The million-dollar reporter How attackers hijacked the phone of Meduza co-founder Galina Timchenko, making her the first Russian journalist to be infected with Pegasus spyware
Een korte inleiding:
Pegasus is de geavanceerde spyware van het Israëlische bedrijf NSO Group. Zij misbruiken kwetsbaarheden in software; de zogeheten zero days (bij het publiek onbekende, grootschalige lekken in software).
NSO Group koopt deze kwetsbaarheden in op de grijze markt, al dan niet met of zonder werkende exploit. Dit is een markt waarin miljoenen omgaan; veel meer dan een bug bounty programma kan bieden. Vervolgens verkoopt NSO Group hun product dat deze kwetsbaarheden op een eenvoudige manier uitbuit, Pegasus aan allerlei actoren. In feite is NGO Group dus een soort
arms dealer.
Dit werd ook ingezet op journalisten en dissidenten, waarbij het opmerkelijk is wanneer dat geval is bij natie actoren die er gebrekkige democratische normen en waarden op na houden. Welkom in de 21e eeuw.
Earlier this summer, Meduza learned that the iPhone of our co-founder and publisher, Galina Timchenko, was infected with Pegasus mere hours before she joined a private conference in Berlin attended by colleagues in the exiled Russian independent media. This is the first confirmed case of a Pegasus attack against a Russian journalist.
NB: Meduza opereert momenteel vanuit Riga, Letland.
ith help from experts at Access Now and Citizen Lab, Meduza reports what we know about this notorious spyware, how it’s been used in Europe, and which states might have spent millions of dollars to hijack Ms. Timchenko’s phone.
Het Canadese Citizen Lab is een bekende naam in deze wereld; zij hebben vaker journalisten en dissidenten geholpen bij het detecteren van malware/spyware, waaronder ook Pegasus.
Het volgende kader vind ik nog even belangrijk om te vermelden:
Readers, please be aware of a possible conflict of interest in this report, which focuses on Meduza co-founder and publisher Galina Timchenko. She was not involved in the preparation of this article.
Dus hoewel het artikel is gepubliceerd op Meduza.io en door Meduza heeft de co-founder er geen invloed op gehad.
Toch lijkt in dit geval het Apple te zijn die de poppen aan het dansen heeft gebracht:
A day earlier, Timchenko had received a curious text message from Apple and forwarded it to Meduza’s tech division. The message was one of Apple’s “threat notifications” about “state-sponsored attackers” — something the company sends to users who are “individually targeted because of who they are or what they do.” “State-sponsored attacks are highly complex, cost millions of dollars to develop, and often have a short shelf life,” Apple explains on its website.
Gebruikers van Apple OSen (macOS, iOS, ...) kennen dit wel van de 'lockdown mode'.
Meme inc:
In eerste instantie zei dit Timchenko niets:
She says she put the message out of her mind after sharing it with Meduza’s technical team. Galina Timchenko has grown accustomed to such warnings. The Russian authorities have tried to hack or destroy her newsroom’s infrastructure for years. Meduza has weathered denial-of-service attacks and countless phishing attempts. Russia’s federal censor now even blocks the website outright.
Vervolgens heeft Alexey (hoofd technische divisie Meduza) de boel fysiek weggenomen, en heeft hij haar uitgelegd hoe de vork in de steel zit.
Daarna zijn ze hulp gaan zoeken:
To understand what Apple’s message didn’t explain, Meduza’s technical director turned to outside help to find out who these hackers were. First, he contacted human rights activists at Access Now, a nonprofit organization committed to “defending and extending” the digital civil rights of people worldwide and helping improve digital security practices. Access Now has also alerted the public to the collateral damage of tech sanctions on civil rights activists, journalists, and dissidents from authoritarian countries, highlighting how targeted sanctions, mass corporate pullouts, and over-compliance in Russia have helped the Kremlin to silence its critics.
..en natuurlijk bij eerdergenoemde Citizen Lab.
Om een lang verhaal kort te maken:
[...] her smartphone was infected with the spyware Pegasus on February 10, 2023.
Met als gevolg:
This gave the hackers total access to Timchenko’s iPhone: its microphone, cameras, and memory. The attackers could see the device’s entire contents, including Timchenko’s home address, her scheduled meetings, her photographs, and even her correspondence in encrypted instant messengers. Pegasus lets you see a device’s screen directly, reading messages as they are written. It lets you download every email, text, image, and file.
Vervolgens krijg je wat voorbeelden te lezen waarbij NSO Group aan 'de verkeerden' heeft geleverd. Het voorbeeld van Washington Post columnist Jamal Khashoggi in 2018 is een bekende welke ongetwijfeld ook de front page heeft gehaald.
