So, hi everybody. I'm Julia. This is David. We're going to talk about backbain, simplify
consensus on Android forensics. And we are part of an organization that's called Observatory
on Existono. It's an Italian nonprofit that started running tournaments, mostly to our
ex-innotes, because we had legal troubles doing that as individuals. And so, we associated
those, have a bit more rights. And we are all volunteers at the moment. And we expanded
our original scope. And also, helping activists was being became also surveillance and doing
general research on surveillance tools and equipment from various users. And we started
in our clubs and in our organized spaces and those are still our communities and the people
we try to add and with whom we try to work with. And this is our tour data center. It's a beautiful
basement in Italy, so it's our headquarters. And let's talk about Spieber. So, when somebody
thinks Spieber and is not very deep into it, they generally think all the big scandals set up
and through Europe and not only Europe, they might think of Pegasus, of an esogrup, of predator,
and of other many Israeli companies. So, the point is that in the last five years, a lot of companies
have started in Spain in Italy. And as exploit research hub and spyware development tabs,
mostly because of the good climate, nice food, tax cuts, and a lot of research in Italy wanted
to relocate somewhere that wasn't possibly cypress or Israel. And Barcelona is one of the main places
as most people, I know. And Israel is still leading the exploit development, especially for
insects, like cyberite and similar, and they test on Palestinians all the time. That's also why it's
developed on their side. And mostly, your countries have had a spyware scandal at a point in time,
Italy had it recently, but we know about Greece. We know about Spain with a cattle and gated,
regret the Pegasus committee. We know about Serbia recently, we know about Bonan, Latvia,
if one search, they can probably find one, and it's very likely that the places they're
unlisted there, it's just that we don't know what they're doing. It's not like they're exempt from this.
And generally doing attribution of was infected boom for which reason is extremely difficult,
and the burden of the proof is almost always on the victims. And even if you can prove that there
was a spyware, finding out what will be sent it is extremely difficult. So, you can guess it stays
surveillance, but you just almost can never confirm it unless the other party confirm it,
which is kind of annoying because justice should work in a way that not everything should be on the
victims. And when we talk about spyware, I started from the leftmost column, and discussing about the
very famous, very sophisticated, very costly ones, including NSW group, Dataflow, which is an Italian
company. And mostly, when we think of this spyware, we think of zero click exploits or one click
exploits plus a little bit of social engineering to a view, a lot of previews, or a document,
or click a link. And generally, this highly sophisticated spyware have agents that run in memory,
maybe in kernel space, are live persistence. And so, they're really difficult to catch from user space,
unless you try to break or root your device. While there's a plethora of, let's say, less expensive,
less sophisticated spyware that are used all the time in so many more circumstances.
And, really, in the lack of sophistication and in the lack of the availability of very expensive
exploit chains, they've to use different tactics. And so, for instance, we've seen spyware,
bar, RCS, ornamental, the general use some type of social engineering for installation,
and then maybe they use either end-day bugs or non-bugs for previous collections, or for maybe
bypassing system prompts, or doing basic kind of basic attacks, so that they require some
social engineering, but also they have some technical sophistication to pass through that.
But, generally, this kind of spyware, are ready, more persistence on this, maybe they
start an application, maybe they become device admin, so they're a bit more catchable,
and they're still generally used, I guess, a significant amount of activities, journalists,
and this is then depending on the case. And then we have on the right-most columns,
the cheapest ones, where basically they just can be installed via social engineering,
and while this seems very unlikely, because we're all taking care of people, they are
totally very used, and they have a high degree of efficiency, because they can start,
especially if you're in a position of power, you can start by doing the basics,
social engineering, but then you can add extra tools. For instance, you can see the phone,
unlock it using a forensic tool like cyber, 10 instance spyware, and they return it to the victim.
