6 ms·

The EU has quietly provided Morocco with powerful phone hacking systems [French]

48 points by c80e74f077 4y ago

rprime 4y ago
I am reading in the airport after leaving Morocco. A couple of days ago I received a weird spam SMS message (coming from an iCloud account) that i’ve never seen before. I didn’t open the messages as I know about Pegasus and my senses started to tingle. I guess it’s time to reset my phone.
c80e74f077 4y ago
DeepL Translation: According to documents obtained by Disclose and Der Spiegel from European institutions, the Swedish company MSAB has provided the Moroccan police with a software called XRY capable of unlocking all types of smartphones to extract data from calls, contacts, location, but also messages sent and received by SMS, WhatsApp and Signal. As for Oxygen forensic, domiciled in the United States, it has delivered a data extraction and analysis system called "Detective". What makes it special? Bypassing screen locks on mobile devices in order to extract information stored in the cloud (Google, Microsoft or Apple) or secure applications on any phone or computer. The notable difference with Pegasus software is that both software require physical access to the mobile device to be hacked, and do not allow remote monitoring.
- deleted 4y ago
  [deleted]
- jaclaz 4y ago
  Both XRY and Oxigen are AFAIK "common" and "established" forensics tools, unless the versions provided to Morocco are "special" there is nothing particularly "alarming" or "new/revolutionary", let alone "secret" about them, https://www.msab.com/ https://www.msab.com/ https://www.oxygen-forensic.com/en/ https://www.oxygen-forensic.com/en/ Some products may be reserved to Law Enforcement or Licensed investigators, but I believe that's all.
- curiousgal 4y ago
  So does that mean that all phone manufacturers are essentially selling snake oil when it comes to device security?
  - GekkePrutser 4y ago
    Kinda. But physical access is a big barrier. I am really surprised they don't do much against Pegasus though. I'm sure the agencies involved know what exploits it uses by now. I guess because western powers use these tools too is why they don't lock them out.
    - ccouzens 4y ago
      Peagasus is an evolving product. Probably the early versions are useless these days. https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_of_capabilities https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_... I wouldn't be surprised if it hasn't always been at full effectiveness on all platforms, as vulnerabilities are patched and others discovered.
  - jaclaz 4y ago
    Yes and no. The manufacturers do their best to protect the users, but when it comes to criminal investigations there are tools[0] that can often make access to smartphone (or computers) data possible. These tools are often prohibitively expensive and/or only licensed to LEO's (Law Enforcement Officers) and cannot unlock/access "everything", so there is no real "privacy risk" connected to them unless you are charged with a criminal offence and/or arrested. To give you an example there are cases where an iPhone can be unlocked by two (AFAIK) different tools, one is made by Cellebrite that charges an awful amount of money for each unlock, and the other is Graykey that wants as well a lot of money but you can buy the "unlimited" option: https://www.forensicfocus.com/forums/mobile-forensics/graykey/ https://www.forensicfocus.com/forums/mobile-forensics/grayke... both are only given to authorized investigators (Police/Government) only. Of course it is possible - in theory - that someone malicious manages to get their hands on one of them and then proceeds to steal the phone from you, and then can afford to spend anything between 3,000 and 10,000 US$ to unlock it and access your data, but I find it improbable. [0] until the manufacturer patches (if patchable) the vulnerability, and then the race starts to find a new one
- BiteCode_dev 4y ago
