as msum
or RCS or momento Labs uh in Spain
Italy um the cze Republic who are
developing end to-end products that they
can then sell to governments to allow
them to uh
compromise um their targets uh and we
still have no real visibility into how
these uh companies are being regulated
or how their tools are being
used I one of the reasons that we
continue to see um these har continue
undebated is that many of the states
that are responsible for enforcing uh
how these companies are regulated are
also customers of the same same
companies uh last year in Greece we saw
how uh dozens of people uh from Med
journalists uh and Senior politicians
were targeted with the Pegasus spyware
uh most likely um by the Greek
authorities um well this is also the
same authorities which on the other hand
are meant to be regulating inexa which
has a base in Greece uh and and they're
authorizing sales and exports of of the
inexa spyware to Sudan to rsf militia or
they're authorizing the sales to
Madagascar uh where uh these are to tend
being misused so I think this conflict
of interest shows how fundamentally um
we can't be we can't expect the states
who are relying and benefiting from the
kind of misuse and lack of capability of
the tools to also reain in and enforce
proper safeguards to prevent the harms
from these
tools so what to
do first as a as an enduser you can
enable uh various security features on
their device on your device such as lock
down mode which can make it much more
difficult for these tools to
successfully compromise your phone uh
you can also use uh always on vpns or
htps only mode to help protect your um
phones from Network injection attacks
and
similar
but also what can people in this room do
so one thing I would ask everyone here
is there's probably people here who who
work for export developers who work for
these companies I know there is uh and
so I'd ask you all to just don't work
for these companies I know
[Applause]
I these these companies cannot survive
without the talent of talented exploit
developers and researchers and I'm
sympathetic to the the technical
challenge of finding this flow going
through all the Hoops to exploit it but
if you want to do this work for a
defensive company work to help keep
people safe and don't help uh for-profit
companies who will sell uh these
invasive tools to whoever is the highest
[Applause]
bidder thank you very much for
listening
[Applause]
donka o Carol thank you very much for
that talk we have a little bit time for
one or two questions you want to line up
is there anything from the
internet uh yes from the internet there
are multiple
questions
um uh first one you mentioned the use of
acquiring TLS certificates by uh
intercepting traffic to a hosting
provider um do you have any comment on
the recent xmpp server interception in
incident
um so yeah I think it's it's interesting
to note with the the recent case where
um a German company maybe if was
compelled to either
Mississsippi we all rely on I think we
need more efforts to both um monitor
monitor this and have researchers trying
to document is this happening in the
wild is there surfix being
mississuaga
where able to obtain fraudulent TLS
certificates it would be registered
publicly by certificate transparency
have you looked at the public locks of
the websites you suspect to have been
affected um so in this case it's not
necessarily intexas acquiring the
certificates themselves but they're
providing a product to their government
customers who can then deploy in the
network and uh acquire these uh T
certificates um this is something we've
we started to look for um it is unless
we know what websites are being targeted
there's a big pool of of possible
candidates out there and so we would
like the any tips from from other
researchers who can maybe help us spot
either where Network injection attacks
have happened from uh https website uh
or have other tips on how to um find uh
how these uh attacks look like in the
wild and as you say these are uh logged
in a certificate transparency log so
there should be a public record to help
try and track down and prove that some
of these attacks have happened thanks
now micr one was the first please go
ahead hi um how hard is it to detect if
a if a device has be compromised and can
you get rid of the infection by computer
refesh refreshing the device can and can
you also infect desktop
systems sure um so in this talk I've
mostly focused on I focused on inexa and
their main product is for for mobile
devices um unfortunately there's always
an arms Ras between the attackers and
the governments using these tools and
the Defenders trying to find them so in
many cases uh you know people have
experienced doing this kind of forensic
research uh some Civil Society Partners
have the ability to use forensic tools
to to find and show traces that either
the attack was attempted if you find the
oneclick links or to prove the phone was
indeed compromised but unfortunately
it's it takes a lot of expertise and
it's experience and it's getting harder
all the time so it's it's important if
people are concerned about this and
their Civil Society to reach out to um
reputable experts who have experience
looking at this um um in terms of the
actual attacks themselves in many cases
we
believe um the attacks are in memory
they don't necessarily have persistence
even between reboots so sometimes just
rebooting the phone can be enough to um
clean the device but other times it may
be necessary to do a full kind of
factory reset of the device to clean out
any Persistence of the spyware it's
still still
there thanks thanks um unfortunately
we're running out of time I have to
disappoint for the really big cues all
at the microphones but I'm sure Dona
will be available for you after this
session here somewhere outside you can
continue your questions discussions
thanks a
[Applause]
[Music]
lot