Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
JACK: What’s a mercenary? Let me look this up; okay, there are two main definitions. One is a soldier hired to do work for another army and the second is a person who works purely because of monetary gains. I’m gonna guess that they don’t have allegiance other than whoever is paying them. They’re hirelings; they get paid to do a job and to get it done and they’re not supposed to ask why. But mercenaries are people and people are complex. They’re filled with emotions and they actually do have allegiance even if they’re paid to forget about that. If you pay a mercenary to do something that goes over their moral line they’ve got internally, conflict happens and everything falls apart.
JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: Let’s get started. Ready?
DAVID: Yes, sir.
JACK: Let’s start with your name, or what do you want to be called on this show, and what do you do?
DAVID: Yeah, my name’s David and I am a type of offensive intelligence analyst. I track foreign intelligence hacking in the United States. That’s what I do now.
JACK: Oh my gosh, I have like, twenty questions already just from saying that. Did you say ‘offensive intelligence analyst?’
DAVID: That’s correct.
JACK: I’ve never heard of that. What does that mean?
DAVID: If a foreign intelligence organization would gain access to any type of US-based critical infrastructure, that would be something that I would help investigate.
JACK: This is gonna be a great episode. It’s very exciting to me because David is going to tell us a story that was a secret up until this year and still remains somewhat shrouded. So, let’s get into it. [MUSIC] Let’s start when he was a teenager. In high school, David really wasn’t into computers at all.
DAVID: Well, I was a long-distance runner. I was involved of all different types of extra-curricular things; student government and stuff like that.
JACK: After high school he went to college and got his degree.
DAVID: It was actually in religion and philosophy.
JACK: Interesting. Take note here; imagine all the morals and ethics one has to consider while majoring in religion and philosophy.
DAVID: My goals at that point were to pursue a career alongside some of my other peers that I might be able to make a difference to. I did look into hey, how could I potentially join as a chaplin? Talking to other people in that same world, they’d say well, I’ve never even met my chaplin, or I’ve never had a real conversation with him, or I don’t know who they are. I realized if I really wanted to make any type of difference in people’s lives, it wasn’t gonna be as a chaplin.
JACK: After getting his degree, David decides to join the military. Off to the Navy he goes. [MUSIC] He does his initial bootcamp, graduates from that; fairly easy and is a full-fledged Navy sailor. But David was hungry for more.
DAVID: My initial school was in BUDS so I joined to sort of become – go through that Navy SEAL track and see how that went.
JACK: Whoa, BUDS is Basic Underwater Demolition Training. It’s what you need to go through to become a Navy SEAL. This is the most rigorous, demanding, and crazy training there is in the Navy. This is what they call Hell Week and it’s much longer than a week. Those who make it through this become practically drown-proof. They become frog-men and most of all, they become weapons experts.
DAVID: [MUSIC] When I talked to a Navy SEAL and his mindset was, the last time I was deployed, I got every type of kill other than a knife kill. He was bragging about that. He just really wanted to get a knife kill. That was like okay, [00:05:00] you know what, I don’t want that to be me. I’m not saying that every Navy SEAL is like that but the potential if somebody can become like that, then there’s the potential that I could become like that. That was something that I wanted to avoid. That’s an important job and I have a lot of respect for Navy SEALs but I just had this fear that I really don’t want that to become me.
JACK: That’s some intense training and you definitely need to do some soul-searching while there. You question yourself on whether you want this bad enough or if you’re fit enough to do it. You have to put mind over matter and push yourself beyond limits you think you can’t ever get over. If you’re gonna push yourself beyond your own limits, you better really want what you’re working for. David wasn’t sure if being a Navy SEAL was for him. He knew that Navy SEALs just weren’t a bunch of killers, but he started to question if he really wanted it bad enough. He rang the bell and quit BUDS, and looked for something else to do in the Navy. Still, he wasn’t interested in computers like, at all. The only thing he knew how to do was check Facebook and e-mails at that point. He’s fit, buff even, and understands religion and philosophy. He looked at his options and for some reason, computers and cyber-warfare caught his attention. He decided to sign up for that in the Navy. Immediately, he needed training, though.
