This malware gang plants incriminating evidence on PCs, gets victims arrested For the past decade, unidentified miscreants have been planting incriminating evidence on the devices of human-rights advocates, lawyers, and academics in India seemingly to get them arrested. That's according to SentinelOne, which has named the crew ModifiedElephant and described the group's techniques and targets since 2012 …
Explain your way out of this...
"Wilson's phone was also found to have NSO Group's Pegasus spyware on it."
But... But... But... We only supply to "nice" government agencies.
Scumbag company deserve to be wiped off the face of the Earth... But of course, to many friends in the west.
This is a commercial company caught in the act. But they have been working for/with/on behalf of governments all over the world. Yes, it would be nice to eliminate such a "scumbag company".
Now think of the resources a secret service agency has at its disposal. Some leaks already exposed the enormous length these agencies will go to do whatever (il)legal they see fit. It is more likely that these official government backed agencies are much worse than what we've seen from NSO so far. Would it not follow that "government secret service agencies" deserve to be wiped off the face of the Earth? Just a thought...
Would it not follow that "government secret service agencies" deserve to be wiped off the face of the Earth?
That would depend who they target and who they allow to be harmed in pursuit of legitimate national defence. If they do more harm than good then they are in need of a leadership and cultural change. A rogue security service whose actions reflect badly on a government by harming their own population should be brought to heel, although we all know of governments who can't control their agencies and of governments who don't care what happens to the people they claim to serve. For them, the revolution can't come soon enough...
Oh boo hoo, let's get our pants in a bunch because those evil Israelis are supplying surveillance tools.
Israel and India are long term allies, with more than just Pegasus being traded between the two countries.
Stop being so naive. There is a lot, lot worse in the world than an Israeli tech company.
This post has been deleted by its author
> Would it not follow that "government secret service agencies" deserve to be wiped off the face of the Earth?
Impossible. Even in the Stone Ages some of the chieftain's buddies were going around listening for important stuff their boss needed to know. Spies and secret polices have been around since forever, secret services are, like defense/security (army, police), foundations of a structured society as they (are supposed to) alert of potential dangers.
Of course they can be incompetent, self-serving, overreaching, completely disconnected from reality, or even all of this at the same time, but you won't get rid of them because even if the government dissolves its secret services, it will soon create new ones in the hope of staying on top of perceived, real or imaginary threats: There are so many things that go bump in the night...
Modi is an evil thug. We knew this.
I like to think that in countries with a freer media, such tactics wouldn't fly - they'd be exposed in fairly short order, and honest judges would not only throw out the evidence but also instigate an inquiry into where it came from. But somehow I'm less sure about that now than I would have been six years ago.
Populist governments do like to attack their own justice system, if they're not able to replace the judges with their own placemen.
Why is it that 'populist' always seems to equate with authoritarian and repressive? Perhaps people who vote for politicians who promise simplistic, short-sighted solutions to complex long-term problems are kept happy just as long as they see people whom they don't like have their rights and recourses restricted slightly more than their own rights and recourses are curtailed.
"Why is it that 'populist' always seems to equate with authoritarian and repressive?"
Because "populist" is fundamentally flawed concept. The basic idea is to do what the people want, which sounds nice, except that "what the people want" is not something that actually exists. "The people", being literally everyone, want all of the things at the same time, including things that are in direct contradiction to each other. That's why we have politics to begin with.
You can hide this problem with smoke and mirrors while you're not in power: promise everything to everyone, and if someone calls you on it, just claim they're a filthy elitist in the service of entrenched power.
When populism is in power, however, it quickly finds itself exposed. It cannot please all of "the people" at the same time. It has to make compromises. For anyone but a populist party, that's just how it works. For a populist party, that's basically rejecting the entire basic philosophy, so you immediately enter a crisis.
So you now have a party that is in power and in a crisis, while suddenly missing any ideological basis at all, except for a vague feeling of hostility towards the institutional architecture of the nation. Not a good premise at all.
For a populist party, that's basically rejecting the entire basic philosophy, so you immediately enter a crisis.