NSO Group gebruikt het bekende excuus 'als wij het niet doen, dan doet iemand anders het wel'.
Een (oud) argument dat wel vaker wordt gebruikt in dit grijze circuit.
(Ik zal een analogie van mijn hand buiten beschouwing laten ...
)
Speaking to The Washington Post in July 2021, NSO Group co-founder Omri Lavie said attacks on journalists by his clients are “horrible,” but he argued that the main problem is a lack of regulation. “This is the price of doing business,” he explained. “Somebody has to do the dirty work.”
Toen kwam de Biden administration met een (onverwacht) antwoord:
A kind of regulation arrived in November 2021, albeit not what Omri Lavie and his colleagues wanted. Months after an investigation by the Pegasus Project consortium exposed the spyware’s rampant, global abuse, the Biden administration added NSO Group to a federal blacklist that bans the company from receiving American technologies. NSO spokespeople expressed “dismay” and said the firm would lobby to reverse the White House’s decision.
Ja, en nu wordt het iets duisterder...
Meduza editor-in-chief Ivan Kolpakov, who was traveling then, joined the meeting by teleconference. He was visibly at a loss and kept listing aloud what could have leaked: corporate passwords and correspondence, bank account balances, the names of Meduza staff, and — most dangerously — the identities of Meduza’s collaborators inside Russia.
It was soon clear, however, that it was impossible to assess what had been compromised. “They got everything,” Kolpakov recalls. “Everything they wanted.”
(Dikgedrukt door mij.)
Daar gaan je bronnen, de kroonjuwelen van iedere gerespecteerde journalist.
Eerst probeerde Timchenko er nog een beetje lacherig over te doen; uiteindelijk barstte ze in tranen uit.
Het is haar ook niet opgevallen, of althans ze heeft er niet naar gehandeld:
[...] Timchenko had no reason to suspect anything was amiss with her iPhone, except for moments when it seemed warmer than usual, which she attributed to her new charger.
Nog wat technische details over de misbruikte kwetsbaarheid:
Citizen Lab’s analysis shows attackers likely infiltrated Timchenko’s iPhone through HomeKit and iMessage. Senior researcher John Scott-Railton says his team found digital footprints unique to Pegasus. “No other spyware would have left this,” he told Meduza. Researchers believe Timchenko’s hackers used the so-called “PWNYOURHOME” vulnerability, which targets iPhones’ built-in HomeKit functionality and exploits iMessage to install the spyware. Scott-Railton says this hack is possible even on devices where HomeKit was never activated.
Citizen Lab collected “forensic artifacts” from Timchenko’s iPhone showing that the device was infected with Pegasus on February 10, 2023.
Dit alles kwamen ze achter
op de dag van Prigozhin's muiterij.
Dan nog een stukje over de eerste schade:
On February 11, one day after Pegasus hijacked Timchenko’s iPhone, she and Kolpakov joined other representatives of Russia’s exiled independent media in Berlin at a confidential seminar organized by the Redkollegia journalistic prize committee. Media managers and lawyers attended the private conference to discuss the legal aspects of operating in Russia under the conditions of total state censorship and the mass persecution of journalists and activists. Just two weeks earlier, Russia’s Prosecutor General formally outlawed Meduza’s reporting, designating the outlet an “undesirable organization.” Timchenko recalls that colleagues meeting in Germany expected the same thing would happen to them before long.
Pegasus was already running on Timchenko’s phone when she joined the meeting in Berlin. Whoever hacked the device could have used it as a wiretap, remotely activating the microphone to record anything said within earshot. The hackers might have turned on the camera just as easily. “They could have used Galina’s phone like a bug to listen in on what the Russian journalists were planning,” says Access Now’s Natalia Krapiva.
“My first thought was the Russian state and the Russian intelligence agencies, of course,” recalls Timchenko. “Who else cares about me?”
Er is ook goed nieuws: dit was voor zover bekend de eerste keer Pegasus mbt RU journalisten.
The attack against Galina Timchenko is the first confirmed case of Pegasus being used against a Russian journalist. Natalia Krapiva at Access Now confessed to Meduza that she’s actually somewhat comforted to see the spyware surface here because researchers have tested the phones of nearly two dozen journalists and activists from Russia and found all manner of malware but never Pegasus.
Daarna volgt stukje uitleg dat Pegasus enerzijds moeilijk is te detecteren, en anderzijds dat detectie vs stealth een kat en muisspel is. Plus voorbeelden.