DAVID: Well, the training is pretty basic. Actually, when I say basic, I don’t mean basic. It’s the same type of training you would get everywhere else from a cyber-security perspective, but the pace is significantly faster. Instead of going through a twelve-week course to learn how to code, you do all of that in one week. You literally learn all of it in a single week. You’re set to learn everything from assembly language all the way up to coding languages and then how that’s interacting with different type of assembly languages and how coding – you understand the process, how it all sort of builds. You go all the way up to that spot and then you get back to the application layer, and then you move back down to the exploitation layer. The exploitation layer in that environment is not taught – buffer overflows and exploitation analysis is not taught until you get into more OJT or following courses for different shops.
JACK: This amazes me. The Navy teaches people how to hack. I sort of know they do that, but it kind of boggles my mind every time I hear it. He got training and then started doing security analyst work for the Navy.
DAVID: Yeah, I applied maybe three or four months before I realized – in that time period when I was learning how to be a certain type of cyber-security analyst or an exploitation analyst or in training, how to be a general IT person. I sort of enjoyed it and I realized that I’m in no ways an expert at exploit development, but I didn’t understand the concepts and I don’t give up; it allows me to push through. [MUSIC] From that time period being at the shop, what I did next basically was purchased a Mac Pro server, for instance, installed ESXI on that, and started building stacks and learning hey, I’m learning this at work. I’m not gonna take the exact thing that I’m doing, the exact concept ‘cause we’re not really supposed to do that, but I can – similar layout, similar designs, and let me just replicate this at home so I can continue to learn how to do it. It might be let’s learn how to pivot through a machine or let’s learn how to exploit active directory trust relationships, so on and so forth. Being able to build those up and stuff like that allowed – it sort of grew my fascination with it.
JACK: [MUSIC] This is an important quality about David. He didn’t just show up and do his work and go home; instead, he built a lab and practiced on his off-hours and got better and better. Anyone who really wants to excel in this kind of stuff has to have the mindset of always trying to learn and not just doing the minimum. With the Navy teaching him formally in his home lab, he became pretty good at hacking. In fact, his specialty was not just getting in but then pivoting around, moving laterally, and finding what else is in that network. After about four months of doing that, he moved over to the NSA. [MUSIC] Because David was an exploit analyst in the Navy, the NSA came and said hey, why don’t you come work for us, and recruited him over. He started working for the NSA as an analyst there. He worked at the NSA for a while.
DAVID: I’d say August of 2011 to August of 2014, so about three years.
JACK: Then around that time, a new opportunity showed up.
DAVID: At that point I had gotten married. Probably, while I was up there, it would have been maybe almost two years I’ve been married. [00:10:00] It’s time for me to get out of the service. I had gotten an offer to stay there on campus which is at the NSA. Then a different organization, or actually, an individual recruiter reached out to me and said hey…
JACK: There was this recruiter from a company called CyberPoint. This is a company that’s contracted to do various types of hacking. Basically, if he were to work for this company, he would become a hacker for hire. The US government actually grants certain companies’ extra permissions to conduct stuff like this. The details of this are foggy but this company that was trying to recruit David was vetted by the US government to do this. David listened to the recruiter tell him what the job entails.
DAVID: That I would be doing a lot of different types of offensive work, offensive maybe security, maybe offensive intelligence. That would be some of our goals. Whether or not…
JACK: Give me an example of what some of the offensive work is that you expected to do.
DAVID: Just from previous conversations, I’d understood well, you might be doing some tracking of terrorist organizations to help out and alleviate some of the workload in the United States. [MUSIC] We’re helping them out over there; protect their country as well. Our main understanding was we’re going over there to help them protect their country.
JACK: This sounded good to David; to help protect the country, to help battle terrorists and to reduce some of the workload for the US forces? Alright! The company was called CyberPoint and it’s based in Baltimore, in the US. It’s typical that not all the details are given about your duties until after you sign an NDA, a Non-Disclosure Agreement. But there was one more detail in this contract. If he was to accept it, he would have to move to Abu Dhabi in the United Arab Emirates for two years which was the duration of this contract.
DAVID: Not really ever traveled, not really ever gone anywhere. I had before, but being married, my wife had not. We made a decision together.
JACK: They decided to take the job in Abu Dhabi. [MUSIC] Off they go. They packed up everything they needed, said bye to the family, and moved to the UAE which is right in the Middle East. The name of the hacking unit Dave was assigned to was called Project Raven.