No, that is when the populist party shifts from blaming "the establishment" and easy target groups to blaming everyone else for its failings, including its own following. From there on you will enter a repressive system because the "people" do not want to get blamed and need to be suppressed.
"The people", being literally everyone
I don't think that populist governments do listen to everyone, or even pretend to, which is why they just do what they want to do regardless. Populism isn't about numbers of people but about who shouts the loudest, about who dominates the argument rather than about who speaks the most sense. It's appeasement of the mob, except these days the mob is defined by who gets the most airtime rather than who occupies the most streets. In fact it gets uncomfortably close to rule by media baron.
Talking of which, I see that dear Rupert has been let out of the doghouse. Now he can once more speak directly to his editors rather than merely issue a tweet each morning and wait for the high priests to interpret his delphic 280 characters.
This post has been deleted by its author
I like to think that in countries with a freer media, such tactics wouldn't fly - they'd be exposed in fairly short order, and honest judges would not only throw out the evidence but also instigate an inquiry into where it came from.
Nope. I know of a CP case in the UK where after a break-in (where apparently nothing was stolen which should have been a hint) the office computer had an iTunes backup added of a phone not in possession of any of the companies' members or the owner.
Then the police got a CP tipoff, collected the computer (but somehow left some 100 SD cards present in that office fully alone) and an "expert*" "found" one image (yes, one) that was allegedly transmitted to the owner's wife phone despite having never been received there and presto, the owner was done for CP possession and immediately lost his livelihood and the ability to see his own kids unattended.
You see, getting CP case statistics up is more important than ruining someone's life. That's also why Apple was never contacted despite having facilities for this: for God's sake, let's avoid any exculpatory evidence that may create even more reasonable doubt.
THAT is the UK justice system for you.
Here's a hot tip for your friends and family: properly password protect computers, even shared office ones. Your livelihood and life may depend on it.
* I have dealt with these so-called certified experts and trust me, some should not even be allowed near a computer, let alone one near one in evidence. They barely know how to use Windows, they just had some training using "forensic" software that in my opinion doesn't deserve the name, let alone should be used for evidence gathering.
That's bad, but it's a different thing. I remember several outbreaks of CP hysteria, and sometimes it seems like the press's bloodlust needs to be sated. I can see weak police chiefs yielding to that pressure in the sort of way you describe.
But it's not the same as concerted attacks on the regime's political opponents. The main difference being, political opponents have a network of friends and supporters. After two or three incidents to members of the same network, the remainder would start getting a bit curious.
For a number of years, I have had raised eyebrows at the number of activists in Western countries who get arrested on child porn charges.
It has been known for decades that the US government is the world's largest pusher of child porn - in various sting attempts; it is just one small step from posting it in online forums for real pervs to download - to planting it on the PCs/phones of people you don't like.
I've wondered about this one.
I'd hate to forced into a conversation with the cops/TLA agency etc about nasties which "someone else" may have installed on my phone or PC. Best outcome would be a trial where your name gets dragged through the mud at great expense, worst outcome of course could be a conviction with imprisonment.
This has been going on for a very long time all over the world. In the 1990s the local police would end up getting a poorly worded fax from someone claiming to be police in a former soviet country who had busted a bunch of bad people links to a local suspect involving various crimes like money laundering and kiddy porn.
Kiddy porn is used as the "no trespassing, trespassers will be shot" sign on the deep dark internet. I suspect that any group using it can bribe their way out of local charges and it does keep the fortune 500 security people away.
Two decades ago when I worked security for an often hacked large international company, we had a room for investigators to visit some web pages. It had a video camera recording what was going on and it had to have two people in there. It had its own internet link, a large stack of hard drives, a large stack of evidence bags to put them in.