Nou, goed, NSO heeft blijkbaar toch nog ergens een moreel kompas weten te vinden. Het danst namelijk naar de pijpen van de IL geopolitiek:
NSO Group says it sells its spyware only to vetted state agencies, but Israeli geopolitical interests often influence the company’s decision to work with particular partners. For these reasons, the firm reportedly refuses to use Pegasus against either American or Russian telephone numbers.
“Infected phones cannot even be physically located in the United States; if one does find itself within American borders, the Pegasus software is supposed to self-destruct,” the spyware’s designers said in 2020. A year earlier, when the Estonian government bought access to Pegasus, NSO Group informed its new client that using the spyware against Russian targets is prohibited.
En we weten allemaal hoe Israel in de oorlog in Oekraïne staat: "neutraal".
Dus...
Oekraïne mag Pegasus al helemaal niet hebben!Israel has also reportedly blocked Ukraine from acquiring Pegasus, fearing Moscow’s wrath. “According to people close to NSO and the Israeli government, they don’t approve such infections because it will disrupt relations with these countries,” says Natalia Krapiva.
(Dikgedrukt door mij.)
The company has also claimed that Russia and China are among the nations that will “never be customers,” citing internal due diligence that scrutinizes potential clients’ track records on human rights, corruption, safety, finance, and abuse. NSO Group chief executive Yaron Shohat told The Wall Street Journal in January 2023 that the firm was “committed to its core business of supplying governments around the world who are allies of the U.S. and Israel,” despite downsizing after losing clients because of the Biden administration’s measures.
Een redenering die dan een nieuwe policy moet zijn want voorheen deden ze dat wel gewoon leveren aan allerlei discutabele overheden.
Moscow possibly has its own reasons for refusing to do business with NSO Group. Investigative journalist Andrey Soldatov has argued that Russia’s intelligence community “is a seller, not a buyer,” on the world market for espionage technology.
Dat zou natuurlijk kunnen. Bijvoorbeeld dubbel verkopen, of werken voor GRU en het ook nog even aan NSO Group verkopen.
Gelukkig doet NSO Group wel aan post mortem, en handelen ze vervolgens bij abuse:
“Pegasus systems log every attack in case there is a complaint, and — with the client’s permission — NSO can perform an after-the-fact forensic analysis,” The New York Times reported in January 2022. Six months later, NSO Group general counsel and chief compliance officer Chaim Gelfand told a European Parliament committee that these internal investigations have led to the termination of contracts in eight cases.
Al liep dat op niets uit:
A year earlier, however, when The Washington Post reported forensic data indicating multiple Pegasus intrusion attempts against Jamal Khashoggi’s wife in the months before his murder, NSO Group’s chief executive said a “thorough check of the firm’s client records” revealed no evidence of Pegasus used against Khashoggi or his loved ones.
“After hundreds of victims, we have concluded that the internal review process either doesn’t exist or exists only for show,” says Natalia Krapiva at Access Now. “When a Human Rights Watch employee was infected, NSO responded to all the questions in just a few lines: ‘Thank you, we found nothing with our current customers. Goodbye.’ Of course, they said nothing about what their past clients could have done. It’s all gaslighting.”
Daarna volgt een stukje over de twee staten Kazakhstan en Azerbaijan. Het komt er op neer dat de infectie heeft plaatsgevonden in Duitsland (zie hierboven), en dat deze landen niet de (duurdere) service hebben voor targets buiten de landsgrenzen. Azerbaijan zou de software wel toepassen maar enkel in Armenië (deze landen zijn met elkaar in conflict over de regio Nagorno-Karabach).
In its study of Galina Timchenko’s phone infection, Access Now notes that either Kazakhstan or Azerbaijan — two suspected Pegasus clients — could have carried out the attack at Moscow’s request. (According to Access Now, Uzbekistan is not believed to have been a Pegasus customer during the period in question.) “There’s a provisional theory that Russia might have asked its partners,” says Krapiva. “Kazakhstan, for example, has already blocked Meduza twice without any requests.”
As far as researchers know, however, neither Kazakhstan nor Azerbaijan has ever executed a Pegasus attack in Europe, and Timchenko was in Germany when the infection occurred.
Moreover, evidence collected by Citizen Lab shows that Kazakhstan does not use Pegasus beyond its borders. Scott-Railton told Meduza that Azerbaijan does use the spyware abroad, but researchers have recorded these attacks in no other country except Armenia, which could explain how the phone numbers of Armenian human rights activists have been infected.
Natalia Krapiva says clients need a bonus package to use Pegasus beyond their borders: “We believe that different NSO customers can purchase different types of licenses. Some buy the rights to hack only within their country. Others buy the rights to infect a large number of countries. We still don’t understand a lot about these secret contracts, but infections outside a client’s state likely require special permission.”