DAVID: For the first thirty days to sixty days, you’re actually living in a hotel. There are so many red flags when you first get over there, you should know to yourself; I shouldn’t be doing this.
JACK: What were some of them?
DAVID: Well, the fact that you have two different folders that explain different confidential information. That should be one of them. Like, this is what we told you you’re gonna be doing and this is what you’re actually gonna be doing.
JACK: When a new person would show up at Project Raven, they would get two back-to-back meetings. First was the Purple Meeting. [MUSIC] In this Purple Meeting, you’re given a folder with information. It says you’re here strictly to carry out defensive measures within the cyber-security discipline such as deploying firewalls, intrusion detection systems, and other defensive measures. But as soon as that Purple Meeting was over, new employees were told that’s just a front; it’s a cover story that you can tell your family or anyone who pushes you to ask what you’re doing. Then immediately, you’re given the Black Meeting with a new folder.
In this Black Meeting, you’re told a very different story. Here, you’re told you’re gonna be helping NISSA conduct offensive cyber operations. This meeting further explained that NISSA was the secret part of the UAE government which is similar to the NSA and that you’re gonna be helping them conduct electronic exploitation and collect information from specific targets. Yeah, for you and me, seeing these two back-to-back meetings like this would be a red flag for sure, but for someone who’s used to a lot of secrets coming out of the military and the NSA, this is actually a sort of common thing to experience. Covers and fronts for what your actual official duties are, yeah, that happens. It wasn’t an immediate flag for David.
DAVID: The location we worked out of was actually a villa, a converted villa. Our spouses were not even really supposed to know where the villa was at even though that’s ridiculous ‘cause some people dropped their spouses off.
JACK: Let’s talk about this villa he worked out of. I saw a floor plan to this. Let me describe it. [MUSIC] It was a big mansion and it was just converted into an office space that these contractors could work out of. I think that was there to blend in and hide out. A mansion is typically private and secluded and quiet. It’s a great place to set up a spy agency. This villa is where Project Raven was to take place. The villa was two stories and it consisted of a server room, a management office, a conference room, an operations center, a data-processing room, a couple of kitchens, and some security guards hanging out. Dozens of people either worked there or had business there and would come and go. I’m guessing [00:15:00] around thirty people worked in this villa. The operation would go down like this; first, an order. A mission was relayed to the management office and managers would then work with those in the targeting room to properly identify the targets.
Then, the team who worked in the infrastructure room would get busy. They would use fake identities and Bitcoin to anonymously rent server space around the world. This is a precaution that in case the target figures out they’re being spied on and they try to track it down, it doesn’t come all the way back to this villa; there’s this anonymous, untrackable gap. Then, the targeting team would get to work scouring the target’s social media and trying to learn as much as they can about the target to strategize on a way to get into the victim’s computers and phones. Once they knew a method of attacking, the target team would figure out what attacks to use or create an exploit from scratch. The target team was very good. They knew that the more you knew about the target, the easier it will be to create exploits for them. The operations team would then step in.
They’d be given all the tools to do the job and all the information on the target. Then, they exploited the target’s computer or cell phone to get data off of it and learn about that person or get the information that they’re after. They vacuumed up photos, e-mails, call records, conversations, texts, locations; anything of value. It was all done very secretly and covertly so the target wouldn’t even know they’re being spied on. Then, this information was given to management who then relayed it to whoever hired them. Pretty good little operation they had going on there. At this point, you might be wondering who’s hiring this group and conducting this spying and hacking? It was the UAE government who was hiring them to conduct these hacks. It sounds like the UAE government was in the process of getting their own internal hacking group stood up but they needed to hire this group of mostly Americans, many of whom were ex-NSA agents or ex-military intelligence-trained. This way, the UAE government can see how they operate and learn from them and build their own hacking team.
DAVID: At this point, whenever I first started, everything was on the level; what we were doing, what we were operating on, what our targets were. We all agreed and we understood this is what we’re gonna be working on.
JACK: The targets that David was given to extract data from seemed okay. He was given the same sort of mission each time.
DAVID: Was just on what could be perceived as terrorist activity and we were protecting the local infrastructure.