I've always been a strong opponent of anti-kiddie porn measures, not because I'm into that sort of thing but because of the implications for individual freedom. Kiddie porn shot to prominence a decade or two ago despite it being something I and everyone I know had never heard of it. Suddenly it was a great menace that warranted all sorts of intrusive investigation methods, cross border investigations and ultimately an entire infrastructure devoted to its suppression. On the surface this might seem reasonable, it sounds super nasty, but the fact that the definition crept to include wholly artificial images suggested something was very wrong. But everyone went along with the program -- after all, its nasty.
If you take a step back and look at the long view, though, the landscape looks very different. What has been achieved was the outlawing of a whole class of information and, furthermore, someone doesn't need to be aware of possessing that information to be guilty of a serious crime. This is not just ideal blackmail material but also if you can outlaw one class of information then you can outlaw any class of information. The investigation, detection and planting techniques are the same. "Obviously that would never happen", I hear you say, "it could never happen here, we have rights, the presumption of innocence and so on". In the light of experience I'd say, "Really?".
This post has been deleted by its author
Oh it does happen here. I have witnessed corruption like you would expect in Soviet Russia in the 60's being conducted in the Crown Court in Oxford not too long ago. Yes, it was on the rising tide of disgust at kiddie porn users and involves someone that I know quite well, someone who didn't know how to set up an email account at that time. Believe it or not, the CPS used Internet Exploder download logs as evidence to prove Uploading and got away with it, despite my protests to my friends lawyer. My evidence was not going to be accepted as relevant by his lawyer or the CPS, despite my having a BSc in Information Systems. It was obvious from the evidence provided that the owner of the device had logged in to an mobile phone account whilst waiting for the nasty video to download to that device. The owner of the device claimed to the police that her partner had downloaded the dodgy video. There was no evidence of uploading anything (which is the illegal activity) to anywhere by my friend or anyone else. He was still convicted and is not on the sex offenders register for uploading kiddie porn.
So don't get carried away thinking this sort of fucked up shit cannot happen here. It can and it does.
ALF
I've always been a strong opponent of anti-kiddie porn measures, not because I'm into that sort of thing but because of the implications for individual freedom.
No. There is no "individual freedom" argument for possession or creation of child sex abuse material, you sicko.
Kiddie porn shot to prominence a decade or two ago despite it being something I and everyone I know had never heard of it.
You must have led a blessed and sheltered life if you never heard of child pornography before a decade ago.
Suddenly it was a great menace that warranted all sorts of intrusive investigation methods, cross border investigations and ultimately an entire infrastructure devoted to its suppression.
And so it should. The world of child pornography's a disgusting, reprehensible cess pit.
On the surface this might seem reasonable, it sounds super nasty, but the fact that the definition crept to include wholly artificial images suggested something was very wrong. But everyone went along with the program -- after all, its nasty.
Ah right, here we go - this is what you were building up to: you don't like that "comic book" depictions of child sex abuse are illegal also?
If you take a step back and look at the long view, though, the landscape looks very different. What has been achieved was the outlawing of a whole class of information
If the "outlawing of a whole class of information" spared one single, solitary child from the trauma and horror of sexual abuse it was worth it.
"There is no "individual freedom" argument for possession or creation of child sex abuse material, you sicko."
(Not the OP.) You're the perfect illustration of why he's right: You don't even parse his sentence, you just register that he somehow doesn't share your blind hatred, so he has to be a disgusting pervert, doesn't he.
The issue is not CP, I think everybody here agrees it is sick and should be prevented. The issue discussed here are the potential false positives, accidental or malicious, and this clearly went way over your head.
Let's say I planted some incriminating evidence on your computer and gave the police an anonymous tip about this sicko (you). From your vehemence, I gather you will fully agree to be chemically castrated, imprisoned and ostracized from society, just in case it might spare a child? Be careful what you wish for...
You're the perfect illustration of why he's right: You don't even parse his sentence, you just register that he somehow doesn't share your blind hatred, so he has to be a disgusting pervert, doesn't he.
Really? I parsed his sentence just fine - he doesn't agree with controls on child sex abuse material because he believes that it's a freedom of choice issue for the individual. Which, of course, it's not - as sexually abusing children is a universal taboo.
