John Scott-Railton Profile picture
Oct 2, 2022 10 tweets 10 min read Read on X
BREAKING: journalists & human rights defenders hacked with #Pegasus in 🇲🇽#Mexico.

Years *after* spyware scandals & new President's promise that abuses were over.

THREAD 1/

Report by @R3Dmx ejercitoespia.r3d.mx
We @citizenlab did forensic validation: citizenlab.ca/2022/10/new-pe… Key Takeaways Mexican digital rights organization R3D (Red eOur technical validation of forensic artifacts collected fro
2/ Per @R3Dmx, #Pegasus victims were infected while working on:

❌Connections between Los Zetas Cartel & Mexican Army
❌Official misconduct in investigations into #Ayotzinapa forced disappearances
❌Human rights violations by Mexican Armed Forces.

Chilling. Ricardo Raphael  Raphael, a prominent journalist and author Raymundo Ramos Vázquez  Ramos has spent years documenting h
3/ Mexico was first rocked by #Pegasus scandals in 2017 under President @EPN.

We @citizenlab, @R3Dmx @socialtic & @article19org had found dozens of abuse cases.

When Pres. @lopezobrador_ took office, he promised hacking abuses were a thing of the past...
4 Mexico's #Pegasus scandals didn't stop.

The #PegasusProject also revealed that scores in the circle of @lopezobrador_ had been potentially selected for targeting while @EPN was in office.

Including now-President AMLO's wife & children. In 2017, the Citizen Lab, along with partners R3D, SocialTic
5/ Mexico has been one of the *most* notorious cases of #Pegasus spyware abuses.

NSO Group has has been confronted about this. For years.

Mexico's new president, touched himself by spyware abuses prior to entering office... had promised it was over.

Yet here we are.
6/ Yet again, journalists & human rights defenders of intense interest to the Mexican government got hacked.

Chillingly, some of their work was clearly of intense interest to cartels, too.

#Mexico has seen *half a decade* of abuses like this. Need for an Independent Investigation These latest cases, wh
7/ I urge you to read @R3Dmx's full report. Here's their thread on the cases.
8/ Another key find via @R3Dmx: Mexico did recent business with companies linked to prior #Pegasus contracts👇👇

Despite making strenuous efforts to deny any such business.
9/ A key detail: while previous Pegasus cases @citizenlab investigated in #Mexico involved finding SMS messages and 1-click attacks... these latest cases were zero-click attacks.

No action was required on the part of the victims to be infected.
10/ Of course NSO has a response that is not serious.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with John Scott-Railton

John Scott-Railton Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @jsrailton

Feb 27
YIKES: @perplexity_ai is flexing that they have OS-level access to 100M+ Samsung S26s.

Zero mention of:

Privacy
Security
Encryption

What will Perplexity do with this growing stash of personal data from deep inside Samsung phones? What jurisdictions will it live in? Who will it get shared with?

Here's the thing: Android's current security & privacy model involves sandboxing 3rd party apps from each other. TikTok can't read your private notes, for example.

Sandboxing is good & it narrows the attack surface against your private stuff.

But this #Perplexity integration breaks that baseline sandbox model, making a kernel-adjacent data bridge for Perplexity into your personal stuff.

Will users understand the structural shift in privacy?

Meanwhile, the risk of prompt injection & other attacks against an agentic AI that has OS-level access to personal stuff is also real.

Lots of speed, no signs of caution.Image
2/ Multiple agents & flows each with their own distinct security & privacy issues and levels of OS-level access to private stuff.

I doubt users have the cognitive spare room to parse privacy & security downsides each time they want to ask a question.
3/ Unprecedented access means @perplexity_ai is taking unprecedented security measures.

And has thought hard about user consent & protecting their privacy...right?

Right? Image
Read 4 tweets
Feb 24
BREAKING: US just sanctioned a network of exploit brokers trafficking in stolen US hacking tools

First-ever use of #PIPA (Protecting American Intellectual Property Act) by @USTreasury.

