Badass Russian techie outsmarts FSB, flees Putinland all while being tracked with spyware
- Reference: 1733488330
- News link: https://www.theregister.co.uk/2024/12/06/badass_russian_techie_outsmarts_fsb/
- Source link:
Kirill Parubets was detained in Russia for 15 days after being accused of sending money to Ukraine, during which time the man was beaten and subjected to aggressive efforts to recruit him as an FSB informant on his contacts in Ukraine.
According to his account of the story, published with his consent by [1]Toronto University's Citizen Lab and First Department legal organization, he says he was threatened with life imprisonment if he failed to comply with the recruitment drive.
[2]
In order to secure release, he agreed but before he was indoctrinated he and his wife fled the country. Always keep a second passport, if possible.
[3]
[4]
First Department's [5]account revealed that Parubets was working as a systems analyst in 2020, a job that didn't require him to attend an office, so as a self-identifying ethnic Ukrainian, the Russian citizen decided to live in Kyiv.
After Russia's [6]invasion of the country in 2022, however, Russian citizens found it impossible to renew their residence permits so he and his wife Lyubov then attempted to obtain Moldovan and Romanian citizenship, but had to return to Russia to collect personal documents.
[7]
"There were no problems entering Russia," said Parubets. "We arrived by car through Georgia, through Verkhniy Lars along the Black Sea and then we lived peacefully in Moscow. I was slowly collecting papers and continued working at the same time."
Then on April 18 earlier this year, six masked men armed with machine guns stormed the Parubets' home, ordered them to the floor, separated them into different rooms, and asked questions about the money transfers.
Kirill confirmed he was involved in charity work when living in Kyiv and that he did make transfers related to this work – an act Russia designated as treason shortly after its invasion began.
[8]
His Oukitel WP7 Android device was confiscated and he was forced to surrender the password before he and his wife were detained.
"Judging by how confidently they acted in the apartment, I got the impression that they had been there before, or there was wiretapping, because they knew what was where, what to look for and where," he said. "They very quickly found a phone, a laptop, the most important documents related to Ukraine. In general, they knew where and what was there."
Despite Russia warnings, Western critical infrastructure remains unprepared [9]READ MORE
After agreeing to work for the agency, the FSB returned his device at its Lubyanka headquarters but Russia's finest didn't do a great job of hiding their tracks. Parubets quickly noticed an odd-looking notification reading "Arm cortex vx3 synchronization," which isn't a typical message to receive.
"I picked up the code and saw that it was some kind of spy thing," said Parubets. "I was very interested in information security and knew that there was such a spy module called Monokle. According to the description, it was very similar to it."
After outsmarting the authorities and fleeing Russia, a bruised Parubets worked with investigators to conclude that during his time in detention, a [10]trojanized version of the legitimate Cube Call Recorder app was installed on his phone. The app had many hallmarks of spyware – specifically the Monokle family.
Various additional features were detected on the app, including the ability to track a device's precise location when not in use, record video and the device's screen, log inputs, install additional packages, send and read SMS messages, and read messages from other messaging apps.
Many of these features were contained in a single class (com.android.twe1ve) which is specific to [11]Monokle – a spyware family that dates back to 2019 and was swiftly linked to Russian use.
[12]Russian court fines Google $20,000,000,000,000,000,000,000,000,000,000,000
[13]Ransomware hangover, Putin grudge blamed for vodka maker's bankruptcy
[14]Happy birthday, Putin – you've been pwned
[15]Putin really wants Trump back in the White House
"This case illustrates that the loss of physical custody of a device to a hostile security service like the FSB can be a severe risk for compromise that will extend beyond the period where the security services have custody of the device," said The Citizen Lab. "In this case, the target noticed several odd behaviors on their device after he was released from detention, such as an unfamiliar and suspicious notification and the presence of an app that he had not installed. However, not every attempt to infiltrate and monitor a device is likely to result in such visible alerts.
"We encourage members of civil society that have lost physical custody of their device to a security service, especially a technically competent service in an authoritarian state like Russia, to seek expert assistance when the device is returned to them. Any person whose device was confiscated and later returned by such services should assume that the device can no longer be trusted without detailed, expert analysis." ®
Get our [16]Tech Resources
[1] https://citizenlab.ca/2024/12/device-confiscated-by-russian-authorities-returned-with-monokle-type-spyware-installed/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z1MtsYV9VxBt4bCF0GrzRwAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z1MtsYV9VxBt4bCF0GrzRwAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z1MtsYV9VxBt4bCF0GrzRwAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://dept.one/story/parubets/
[6] https://www.theregister.com/2024/09/24/russia_malware_ukraine_attacks/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z1MtsYV9VxBt4bCF0GrzRwAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z1MtsYV9VxBt4bCF0GrzRwAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2024/09/18/russia_west_critical_infrastructure/
[10] https://www.theregister.com/2023/10/06/golddigger_android_trojan_vietnam_attacks/
[11] https://www.theregister.com/2019/07/24/monokle_android_snoopware/
[12] https://www.theregister.com/2024/10/29/russian_court_fines_google/
[13] https://www.theregister.com/2024/12/05/putin_ransomware_stoli_group/
[14] https://www.theregister.com/2024/10/08/russia_state_news_shutdown/
[15] https://www.theregister.com/2024/09/18/russia_putin_trump_white_house/
[16] https://whitepapers.theregister.com/
"Always keep a second passport"
I would venture that, in every country that delivers passports, having a second one is against the law.