JACK: Makes sense, right? Anyone can get behind this. Let’s use hacking to get into terrorist cells and anyone planning to attack the UAE infrastructure, and stop any terrorist attacks before they happen. That’s what happened; David and the team at Project Raven were learning what terrorists were planning and giving this information to the UAE government to stop them. Now, I should add an important note here; all of this hacking was done by citizens of the UAE which are called Emiratis. I’m gonna use that term a lot so make sure you understand it. An Emirati is simply a citizen of the United Arab Emirates. Since the UAE was trying to train up their own team to do this, it made sense to teach them how. David really never really had hands-on-keyboard to conduct any of this. Instead, he was right next to an Emirati doing it, telling him exactly what keys to press and what exploits to use, and giving advice on how to move around the network. Most Emiratis speak English so the language barrier wasn’t a problem.
This sounds okay too, but it also might be a red flag. Things get murky regarding how legal Project Raven was. It’s clearly illegal to share classified information with other people so David couldn’t tell these Emiratis any secret information that he was privy to at the NSA but in this case, David was sharing cyber-spying techniques with the Emiratis. Provided it’s not proprietary NSA style tactics and exploits, there isn’t any hard law prohibiting him from teaching others how to hack, such as how to set up a phishing e-mail and use Metasploit to gain access to the victim’s machine. Anyone can learn this just on YouTube. That part, okay, that’s legal. But then we start trying to figure out whether an Emirati hacking into a terrorist phone who’s also in the UAE is legal or not.
In the US, it probably isn’t legal unless you’re given express written consent from the US State Department. But what about over there? Keep in mind, this company did have all the approvals they needed from the UAE government and the US State Department to do this. Yeah, it might be a little easier to get approvals for things if Emiratis hack other Emiratis, but if an American were to do it, I don’t know, would it be different? It’s complicated and it makes my head spin but you see how murky this gets, right? But whatever, it’s not something I’m gonna be able to solve here. At this point, the UAE government was pleased with the work that Project Raven was doing.
DAVID: The first four to six months, that’s what we were doing. Anytime we had an alert or a red flag of a probable or anticipated event, we would start the process of doing research to see if we can identify whether or not [00:20:00] it was a valid threat.
JACK: Now, it’s also important to say that all of this data exfiltration David was doing on the targets was only that; data exfiltration. He was never on a mission to drain a terrorist’s bank account or disable a car remotely, or do any disrupting, degrading, or destroying things that other hackers might do. This was just collecting communications. This went on for a while but then at some point, the requests from the UAE government started to get a little weird.
DAVID: [MUSIC] You know, the unfortunate thing is, things didn’t get weird for quite some time because the requests looked very similar to what we were currently working on. Hey, this looks like that some of their funding might have come from over here. What would be necessary for you guys to prove that a country, for instance, is funding terrorist activity? Our response would be gain access to the country and gain access to this particular shopper, this person, and then read this stuff from the perspective of we’re still sanctioned to perform these activities under the State Department. Again, this might have been just me being naïve about the entire situation. Chances are, other people on the shop knew the answers to the questions of this is not sanctioned. But me being so new to this entire community and this whole world, I’m like okay, well, this is approved. They wouldn’t be asking unless it was an approved request.
JACK: Keep in mind, the government branch of the UAE communicating with Project Raven is called NISSA and this is UAE’s version of NSA. NISSA told them to gain access to that foreign government country’s network to see if they’re funding terrorists. David’s team got busy scanning the IP space of that target country’s government network. You’ll never believe what they found. Stay with us. After the team at Project Raven scanned the .gov URLs for the target country, they found a VPN portal, a place you can log into and from there, you can get access to the internal systems in that network. Guess what? That VPN was using default credentials.
DAVID: It’s not very hard to find default credentials; a Google search. I would say that 95% of initial accesses are gained based off of some type of easy guessable or default credentials. Look at the IOT world right now. That’s exactly what’s happening.
JACK: [MUSIC] Take note, listeners; change your default passwords and don’t use any of the top 100 most common passwords like qwertyo or 12345. Make it hard for people like this to break into your stuff. Double-check your routers, firewalls, computers, phones, e-mails, VPN servers, and make sure none of them are using easy-to-guess passwords. When somebody at your shop gets into this thing, now this is where you shine, right, being able to move laterally in a network, pivot around, find the goods. Is that right?
DAVID: It’s sort of one of the things that I was trained in. Again, I’m really good at ideas; hey, let’s do this, and then it’s a bunch of research if no one has done that before.