Meduza heeft een artikel over deze kwestie:
Pegasus spyware in the Azerbaijan-Armenia conflict
Wie dan wel? Letland zelf?
Er is een motief:
Access Now also does not rule out that the Latvian intelligence community carried out the attack on Meduza’s co-founder. Just two months before Timchenko’s phone was infected, Latvia declared another Russian media organization in exile — TV Rain — to be “a threat to the national security and public order” and canceled its local broadcasting license. “Because of the invasion of Ukraine, there’s distrust of all Russians without exception,” says Natalia Krapiva. “If such surveillance is taking place, it’s very consistent with remarks by the president of the Czech Republic, Petr Pavel, who said intelligence agencies should place all Russians living in the West under ‘strict surveillance’ as the price of Russia’s war against Ukraine.”
..maar er is nog nooit een zaak geweest van Pegasus buiten Letlands grenzen:
However, experts at Citizen Lab have never observed Riga using Pegasus against targets outside Latvia’s borders, and Galina Timchenko was in Berlin when her phone was compromised. (Whom exactly Riga has infected with Pegasus remains unknown.)
Vervolgens stukje EU parlementariër Letland die ontkent dat Letland deze software op welke manier dan ook gebruikt. Vind ik niet zo boeiend. Ook het ontkennen van Letland's veiligheidsdienst kun je teruglezen in het artikel.
Litouwen dan?
While there’s no proof that Lithuania has used Pegasus, researchers have confirmed that the Estonian authorities bought access to the spyware in 2019. Citizen Lab has corroborated these findings. More importantly, says Scott-Railton, his team has tracked Estonia “infecting targets beyond its borders in many E.U. countries, including in Germany.”
Vervolgens Duitsland. Verhaaltje over BKA die het ontkennen of het hebben over een 'lite' versie:
[...]
[...] “special version that doesn’t violate privacy rights” — some kind of “Pegasus Lite.” But we’ve received no evidence of this, not even an idea of what a “lite” version might be.
De software zou zelfs illegaal zijn binnen de EU:
Also, the European Data Protection Supervisor concludes that Pegasus in any form is fundamentally incompatible with E.U. law.
En 11 EU landen hebben toegezegd het niet te gebruiken
“Why Germany isn’t interested in solving this is a mystery to me,” he told Meduza. “For example, why hasn’t Berlin signed the Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware? It’s been signed by 11 countries, including Denmark, France, and Sweden.”
(NB: Ik ben niet overtuigd
en overigens ben ik ook niet per definitie tegen het gebruik van deze tools door veiligheidsdiensten. Als het maar proportioneel is, en men het subsidiariteitsbeginsel in acht neemt. Het gegeven 'Russische journalist' is daarbij m.i. onvoldoende.)
Ook Nederland wordt terloops nog even genoemd:
Access Now points out that the four E.U. members that have become new centers of Russian anti-war emigration — Latvia, Estonia, Germany, and the Netherlands — are all suspected Pegasus users.
Vervolgens kun je e.e.a. deduceren:
In fact, the E.U. PEGA Committee revealed at least 14 E.U. states and 22 operators of Pegasus in the European Union, and only NSO Group’s contracts with Hungary and Poland are no more.
(Dikgedrukt door mij.)
Overigens zijn er nog 3 andere voorvallen bekend, deze wensen anoniem te blijven:
Access Now considers the attack on Galina Timchenko to be at least the fourth in a series of similar cases across Europe in the past year. (Meduza knows the details of these other attacks, but the victims have asked for privacy.)
Timchenko begrijpt niet waarom een Europeaanse dienst haar getarget zou hebben. Ze gaat niet zwijgen:
“I can’t reconstruct the logic of European intelligence agencies that might have installed Pegasus, and I don’t want to make assumptions,” says Galina Timchenko. “Moving forward, we’ll act in accordance with what our lawyers advise. I won’t be silent.”
(NB: Wederhoor vooralsnog onmogelijk.)
En hoe doet Timchenko het tegenwoordig? Nou, zo:
Today, Ms. Timchenko carries two phones: a new one she bought after the intrusion and the formerly infected gadget (Citizen Lab confirmed that Pegasus is no longer installed on the device). She says she decided to keep it as a souvenir. “There’s nothing on it except messages with my hairdresser and manicurist,” she says. “Let it be. It will remind me to keep looking over my shoulder.”