His lack of a response (if you really aren't him) says enough for me...
The issue discussed here are the potential false positives, accidental or malicious, and this clearly went way over your head.
See above. The person I replied to was referring to controlling child sex abuse material in general. I'm well aware of what the article referred to, which seems to have gone over *your* head.
Let's say I planted some incriminating evidence on your computer and gave the police an anonymous tip about this sicko (you). From your vehemence, I gather you will fully agree to be chemically castrated, imprisoned and ostracized from society, just in case it might spare a child?
Letting your imagination run wild there, aren't you? I don't think you'd have the skills or the knowledge to pull it off AC, but if you did somehow manage it what makes you think that I wouldn't be able to disprove the allegation forensically?
Why would I "fully agree to be chemically castrated, imprisoned and ostracized from society" for something I hadn't done in *your* hypothetical situation? Y u knot raed gud? That's a moronic assumption, and you "gather" wrong.
> what makes you think that I wouldn't be able to disprove the allegation forensically?
Your attempt to give that evidence would be struck out unless you are a court-registered "Expert Witness".
See the example above from the Oxford Crown Court for how that works. I've seen it myself, too, in Cambridge.
Unless you have a spare probably mid-5-figures cash now on top of your legal fees, for said Expert Witness, you'd be done like a dinner.
Oh, and even if you DO have the spare extra cash, you can prep your official Expert all you like --hell, script him and give him pre-prepared exhibits to table-- theres absolutely nothing stopping him from just deciding to be staggeringly incompetent and unprofessional on the stand. I've seen one guy (in London IIRC) actually say the opposite of the actual expert evidence, then repeat a standard stereotype or two, and finish. Game over for the Defence in maybe 30 surreal seconds. Then there's the barristers...
You seem to be assuming an ideal world re legal processes. It's actually so borken (and actively parasitized) that it makes my stomach hurt.
"I don't think you'd have the skills or the knowledge to pull it off AC"
So, a pissing contest is all what you have to offer as counterargument? Blindly confident in our superiority, aren't we? This shows you're most likely an easy target.
But to get back to topic it doesn't really matter, even if you're indeed the only one with your l33t skillz, because everyone else is fair game, aren't they. My point still stands.
If that 'someone else' is your government, it amounts to entrapment and worse.
Once fake evidence is planted and an otherwise innocent person falls into the clutches of investigation agencies while being imprisoned without bail while the trial is underway, then all his human rights can be violated just on the basis on one PDF found on his laptop or phone.
We live in that world today.
I'd hate to forced into a conversation with the cops/TLA agency etc about nasties which "someone else" may have installed on my phone or PC
The exact reason why I do not like to let my phone out of my sight at customs in some countries, to the point of now carrying an almost bare unit that I can fully re-initialise the moment I get to my hotel. I do far too sensitive work to trust anyone not to get creative.
I thought this at the time that Paul Gadd was put though the mill. It turns out that he was probably guilty, but had I been his lawyer I would certainly have demanded that his accusers prove that the apparently incriminating evidence found on his computer hadn't actually been placed there by malevolent actors. Especially given that it wasn't discovered until he had voluntarily handed over said computer to a third party.
Guilty or not, I still love Rock and Roll (Part 2) as a piece of music, including (especially) the KLF's adaptation, not to mention the Oasis tribute.
-A.
No surprise, it's the digital version of planting some incriminating evidence in someone's house or pockets.
In that case, if the bastards work for the government, who in return controls tightly police and justice, the poor ones in jail have few hopes to be considered innocent.
Let's hope that the exposure of this hideous behaviour will create enough scandal internationally to give the jailed ones a chance to end the nightmare they were forced into.
A UK senior policeman was famed for his crime busting successes. One day he charged a demonstrator with a serious offence - whereby the evidence was a half-brick that was supposedly found in the man's pocket. His defence had the wit to get his clothes' pockets forensically examined - and not a speck of brick in them.
The policeman was eventually found to have been planting evidence for years.