JACK: The idea they had here was let’s start reading e-mails within this .gov organization. They found the organization was being managed by an MSP. An MSP is a managed service provider. Basically this .gov organization didn’t have the expertise or head count to handle all the routers, firewalls, servers, phones, whatever. They contracted all this out to someone else to take care of it. That’s what an MSP does. It manages, patches, oversees, and troubleshoots the network devices. I think in this case they did a bad job at managing the network since they left default passwords on the VPN [00:25:00] but who am I to judge? David’s team found a device on the network managed by this MSP. It was a server running an app called Managed Engine which is basically a tool to help you monitor your network better.
DAVID: The default credentials on this platform, again default creds, are administrator/administrator. You login and there’s a known vulnerability for this where you actually have to – you’re creating a ticket but in that process of creating a ticket, you can upload a document. That process of uploading a document, since you’re administrator, you go back to the administrator console where it tells you where do you want the documents to go that you upload? Then you can change that to a new location.
For instance, if you know it has a VaR dub dub dub HTML space and you know hey, I can actually just drop these right in there, you know the sub folder creation naming convention for each ticket number, then you go and create a ticket, you put an ASPX web shell on there, upload it as part of that ticket, and now you browse your ASPX web shell and you have either a web shell or if your ASPX is a reverse – let’s just say meterpreter session, now you have access to that server. Realizing that they had credentials stored in the machine that we just used their encryption process to – just took that down, reversed their encryption process – again, somebody else significantly smarter than me did this, reversed this encryption process to actually decrypt the passwords for administrators for peered networks in this platform.
JACK: Okay, so now they have a whole bunch of usernames and passwords of people who log into this managed engine server. From here they figured out that some of the users also worked for this MSP. They also found a tunnel back to the MSP. Now they decide to try to get into that MSP’s network.
DAVID: [MUSIC] You have two different ways; if you have a credential, you just use your – again, living off the land, your net bios, your SMB, passing the hash or even the plain text password, login remotely until you get where you want to go to the domain controller, dump all the credentials, and then install persistence throughout the environment.
JACK: Whoa. Oh man, like, this is – do you realize what’s happening here? David’s team has access into the managed service provider, this MSP. This is a company that has a map to all the critical infrastructure for this .gov organization. It also has all the passwords and IP addresses and access to all these systems. But not only that; this MSP had many more clients, like other .gov networks in this target country. Do you see now? David’s team just got tons and tons of access into that target government’s network by gaining access to this single MSP. I mean, where do you even begin looking for e-mails or communications saying that they’re paying the terrorists? The UAE government asked Project Raven for an update. Did you find anything yet? The team responded by saying…
DAVID: We gained access to Ministry of Foreign Affairs, their royal family heir line, some of their military infrastructure.
JACK: This was very interesting to the UAE government. They then even asked the team to track the royal family airlines of this target nation.
DAVID: [MUSIC] Yeah, when they’re flying, at least. Then we started getting requests for daily polls; we want this particular flight tracker on a daily basis. Again, that was another red flag of why is this important? You guys are just looking for proof that they’re funding Muslim Brotherhood. Why do you guys need this information? More internal conversation that we were actually becoming the intelligence-gathering shop for essentially the local country’s intelligence agency. We’re no longer really focused on getting this particular type of information. That’s when questions started to come up. Why are we doing this? What is the point of this? In reality, from a political perspective, I could see that there was a lot of point; they want to know who else this country’s talking to, they’re lying behind their back, and so on and so forth. Those are just speculations. I would assume that they’re doing this but I don’t really have any idea.
JACK: Let’s put our ethics cap on, here. If you were hired to work in another country as a cyber-mercenary, if you will, and you come for the money and to help the government fight terrorism, but now you’re just helping the UAE collect intelligence off a foreign government’s royal family? Do you question it or do you do it diligently [00:30:00] with no questions asked? This scratched something in the back of David’s head; something wasn’t exactly right with this but he kept on doing his work anyway. [MUSIC] He went back into that foreign government network and started looking around for anything about terrorist funding. Sometimes when David was in that network, he would see someone else was also in there at the same time, another hacker. Maybe another government agency has hacked into the same system that he was sitting on. Seeing something like this always makes you slow down and take a breath.
