Tag Archive for: romania

Steganography: government documents under analysis

Analysis published in May 2022. The full document is available below.

Steganography is the practice of hiding a message inside another message, file or object, so that no one suspects it exists. In computing, text, images, audio or documents can carry hidden content. This analysis looked at three documents published on the official servers of a Romanian national agency, whose table borders turned out to be made of strings of characters rather than lines.

Key points

  • Three documents, three different people, three different years, the same institution.
  • The “lines” of the forms were neither solid nor dotted: they contained many characters that looked like text.
  • Optical character recognition produced fragments in Arabic and Gujarati script, apparently excerpts from different conversations, full of names and places.
  • The cause could not be established: a compromised computer, modified software or a compromised server are all possible.
  • What is certain: the documents had been modified by someone, a threat actor or a system.

What steganography is

The word comes from the Greek steganós (“covered, concealed”) and -graphia (“writing”). Unlike encryption, which makes a message unreadable, steganography hides the fact that a message exists at all. It can use text, images, audio, network protocols or office documents.

What was found

At first glance, the scanned forms looked normal. On closer inspection, the table lines were made of characters that were hard to read and resembled the words in the form. In Word, table borders can be styled from a predefined list, but these were clearly altered.

Text extraction from small portions gave no meaning. Extracting the characters page by page, from all three documents, produced longer passages that looked like fragments of discussions on different topics, containing names of people and geographic regions. The first hypothesis, that the documents had been altered for black-hat SEO, did not fit what was found. What is published represents about 15% of an analysis that took almost 25 hours.

Steganography – government documents under analysisDownload the full document

Possible explanations

  • the computer used to edit the documents was compromised;
  • the editing software had been modified to insert the characters;
  • the institution’s server was compromised and someone changed the files.

Each of these has implications for personal and confidential data that could be compromised and exploited.

What still applies today

  • public institutions should check the integrity of the documents they publish, not only their content;
  • cybersecurity is more than updates and an SSL certificate: workstations, software and servers all need protection;
  • staff training should come before digitalisation, not after it.

ProDefence offers web and network security testing and analysis of suspicious files.

Analysis of a “Pegasus” source code leak: spyware or something else?

Analysis published in May 2022 by Alexandru Angheluș, Oana Buzianu and Aris Giannopoulos. The full document is available below.

In 2022, source code advertised as “Pegasus” was published on Telegram. Since NSO Group’s Pegasus is one of the most dangerous espionage tools known, able to compromise a phone with a single message and no click, the leak looked like a chance to understand how it works. The analysis showed something else: the code belonged to a remote administration tool also called Pegasus, not to NSO’s zero-click spyware.

Key points

  • NSO’s Pegasus is zero-click spyware: receiving a message can be enough to compromise the device.
  • The leaked project was “Pegasus Remote Control” by Skynet Software Corp (2020), with remote desktop, a cryptocurrency miner and a RAT component.
  • Subfolder names written in “Greeklish” suggest that at least one author or later contributor was of Greek origin.
  • The post had about 6,600 views in two days, so the code could reach other criminals.
  • It is better that the real Pegasus code was not the one leaked.

What the leak contained

The files included folders named PEGASUS, Server and HVNC, which looked promising at first. The version information told a different story: “Pegasus Remote Control”, created by Skynet Software Corp in 2020. The project included an option to use the victim’s device to mine cryptocurrency, which makes no sense for discreet state-level espionage. Its components were a Windows remote desktop manager, AsyncMod Miner and BitRAT.

Public sources described the tool’s features: user-level rootkit, hidden remote desktop (HVNC and hidden RDP), cryptocurrency wallet theft, remote recovery and a builder. It is an espionage and control tool for cybercriminals, but not one used against politicians, institutions or journalists.

A clue about the authors

Some subfolders had Greek names written in Latin characters, a practice known as Greeklish: Cryptografhsh (encryption), Diadyktio (network), Metafora_Dedomenon (data transfer), Metafora_Eikonas (image transfer), Metafora_kwdika (code transfer). This suggests that the author, or someone who later modified the code, may be of Greek origin.

Full document

The analysis of some Pegasus Spyware source codeDownload the full document

How to protect yourself from spyware

  • keep the phone and apps updated and install security patches as soon as they appear;
  • restart the phone daily, which can interrupt some in-memory infections;
  • do not click links received by message or email;
  • install a security app that warns if the device is rooted or jailbroken;
  • on iPhone, consider disabling iMessage and FaceTime if you are at high risk, or use Lockdown Mode;
  • use a reputable paid VPN on untrusted networks.

Classic remote administration tools can be detected by security software, and users can be taught to avoid them. Zero-click spyware is much harder to defend against, which is why the real Pegasus has so far been used only against selected targets. For the analysis of a device or file you suspect is compromised, ProDefence offers malware and fraud analysis.

Skip to content