  Which is fair play. I fully expect authorities from any countries to try to get evidences from physical access to electronic devices in the case of criminal investigation. Just like they can go into ones house and open safes with a torch if a judge allows it. The problem is mass surveillance, not getting data about someone under arrest. Of course, I unfortunatly also fully expect them to abuse that and use it outside of criminal investigations, without the knowledge of said person.
  - Proven 4y ago
  - SnowHill9902 4y ago
    No, the problem is backdoors and misleading information.
    - BiteCode_dev 4y ago
      That as well. Apple may state that their enclave is secure, the existance of such tools and the fact they were part of PRISM hints that they are like all others: open to those with a lot of resources.
arminsergiony 4y ago
The primary distinction between Pegasus software and other software is that in order to hack a mobile device, the hacker must have direct, physical access to the device. Pegasus software does not provide remote surveillance.
peoplefromibiza 4y ago
Bit of clickbait title, from the article it's not clear at all what the news is, Morocco already has Pegasus (from Israel) that works remotely, these new software are much less powerful and require physical access to the device, but once you already have physical access, it's game over. Of course, even if the article make it sound like a scandal, exchange of anti-privacy software for catching human traffickers [1] is not announced in a worldwide press release, it would defeat its purpose [1] from the article Objective of this technology transfer financed from the budget of the EU's "border management program for the Maghreb region": to fight against irregular immigration and human trafficking at the gates of the EU.
Kukumber 4y ago
I'm not surprised, morocco is a source of migrants and drug problems, this cooperation to strengthen security at EU's border makes sense
- kabylehabyle 4y ago
  > source of migrants and drug problems Wow. Sounds like someone is on an agenda.
  - GekkePrutser 4y ago
    It's the only African country with a land border to the EU so there's a point. There was a major incident with almost 40 dead at one of these borders only months ago. I also don't like the framing of migrants and drugs in the same sentence as both issues are ethically very different. But both are driven by organized crime groups and the migrants are victims too. The traffickers take them for all they're worth. It's a problem that needs to be fought.
    - jaclaz 4y ago
      >It's the only African country with a land border to the EU so there's a point. By "land" you mean "only a few miles of sea", I believe. There are three spanish islets (exclaves): https://en.wikipedia.org/wiki/Enclave_and_exclave https://en.wikipedia.org/wiki/Enclave_and_exclave in Morocco, but they don't really count, even if inside Melilla, Ceuta or Peñón de Vélez de la Gomera https://en.wikipedia.org/wiki/Morocco%E2%80%93Spain_border https://en.wikipedia.org/wiki/Morocco%E2%80%93Spain_border you are on Spanish territory, you still need to cross the Gibraltar straight to get to Spain, they are among the few "special territories" of the EU: https://en.wikipedia.org/wiki/Special_member_state_territories_and_the_European_Union https://en.wikipedia.org/wiki/Special_member_state_territori...
      - GekkePrutser 4y ago
        I was talking about the enclaves yes. Why don't they count? They are regular targets for human trafficking and drug activity. Many people have died in trafficker-incited border incidents. https://en.wikipedia.org/wiki/2021_Morocco%E2%80%93Spain_border_incident https://en.wikipedia.org/wiki/2021_Morocco%E2%80%93Spain_bor... https://www.theguardian.com/world/2022/jun/26/calls-investigation-deaths-moroccan-spanish-border-melilla-enclave-crossing https://www.theguardian.com/world/2022/jun/26/calls-investig... I know they can't readily travel to Spain from there but I guess the idea is that they apply for refugee status once they're in. And they are part of the EU.
lordfoom 4y ago
Worth reading: https://en.wikipedia.org/wiki/Human_rights_in_Morocco https://en.wikipedia.org/wiki/Human_rights_in_Morocco