And clearly, that doesn't require exploits on the spyware side, and clearly still has a high degree
of efficiency, that's what's been seen in Serbia and in other countries. And there's also
other things that we're going to talk about, where I discuss social engineering plus infrastructure
attacks that are very widely used in Italy to deploy spyware against activists. And there's also
a sub-genre of all these things that are spyware that don't employ any exploit, but they're still
widely used for gender violence, so for stocking purposes, for subvening employees, and these
tools are generally very cheap, like you can buy them. Maybe a while ago, you could still find
these tools on the Play Store, now you can't probably anymore unless special circumstances,
but they're still very widely available and used. And as we see, there's been
evidence of cyber use to unlock phones, and then it's a spyware. This is from another Italian
collective that's been tracking spyware locus spyware infection via social engineering,
and what they found out is that what happens in Italy at the social engineering,
plus infrastructure level, is the victim. We'll have a service that they need cut off,
so for instance, the data on their sim, or their phone calls don't work anymore. And then
basically what they can do is they can only call the support number of the RSP. The RSP will have
a social engineering agent, who knows, who that is, and then they will basically say,
you need to install these special support app so that you can get your data traffic back.
And that works very well, because you need the service, and like the only way to get back
your services to start the spyware, and that will guide you through a design, the play product,
like all the security features, like it's an alpha-nour, or social engineering support code,
that they do, and people install the spyware, and it works. And it's also extremely cheap,
because the cost per license of the staff can be as well as a standard per day per user.
And so, where we've focused on consensual forensic on mobile. It's because, well, on desktop,
we have focused for a long time on trying to do live detection of malware. Actually,
we cannot really look system calls, or we can really, I'm privileged and caught threats, like
data, Ily privileged level. And so, from user space, we are very limited of the things we can do,
and obviously there's good reason for that. And so, most civil society has worked into two branches,
to catch this kind of threats. One is the forensic methodology, which we're going to talk about,
and the other is network-based detection from Pirog to Sweet, where basically you have
at least a false name and some other network you see.
Yeah, it says,
get a signal.
Maybe I can...
Instagram, and I don't even published an Instagram account.
as the painting
let's go
I think that's what this one is supposed to.
It's like a cell delay in the mouse.
It's a cell delay in the mouse.
This is what I would like to ask you.
Okay.
I'll wait.
Let's take a look.
No.
That's all.
Thank you.
No.
I don't know what's going on here.
No.
I don't like it.
Okay.
Sorry for the introduction.
And so, as I was saying, we've been focused on forensic methodology
and network-based detection,
but they have shortcomings,
especially at the moment,
where basically you can almost only catch
on the known spyware, like cause you need to have a ready-day
OCS or not the OCS names or as some indicators,
you know, like something has happened.
And there's a bit of research of running,
starting and dynamic analysis on the phone itself,
but like that's very battery consuming, it's pretty difficult to do.
So there's a lot of complexity if you want to have something
that respects the privacy of the user, doesn't do data collection,
does it do data correlation,
but also you want to catch things,
but then you're limited only to non-stuff.
And as I was saying before,
what we were going to focus is the threads that I've sorted,
I've used it, have apps because we can't really catch
from user space or it's extremely difficult to catch
from user space, they're very sophisticated threads.
And it's also not like our target users,
just because we know that there's so many of the lower
sophistication threads just affects a lot of people
and generally they have also less assistance for civil society.
And so what we're going to focus on is consensual
forensic methodology.
And what happens at the moment when an activist or a journalist
is suspected to have been infected,
is that they have to look for a civil society organization
that's likely going to help them,
it depends on the case and on their organization,
and also on geography, but these are so many issues.
Because the first thing is that if the person who has the
infection is in contact with the nation,
they likely either need to have somebody come to them,
and some come online tools, do some manual analysis,
check the results and like explain them what's happening,
or there's to be guided to this process through a
multiple part, which is again pretty difficult,
or the victim has actually to ship their device,
to one of these support organizations,
which again is border someplace,
you basically send somebody or your data via post,
like there's a bunch of complexities.