It seems to be institutional in presumption of guilt. A policeman was once telling me a story about a man they had arrested. They couldn't charge him because he hadn't broken the law they expected. The officer concluded the story by saying "We'll get him next time!".
Absolutely. Hiding extensions is super dumb and is one of the first things I turn off with any Windows installation.
Also: rar? seriously? I get rar files sent to me from China all the time, but then for some weird reason they get a free version of WinRAR. I really don't get why they don't just use zip anyway though. Also: I get that 7z has very slightly better compression, but for the sake of compatability, that doesn't matter a damn for the sake of a few percent what with download speeds these days. </rant>
No, 7zip does not have "much" better compression. It has slightly better compression in real-world scenarios. And it may be freely available, but like it or not, it's not just there already.
The question I have to answer is whether my client/brother/grandmother/neighbour's dog will be able to open the compressed thing I send them. If it's a ZIP, then the answer is always "yes", regardless of the OS. If it's anything else, then the answer will be "possibly not". Betamax was technically a better format than VHS. There are far better ways to have done digital radio than DAB. USB-A is stupid. What do they have in common? They somehow became the "thing people use". Whether you like it or not, ZIP is universal. As yet, nothing else is.
I will continue to use ZIP until I know for certain that everyone I send stuff to will be able to open something else effortlessly. Sure, feel free to geek-out about 7z being a fantastic format, use it for your server logs, use it for your pr0n stash, use it to impress your friends, but don't expect every non-geek to know what the fsck to do when they get a 7z file.
As an aside, I do actually have a rotary telephone.
They use .rar and .7z because even old anti-virus software will routinely check the contents of .zip files in emails.
I'd hope modern anti-virus could handle .rar and .7z now, but anyone who keeps their anti-virus up to date is probably not going to fall for the scam in the first place, why bother improving the technique?
It's the same reason it's good to have poor grammar and spelling in the emails - it self-selects for people who don't care enough.
"They use .rar and .7z because even old anti-virus software will routinely check the contents of .zip files in emails."
Most if not all(?) reasonably recent AV software has support for both formats. RAR has been supported for quite a long time now.
The malicious RAR/7-Zip archives are typically encrypted with the password and even instructions in the message. Encrypted archives cannot be AV scanned. But unlike ZIP, an encrypted RAR/7-Zip also encrypts the file list as well, so the AV cannot quarantine the archive due to file names.
Depending on the E-Mail AV settings, archive attachments that cannot be scanned due to encryption, or because they have too many times nested archives (zip inside zip inside zip...) can (and should) be quarantined/dropped.
Wouldnt it be hilarious if NSO turned around and said "After reviewing the Logs, we can see that this file was planted by a malicious Actor, and this person is innocent."
The government agency applied "official" tracking software, proving that the government "likely approved" black ops program was behind the fake incriminating data.
Since it's been proven that Pegasus was on the phone, can they request all the data from the government in order to prove they did not upload the pdf?
"There's something to be said about how mundane the mechanisms of this operation are ... The malware is either custom garbage or commodity garbage."
I've often wondered if the cybersecurity industry is too focused on sophisticated methods of attack/defence and ignoring reality. High-tech is definitely a thing in relation to inter-state skullduggery, but most of the time it's more a matter of miscreants having the will to screw average people over - and they'll use the minimum sophistication necessary to get the job done (why invest in high tech rifles when a bow and arrow will suffice?).
Poul Anderson in the late 60s wrote a story, High Crusade. It relates in flashback fashion how a minor English lord preparing to leave for the Holy Lands runs headlong into alien invaders. and in the end England has a Galactic empire. As noted a rock can kill and a bomb just a rock is more efficient.
An after thought 'The Reign of Terror' was a populist action which resulted in a lot of bad story plots and cinema and not to say a government designed not to be efficient.
This post has been deleted by its author
This whole thing makes me feel sick. I was once, only once, sexually abused as a child (very minor abuse, over very quickly and never repeated). The thought that someone might place child pornography on an innocent person's computer is just horrible.
(No up or down votes please, this is too awful.)
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
