Amnesty Researcher Details Spyware Abuse and Phone Exploitation Against Activists and Journalists

Summary

Donncha Ó Cearbhaill describes Amnesty International’s spyware investigations, including Pegasus targeting and the use of phone-forensics tools against people detained in Serbia, and calls for greater oversight of exploit sales.

Key points

Amnesty’s investigations found Pegasus targeting journalists, activists and politicians; a leaked list contained 50,000 phone numbers selected as potential targets, according to the speaker.
Two Serbian journalists received Pegasus links via Viber, but phone checks suggested they had not been infected.
Forensics on a Serbian journalist’s phone indicated that a Cellebrite product was used to unlock it during detention, followed by installation of Novi spy.
Researchers found evidence of a suspected in-the-wild privilege-escalation exploit on a Serbian activist’s phone and investigated USB-device exploitation on another detainee’s device.
The speaker said Cellebrite cut off its customer in Serbia after investigating the findings; the Serbian government did not respond to Amnesty.
He urged exploit developers and vendors to scrutinize customers, investigate misuse, disclose problems and report abused vulnerabilities to affected vendors.

Article Details

Topics: [00:18] Spyware abuse against activists, journalists and politicians
[04:55] Pegasus investigations and mobile forensic methods
[09:26] Leaked Pegasus target list and the impact on journalists
[17:29] Pegasus targeting and physical-access spyware cases in Serbia
[23:24] Android privilege escalation and USB-device exploitation
[28:24] Vendor response and human rights due diligence
[33:17] Exploit reuse, proliferation and researcher accountability
[40:46] Questions and safeguards for exploit researchers