Of course, in democratic, civilized countries, you most likely don't need one unless you are a foreign agent (aka spy) or a hardened criminal. In Russia, however, I fully understand that perfectly innocent citizens might need one other magic want to ensure the safety that the Kremlin does not.
Now, I'm glad that this guy got out with his wife - very happy for both of them. It's good that he was techno-proficient. The ham-fisted way his phone was compromised speaks volumes about how poor the FSB is in true technical ability. Gosh, I guess Tom Clancy was wrong about a few things.
But saying that you should no longer trust your phone if it has been confiscated by a tyrannical regime is like saying brush your teeth before going to bed.
Duh, man. That thing is burned. Throw that shit away and get another one.
Re: "Always keep a second passport"
I'm with you Pascal, the device is compromised.
Get a new device, SIM, IMEI etc. No point in keeping the old one, unless you want to use it for research purposes in a sandboxed environment.
Re: "Always keep a second passport"
If it's been near the Israeli security services make sure it's a large sandbox well out of the way of anything not shrapnel proof
Spyware is kinda the 'nice' way to have your device compromised these days
Re: "Always keep a second passport"
This guy is probably best off using paper cups and string at the moment.
Re: "Always keep a second passport"
My wife, children, grandchildren and brother- and sister-in-law are all entitled to both UK & Irish passports. I'm only entitled to a UK one.
Re: "Always keep a second passport"
In the Netherlands it is possible to [1]get a second passport for business use with twice the regular number of pages. Often for obtaining visa the passport has to be given to an embassy for several days and this prevents you from traveling during that time. The second passport allows you to travel anyway. Also useful if you need to travel to conflicting countries.
Apart from that, many countries allow dual citizenship, and some countries, such as Morocco, make it just about impossible to get rid of Moroccan nationality. Which means as a Moroccan you can naturalize to a new nationality but not denounce your original citizenship. And the you have two passports.
[1] https://www.denhaag.nl/en/passport-and-identity-card/apply-for-a-second-dutch-passport/
Re: "Always keep a second passport"
https://www.gov.uk/government/publications/additional-passports/additional-passports-accessible
UK citizens can hold two passports
US citizens can hold up to four
Re: "Always keep a second passport"
I would venture that, in every country that delivers passports, having a second one is against the law.
Not at all. It's quite valid to have an extra passport, and I know some people who do. Visa applications can require you to send in your passport as part of your application, so people who travel on visas a lot will have spare passport(s) so that they can always have one to travel with when other passports are away with visa applications.
A friend of mine has used this to his advantage by carrying both his passports on a trip to the other side of the pond - he used one for getting in and out of Cuba and the other one for subsequent entry to the USA...much easier than showing up at USA immigration with a Cuban stamp in the passport. Similar use cases exists for travelling between some middle-eastern countries.
Re: "Always keep a second passport"
Quote 'I would venture that, in every country that delivers passports, having a second one is against the law.'
Can't comment on other countries, but certainly in the UK you can have more than one British passport, these are known as 'additional passports' and you have to provide a valid reason for wanting one.
Valid reasons include things like being a frequent business traveller, if you need visas, as often you need to send your passport to a embassy or consulate to get the visa, and this can take time, several weeks, meaning no passport for that time, and if you travel every week or two, or even just monthly, this can be impossible without a second passport.
Another reason is incompatible countries, having stamps for some countries can make it difficult to get into others. A friend of mine years ago was a language teacher, and did volunteer charity work overseas, sometimes to countries that were not all that friendly with each other, or the West in general. The charity suggested getting a second passport, and to use his original one for the West and West friendly nations, and the second one for some of the less friendly ones. This wasn't just a case of getting into the other countries easier (as it was obvious where he'd come from of course), but more about getting back into places in the West, such as the USA, without having a passport full of visas and stamps from places like Libya etc.
Re: "Always keep a second passport"
My brother has two UK passports, because he has to travel a lot for work, so if he needs to get a visa for (eg) the US, he can still travel while his original passport is having the visa installed.
I got the impression that it's a fairly normal service, just not one that's widely advertised.
Never was a spy, likely
People throw this "spy card" to spy on you.
I know people who never was a spy but had lots of knowledge, and who suffered this already.
In Soviet Russia phone owns you!