DAVID: We’re not gonna go in and help clean up an entire environment because we’re in there. But you can see that there’s stuff there and you can do some research and figure out what it is. But lots of times in those environments, you either don’t use those particular machines that might have other infrastructure on there or you just do your best to blend in. Also, if you have proprietary tools, you don’t use those tools on that piece of infrastructure.
JACK: This makes sense, right? Exploits are weapons and if you load up your best weapon so that you can hop into another computer, anyone else who’s on that system can also see your exploit or weapon and grab it for themselves. It’s best to use off-the-shelf stuff because you really have no idea who else is hacking their way around this network, too. The UAE called up Project Raven and gave them a new request.
DAVID: Hey, is there any indication that bribing happened for a particular sport? They want to know if a sport – if there was bribing is because we both bid on this to take place in our country and then they won it. We think that we probably bid higher and we had a much better chance but they won. Then we realized that the requests were all political. [MUSIC] There was no real request about funding the Muslim Brotherhood. There was just the shady request design to push us forward to gain access to this.
JACK: Again, this was odd for David because he came here to do something else. He quit the NSA and moved with his wife all the way across the world to here, the UAE, to battle terrorists. Now he’s learning that’s not what this role is actually for; it’s kind of changed. This is hard to handle. If he knew this is what the job was from the beginning, he might not have moved all the way over here to do it. I think this is when David starts to really question his work here. There were other teams in the villa like I was saying earlier.
David was there to extract information from the target but his team would give that information to another team for analysis which is just in another room in this villa. One of the people in that analysis team was named Lori Stroud. Lori would take the information collected and try to make sense of what it was, and then give it to management and then the UAE officials. Before coming to Project Raven, Lori was a technology consultant for a company called Booz Allen Hamilton. After that, she went on to work for the NSA. But now she’s here in this villa with David. Lori, too, was getting suspicious of the motives that the UAE was giving her.
DAVID: We start getting requests for targeting of, let’s just be honest, journalists and human rights activists. [MUSIC] Again, they started to raise some pretty significant flags.
JACK: There were journalists and activists that were being critical of the UAE government and their leaders. Basically, the UAE saw these people as threats to the nation and wanted this team to get anything they could off them. What stories were they working on? Where were they rallying? Where were they located? What were their phone calls about? Back in the US where David and Lori are from, this is wrong. The First Amendment of the Constitution protects against this. In short, it says congress shall make no law prohibiting the freedom of press or the right of people to peaceably assemble. This was not okay for them to morally or ethically do. As David said, this was starting to go too far. This was becoming a bigger red flag now.
DAVID: There’s no potential threat. The only potential threat is gonna be political. It turned into something that we didn’t really quite – none of us really agreed with. None of us thought it was the right direction for us to be going. We started to raise questions. We started to say hey, I don’t think this is the right way.
JACK: The UAE was requesting more and more from Project Raven which clearly looked like it was for political reasons [00:35:00] and not for threats against the nation. At one point they asked the team at Project Raven if they would consider targeting US computers. If a known terrorist was using a computer in the US, then they wanted the data off that computer. But David is from the NSA, the military. He remembers clearly reading through FISA, the Foreign Intelligence Service Act, and in Section OVSC-1203 it clearly says if you find yourself targeting a US person, you should de-target them at an emergency priority. This was clearly going over the line for David so he advised management to push back on this objective.
DAVID: We told them that we’re encouraging you not to do this, yeah.
JACK: With that, a lot of conversations went back and forth between this company that David and Lori worked for and the UAE government. At one point during her analysis, Lori found that data was collected on US citizens. She decided this was wrong and she said, quote, “I don’t think Americans should be doing this to other Americans. I’m a spy; I get that, and I’m an intelligence officer but I’m not a bad one.” End quote. Lori was not happy with this and started to raise even more questions. By now, over at the villa where Project Raven was, the seams were starting to show. Employees were asking questions. They were feeling hesitant about the work they were doing.
DAVID: Probably at this point, around October/November, there’s a lot of red flags going up for people. Then my wife and I, we left for Christmas break to go back to the states around Christmastime. I think it was December 17th or 16th or 17th when I got an e-mail saying – from our US contracting agency that they’re essentially giving everyone a reprieve on their contract. If you want to go back to the United States, they’ll pack you up and ship you home at no cost. We decided to do that. A lot of people did. There’s also a lot of people who decided to stay but a lot of the people that I operated with on a daily basis decided I’m not staying here, and so they took off.