48 points by c80e74f077 4y ago

I am reading in the airport after leaving Morocco. A couple of days ago I received a weird spam SMS message (coming from an iCloud account) that i’ve never seen before. I didn’t open the messages as I know about Pegasus and my senses started to tingle. I guess it’s time to reset my phone.

c80e74f077 4y ago

DeepL Translation: According to documents obtained by Disclose and Der Spiegel from European institutions, the Swedish company MSAB has provided the Moroccan police with a software called XRY capable of unlocking all types of smartphones to extract data from calls, contacts, location, but also messages sent and received by SMS, WhatsApp and Signal. As for Oxygen forensic, domiciled in the United States, it has delivered a data extraction and analysis system called "Detective". What makes it special? Bypassing screen locks on mobile devices in order to extract information stored in the cloud (Google, Microsoft or Apple) or secure applications on any phone or computer. The notable difference with Pegasus software is that both software require physical access to the mobile device to be hacked, and do not allow remote monitoring.

deleted 4y ago
[deleted]
jaclaz 4y ago
Both XRY and Oxigen are AFAIK "common" and "established" forensics tools, unless the versions provided to Morocco are "special" there is nothing particularly "alarming" or "new/revolutionary", let alone "secret" about them, https://www.msab.com/ https://www.msab.com/ https://www.oxygen-forensic.com/en/ https://www.oxygen-forensic.com/en/ Some products may be reserved to Law Enforcement or Licensed investigators, but I believe that's all.
curiousgal 4y ago
So does that mean that all phone manufacturers are essentially selling snake oil when it comes to device security?
- GekkePrutser 4y ago
  Kinda. But physical access is a big barrier. I am really surprised they don't do much against Pegasus though. I'm sure the agencies involved know what exploits it uses by now. I guess because western powers use these tools too is why they don't lock them out.
  - ccouzens 4y ago
    Peagasus is an evolving product. Probably the early versions are useless these days. https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_of_capabilities https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_... I wouldn't be surprised if it hasn't always been at full effectiveness on all platforms, as vulnerabilities are patched and others discovered.
- jaclaz 4y ago
  Yes and no. The manufacturers do their best to protect the users, but when it comes to criminal investigations there are tools[0] that can often make access to smartphone (or computers) data possible. These tools are often prohibitively expensive and/or only licensed to LEO's (Law Enforcement Officers) and cannot unlock/access "everything", so there is no real "privacy risk" connected to them unless you are charged with a criminal offence and/or arrested. To give you an example there are cases where an iPhone can be unlocked by two (AFAIK) different tools, one is made by Cellebrite that charges an awful amount of money for each unlock, and the other is Graykey that wants as well a lot of money but you can buy the "unlimited" option: https://www.forensicfocus.com/forums/mobile-forensics/graykey/ https://www.forensicfocus.com/forums/mobile-forensics/grayke... both are only given to authorized investigators (Police/Government) only. Of course it is possible - in theory - that someone malicious manages to get their hands on one of them and then proceeds to steal the phone from you, and then can afford to spend anything between 3,000 and 10,000 US$ to unlock it and access your data, but I find it improbable. [0] until the manufacturer patches (if patchable) the vulnerability, and then the race starts to find a new one
BiteCode_dev 4y ago
Which is fair play. I fully expect authorities from any countries to try to get evidences from physical access to electronic devices in the case of criminal investigation. Just like they can go into ones house and open safes with a torch if a judge allows it. The problem is mass surveillance, not getting data about someone under arrest. Of course, I unfortunatly also fully expect them to abuse that and use it outside of criminal investigations, without the knowledge of said person.
- Proven 4y ago
- SnowHill9902 4y ago
  No, the problem is backdoors and misleading information.
  - BiteCode_dev 4y ago
    That as well. Apple may state that their enclave is secure, the existance of such tools and the fact they were part of PRISM hints that they are like all others: open to those with a lot of resources.

arminsergiony 4y ago

The primary distinction between Pegasus software and other software is that in order to hack a mobile device, the hacker must have direct, physical access to the device. Pegasus software does not provide remote surveillance.

peoplefromibiza 4y ago

Bit of clickbait title, from the article it's not clear at all what the news is, Morocco already has Pegasus (from Israel) that works remotely, these new software are much less powerful and require physical access to the device, but once you already have physical access, it's game over. Of course, even if the article make it sound like a scandal, exchange of anti-privacy software for catching human traffickers [1] is not announced in a worldwide press release, it would defeat its purpose [1] from the article Objective of this technology transfer financed from the budget of the EU's "border management program for the Maghreb region": to fight against irregular immigration and human trafficking at the gates of the EU.

Kukumber 4y ago

I'm not surprised, morocco is a source of migrants and drug problems, this cooperation to strengthen security at EU's border makes sense

kabylehabyle 4y ago
> source of migrants and drug problems Wow. Sounds like someone is on an agenda.
- GekkePrutser 4y ago
  It's the only African country with a land border to the EU so there's a point. There was a major incident with almost 40 dead at one of these borders only months ago. I also don't like the framing of migrants and drugs in the same sentence as both issues are ethically very different. But both are driven by organized crime groups and the migrants are victims too. The traffickers take them for all they're worth. It's a problem that needs to be fought.
  - jaclaz 4y ago
    >It's the only African country with a land border to the EU so there's a point. By "land" you mean "only a few miles of sea", I believe. There are three spanish islets (exclaves): https://en.wikipedia.org/wiki/Enclave_and_exclave https://en.wikipedia.org/wiki/Enclave_and_exclave in Morocco, but they don't really count, even if inside Melilla, Ceuta or Peñón de Vélez de la Gomera https://en.wikipedia.org/wiki/Morocco%E2%80%93Spain_border https://en.wikipedia.org/wiki/Morocco%E2%80%93Spain_border you are on Spanish territory, you still need to cross the Gibraltar straight to get to Spain, they are among the few "special territories" of the EU: https://en.wikipedia.org/wiki/Special_member_state_territories_and_the_European_Union https://en.wikipedia.org/wiki/Special_member_state_territori...
    - GekkePrutser 4y ago
      I was talking about the enclaves yes. Why don't they count? They are regular targets for human trafficking and drug activity. Many people have died in trafficker-incited border incidents. https://en.wikipedia.org/wiki/2021_Morocco%E2%80%93Spain_border_incident https://en.wikipedia.org/wiki/2021_Morocco%E2%80%93Spain_bor... https://www.theguardian.com/world/2022/jun/26/calls-investigation-deaths-moroccan-spanish-border-melilla-enclave-crossing https://www.theguardian.com/world/2022/jun/26/calls-investig... I know they can't readily travel to Spain from there but I guess the idea is that they apply for refugee status once they're in. And they are part of the EU.

lordfoom 4y ago

Worth reading: https://en.wikipedia.org/wiki/Human_rights_in_Morocco https://en.wikipedia.org/wiki/Human_rights_in_Morocco