And obviously we are great for all the organization
we've been doing this at this point at this moment.
And we also do this in Italy for people when you don't
have a fact, but it's something that's really difficult
to scale just because you need a person,
to provide the support.
And some of these are volunteer based,
some employees volunteer and employees,
we are all volunteer so it's a bit complicated.
So we have seen a consensus,
forensic methodology, but what to do you use
if you're at a technician and want to analyze a phone
that you think it is infected by spyware
and there is a spyware abuse.
So MVT is the factors standard tool for consensus mode
that mobile forensic, it was developed by
Amnesty Tech Lab that is one of the civil society
organization that performed this type of analysis.
And it was developed in 2021
in the context of the Pegasus project investigation.
And if you don't know,
the Pegasus investigation was a spyware scandal
that targeted the Catalan government
and all the members of the Catalan government
were like surveilled with the Pegasus spyware
and these sparked a lot of problems
in all of Europe because of these.
And the MVT tool, it is developed in Python as a command line tool
so it is not really usable for and user.
You need to know what you are doing.
It's difficult to install.
You have to do like pee,
etc. but for the end user,
it's not really a common thing.
And also interpreting the results
requires some technical expertise
that are a lot of scary warning
that a user like maybe don't understand.
And so you need a technical person
to run this type of tool.
And it works by connecting the target phone via USB
enabling the developer tool on the phone,
enabling ADB, Android bug bridge.
And then you can extract the relevant artifact
from the phone and analyze it on the PC.
But as I said,
it is really difficult to use for an end user
so Android QuF was developed
to make the acquisition process easier for the victims.
And Android QuF is more user-friendly than MVT
is basically returning along and distributed
as a single binary.
You can download it like a victim.
You can download it, run it on their PC
and then get an export that is basically MVT compatible
in a single click.
And these exports can then be shared
with our technical team.
And MVT is used to analyze it by like an expert.
This just streamline the acquisition process
but the analysis is still, let's say, difficult.
So we came up with an idea that is bugbing
and our goals were to first of all create
a friendly user-friendly tools that can be used by everyone
because these will improve the civil society
tracking intelligence by making analysis widespread.
So if more people that think they had
a spyware infection abuse,
they can analyze their phone
then we can catch abuse sooner.
And this kind of position can be
so actively scan with updated indicators of compromise
because you can acquire now,
keep the acquisition on the phone
and then scan later if new indicator of compromise
are published or released.
And another goal is to remain
for compatible with other open source tools
such as MVT and Android QF.
But mostly perform acquisition
and analysis locally on the target device.
It's our main goal.
How can we do it by using wireless USB
debugging?
And basically it works like USB
but the TCP via Wi-Fi.
And basically you need to enable
this option in the development tools
and pair the D-Mon and the app
with the pairing code or QR code.
It is available since Android 11,
these features so we are only targeting
let's say newer devices.
And it grants the same privileges as MVT
and so this is a good news
because we can do acquisition
that are one to one the same as MVT.
And ironically, this is the same mechanism
that low-end spyware use to escalate their privileges.
So they automate this part to obtain
the pairing with the D-B process
and then obtain higher privileges on the phone.
So this is a little schema of bug vein
on the left on the right.
We can see the artifacts that gets collected.
So SMS, it's a big thing
because most of the entry points
for low-end spyware are SMS.
You get an SMS saying, yeah, please don't load this application
to get your internet connection back
and a lot of URLs are IOCs for infection.
Another interesting part is that IOCs are updated.
Let's say every day there is a check
if there are new IOCs if you don't load it into use.
And another thing is that the user is reported
with some warnings and based on the warning level,
the user can decide to encrypt their acquisition
and share it with organization
that can analyze it further
and understand if there was indeed a spyware or spyware abuse.
Or otherwise, if there are no big warnings
they can just encrypt the acquisition
and scan it in the next IOC update.
And here are some screenshots
of the beta version that we are starting to release.
Here is an example acquisition
that runs some modules to acquire artifacts.