Oh handig heeft ze allebei bij zich, dubbele attack surface
maar dus inderdaad wel werk en privé gescheiden, en ze zegt niets over haar werktelefoon. Mooi aandenken.
NSO Group lobbyt er nog steeds vrolijk op los, strikt celebs voor investeringen, en is verzeild geraakt in allerlei rechtszaken waaronder eentje met Apple. Men heeft de malware bij geen enkele andere medewerker gevonden, en men begrijpt niet waarom men is getarget. Alexey maakt zich zorgen.
“Until I know the motive, I have to expect the worst,” says Alexey. “I deal with our security not just in a technical but in the broadest sense of the word: every day, I think through how they’re going to kill us and bring us down. Surveillance, harassment, threats — I’ve already considered all these scenarios and experienced them myself, in a sense. As for Pegasus, until we have more details, we can’t rule out that Russia could have ordered the infection and that this spying could have the most serious consequences, right up to somebody being eliminated.”
Toch is het volgens Timchenko business as usual:
Timchenko, meanwhile, says she hasn’t yet contemplated such consequences of being watched through Pegasus. “I already look back wherever I go and watch for anyone following me in a car. Meduza’s founders have always lived like this,” she says.
Klinkt strijdbaar. Vervolgens de nuchtere uitspraak:
“If they want to do it, they’ll do it.”
En
by hook or by crook zo is het, #6.
/u/217510/crop660db19c1cf7b_cropped.png?f=community)
), zie de KrakenSDR hierboven. Al heb je voor langere afstand andere antennes en meer vermogen nodig. Vervolgens ga je daar eens kijken met een drone voor visual en omdat je weet waar je moet kijken zie je het al op grote afstand. Intussen is de artillerie of de drone al geïnformeerd, daarna gaat het heel snel. Als je die recon drone ziet (ter bevestiging), dan is het al te laat. Daarentegen de range en mobiliteit van HIMARS hebben nog tot geen enkele casualty geleid; ook dit apparaat kan mobiel zijn maar de range van het storen is maar max 1 km. Onvergelijkbaar en m.i. dus kwetsbaar. Blijft over het mobiele voordeel.
:strip_icc():strip_exif()/u/113446/crop630a600660a6b_cropped.jpg?f=community)
:strip_icc():strip_exif()/u/93663/crop5e957aaad5bd2_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/23872/Y2.jpg?f=community)
/u/357965/avatar2.png?f=community){kind=avatar}
:strip_icc():strip_exif()/u/551203/crop59428e0611bc9_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/56758/falconlogo.jpg?f=community)
:strip_icc():strip_exif()/u/24088/felix.jpg?f=community)
:strip_icc():strip_exif()/u/84176/crop577a4401d15ce_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/78991/Image2.jpg?f=community)
/u/18075/crop5db023aa710a8_cropped.png?f=community)
:strip_icc():strip_exif()/u/109539/avatar_kerst_still.jpg?f=community){kind=avatar}
/u/324913/crop56a24cce05cd3_cropped.png?f=community)
/u/1906/crop5dfd46928e003.png?f=community)
:strip_icc():strip_exif()/u/106218/wc-backbone.jpg?f=community)
:strip_icc():strip_exif()/u/30300/crop649b06535e901_cropped.jpg?f=community)
:no_upscale():strip_icc():fill(white):strip_exif()/f/image/uCj5dVPB3aFOFYbnPmUaqSk3.jpg?f=user_large)
/u/820/crop5dc1821dada95_cropped.png?f=community)
:strip_icc():strip_exif()/u/170519/crop57517e4714513_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/253068/crop5943a47e0f940_cropped.jpeg?f=community)
/u/208006/Zagor%2520small.JPG?f=community)
:no_upscale():fill(white):strip_exif()/f/image/m53MzayHzkUJda1XcgslrzJW.webp?f=user_large)
/u/12038/crop5a51514a4dec1_cropped.png?f=community)
:strip_exif()/u/38542/Scrat1ani.gif?f=community)
:strip_exif()/u/406500/Minisculegifloopedcropped.gif?f=community)
:strip_icc():strip_exif()/u/81921/back_front_s_small.jpg?f=community)
/u/62205/crop5db2de62da599_cropped.png?f=community)
:strip_icc():strip_exif()/u/2060/crop5f441ab454be9_cropped.jpeg?f=community)
/u/46804/crop5f989efcbb253.png?f=community)
:strip_icc():strip_exif()/u/182627/crop5a0606b27e9d5_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/381770/yoda-dj_small.jpg?f=community)
:strip_icc():strip_exif()/u/159369/crop5ebeb5d6c0a24_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/178794/Iron_Maiden_klein.jpg?f=community)