Here's the wild backstory of how @opzero_en got US-taxpayer funded exploits. 1/ Image
Image
2/ Peter Williams was an exec at Trenchant, subsidiary of @L3HarrisTech / $LHX.

Trenchant makes hacking tools for 🇺🇸US & allies.

Williams sold them to @opzero_en & bought nice things.

Result? Powerful 🇺🇸 capabilities got into hostile hands.
Image
@L3HarrisTech @opzero_en 3/ Operation Zero is a zero-day broker. They pay bounties for exploits in tech (much of it 🇺🇸US-made).

Then resell to non-NATO governments & intel agencies.

They aren't secretive. They even advertise here on X. Image
Image
Read 11 tweets
Feb 18
BREAKING: It started with WhatsApp messages.

They said they were students & tried to build rapport with Angolan journalist Teixeira Cândido.

Then the links began arriving.

Someone was trying to hack him with #Predator spyware.

New bombshell investigation by @AmnestyTech 1/Image
Image
Image
Image
2/ Heard of Pegasus? #Predator is a somewhat sloppier cousin.

They don't always have the hottest zero-click exploits, but they market to the same dictators.

And once you are infected, the harm is just as real: your digital life is turned inside-out.Image
3/ Predator spyware, which is distributed by #Intellexa, has a massive abuse problem.

And this latest excellent investigation by @AmnestyTech just drives home how much chaos the company has caused...
Read 11 tweets
Feb 17
NEW: When Kenyan cops arrested activist & presidential candidate @bonifacemwangi they took his devices.

When he got his personal phone back, the password was gone.

We @citizenlab found they'd abused @cellebrite to break into it.

Here's why this abuse matters 1/Image
Image
Image
Image
2/ Your phone holds the keys to your life, and governments shouldn’t be able to help themselves to the contents just because they don’t like what you are saying.

But everywhere you look, cops are getting phone cracking technology from companies like @cellebrite.

Many abuse it.Image
Image
Image
Image
3/ @Cellebrite's abuse potential is clear.

Now, Cellebrite says that they have a human rights committee & do due diligence...

Because even Cellebrite knows that if you sell phone cracking tech to security services with bad oversight, you have a problem.

So why are there so many sales to questionable security services?Image
Image
Image
Read 6 tweets
Feb 16
NEW: Israeli surveillance companies are rushing to turn your car into a spy.

🎥Watching the cameras
🎤Listening to the built-in mics
📍Tracking your movements

And that's just the beginning of how these companies turn your car against you. 1/

Story by @haaretzcom's @omerbenj Image
Image
Image
Image
2/ And other companies are using AI to fuse all the signals coming from your car with other sources of information.

Honestly, the growth of #CARINT shouldn't shock anybody.

Our cars are badly secured & very connected... So it's natural for surveillance merchants to turn up.

STORY haaretz.com/israel-news/se…Image
3/ We got here partly because your car manufacturer really, really doesn't care about your privacy.

And face no serious consequences for doing a bad job with security.

Clearly early days with commercial #CARINT, but the trendline points in a scary direction. Image
Read 4 tweets
Feb 11
Epic OPSEC fail by Paragon exposing Graphite spyware capabilities.

Annotated pic from what we know.

Please help me figure out the other apps in in this pic that the spyware can access:

#WhatsApp
#Telegram
#Signal
?
#Line?
?
#Snapchat?
#TikTok?Image
2/ Companies like Paragon (founded in Israel, former Israeli intelligence ppl, recently sold to a US owner) make hacking American technology companies their business model.

And then selling these capabilities to foreign governments.

How can this be?
3/ Honestly it is astonishing that a company that works tirelessly to hack & undermine the security of American products is now US-owned.

The missing factor: building contracts with the US government & lobbying.

The goal of these contracts, I believe, isn't just profit. It's getting protection & building government dependency on their technology.

We all wind up paying the price.Image
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(