Then in the center there is an example
of an acquisition details with some findings.
Here are two scan of the same acquisition
and then in the last one we have the detail
of what are the warnings in that specific scan.
What are the limitations of this approach?
The first one is that can only catch known threats
as we have saved before.
And techtactors can also scrape public IOCs
and update their obfuscation
to make it harder for this tool
to detect such spyware.
And also another big thing is that
we are using artifacts on the device
to add evidence in case of seizures.
So maybe you have a lot of acquisition
that you performed on your device
that you want to keep to scan later
but if your phone gets seized
and then they use subbright for example
to unlock it then they can get
all this kind of evidence from the past.
What it is currently on the developed
in our application we want to secure
the app by encrypting the local data
so the local acquisition so it is encrypted
and not available at a later time
for people outside of the user itself.
We are building and are reproducible builds
infrastructure and we plan to release the app
also on f-droid so that the source code
is public and everybody can vet the source code
and see that the app that is downloaded is really safe.
And we want to improve all
so false positive detection and prevention
that is a problem with the MVT
because technical people can just
check out what are the false positive
and exclude them.
Instead if you are target
the end user you need to be able to provide
like less false positive
as possible otherwise the user will simply just
be scared by all your warnings.
And finally as I said UX because it is important
for the end user to ever
easy to use application.
So clearly everything is open source
you can find a blog post on our website about this.
It is not released yet we will soon
we are thankful to all the people who helped
to Rowan and also to all the previous projects
who provided like the foundation to start building
is to see the service service service organization
that is an organization
of organization and all the
civil society groups tend to share
threat intelligence.
And we didn't talk about closet source
source tools, there are a few
and that is some purpose because most of
these tools do some kind of full pack
data collection and then run
and maybe machine learning algorithms
on their servers but the first need to collect
the logs and all that kind of stuff
where we are trying to focus on
local clear practices to
respect the user choices so nothing
from the application gets shared unless
the user explicitly go through
a flow to share that information
and to end encrypted it doesn't come to us.
And so that was it.
We are happy for questions.
There are more pointers.
Thank you.
Just say that this project was only
in my work that is existing
all the advice as an application.
So in theory, like that's the easiest to
catch.
Sorry.
The question is does the application only
try to detect malware that is installed
as an application?
The answer is not necessary.
In the sense that that's the easiest to catch
because it leaves the most traces and then we can
from the application in theory you can
not extract the application and then
as to share those.
But with the fact that we collect the log
cut and the back report,
if there's wheel crashes and we have
you see it for the wheel crashes,
then we can basically say well there's
wheel crashes on your back report that's
the easiest and the same goes for SMS.
Like if you received an URL,
there was one of the known ones.
So the question is about, for instance,
Java card applets.
So these are regretted as if you open
us an issue, then we look if we can find
this information from adb and we will add
the model to do that.
Because you've got this all the time.
Yeah.
But all the forms are due to this,
but very low integrated
with the communication problems.
And it's true.
Yeah.
Oh, yes.
Oh.
Yeah.
Well, a bit to chat afterwards and we see
we can build a model to do that.
It really depends on what we can do from adb.
We can't, like some stuff is documentited.
Like you can do adb commands to finance
certain things other stuff just like finding
application to their device had means have
commands to their know document.
So if you spend some time you can find a way
to detect it.
So maybe there's a way to also detect it.
This is the, by now, yes, the last one is up in the configuration of the operator 7, or 8, and the one that's the one that's the one that's up, and to be a vector of infection, you know the basis, you know the basis,
if there are changes on the device setting, yes, that's an artifact that we gather.
If, for example, malware just leaving memory and replace, for example, the X, Java class classes for another process, for example, like it's targeting WhatsApp and then changes the code for WhatsApp,
then we are not going to be able to detect that with normal artifacts, but that's not like the our target, like our target is just low-end spyware that is not so sophisticated because we don't have like the privileges to dump and catch that.