JACK: After David left, Project Raven continued. They carried out new operations and tasks that were given to them. I’m gonna switch gears here for a minute and bring on someone new to talk about what happens next at Project Raven.
RORI: My name is Rori Donaghy and in 2012, I set up a human rights group that was effectively just a WordPress website and the blog where I set out press releases from. It was called the Emirate Center of Human Rights. I wrote about human rights abuses in the United Arab Emirates because I felt they weren’t getting enough coverage and I had built up some good contacts that helped me with information that happened there.
JACK: Rori was living in London in the UK and he started this little WordPress blog simply to call attention to some of the bad things that the UAE government was doing. But this blog started to pick up and it was getting noticed by some bigger journalists.
RORI: I was getting good coverage and getting access to big platforms. I was being interviewed semi-regularly by the BBC across the English and crucially, its Arabic platforms. Also, the work was being covered a little bit more in places like the Financial Times and The Guardian, places where it was never in discussion about Dubai other than in a positive tourist and business sense. All of a sudden there were these stories about torture and how they were treating people in prison, and political activists, and shutting down of free speech. It was changing, I think slightly, the international image of the UAE at the time.
JACK: Here’s a clip from Rori on the BBC.
HOST: I’m joined by Rori Donaghy who is campaign manager for the Emirates Center for Human Rights based here in the UK. Why is this important?
RORI: This is important because they’ve been tortured and some have been held as – enforced its appearances over the last seven months. We’ve seen the European parliament condemn the human rights abuses in the UAE over the past two weeks.
HOST: Let me quote to you what the attorney general has said. He says that they were arrested for managing an organization with the aim of committing crimes against state security.
RORI: Well, there has been no evidence brought forward for that.
HOST: Neither have they gone to court yet, either.
RORI: They haven’t got to court. No charge has been brought…
JACK: The UAE government did not like Rori talking about them. They told Project Raven to get in his computer and phone and spy on him.
RORI: [MUSIC] One day at work in the Middle East, I got an e-mail asking if I could take part in a human rights panel and if I wanted to take part in it, could I click on the following link and comment on a piece? The link looked like it would go to an Al Jazeera English’s website. But the e-mail address was very odd; it was random and the English was poor, misspelled. [00:40:00] But none the less, I was foolish enough to click on the link. When I did, it didn’t go anywhere. I thought it was very strange so I just forwarded it onto Citizen Lab and Bill Marczak there, who I knew through work. He got to work on it because even at that point, when I sent the e-mail to him, I couldn’t have thought that I was being surveilled. I just thought it was a bit strange. I really had no idea what was going on.
JACK: Rori gave this e-mail to Citizen Lab. They basically do research on espionage going around against civil society. If a journalist or an activist thinks they’re being targeted by malware or espionage from some government, they can go to Citizen Lab to get help. Rori sent this suspicious e-mail to them to check into it.
RORI: After some time, Bill came back to me and told me that I had been the target of this spyware.
JACK: Besides the URLs riddled with spyware, there were a lot of people tweeting at Rori, too. Citizen Lab found thirty-one public tweets sent to Rori that were suspicious. These were all tweets about human rights activities in the UAE with shortened URLs that contained spyware. These tweets were publically sent to Rori but what was really interesting about these tweets is that about six of the accounts that sent these tweets were actually UAE citizens, except they had been arrested. These tweets were sent after their arrest.
RORI: Yeah, this is a common tactic in the UAE which would be to – once they had arrested a political activist or dissident, that they would then take control of their social media accounts and then use them to try and lure other people they would want to pull into their web of surveillance because obviously they couldn’t arrest me because I was living in London. That’s quite a common tactic. It’s a really frightening tactic.
JACK: A very freaky tactic but an effective one because the team at Project Raven did completely infiltrate Rori’s computer and phone. [MUSIC] Bill at Citizen Lab told Rori the bad news.
RORI: He said he believed ultimately was the UAE government to spy on me and probably listen and read all my communications. They weren’t just surveilling me from what I understand; it was also my parents, my other younger brother who’s got special needs who poses no threat to anyone, the school we went to, my partner. I did feel really violated. I guess the thing that I would say most about it is that when people ask about this story, is that it all happens silently. I was just carrying on with my life. When I think about the experience of it, there wasn’t really any experience of it. This all happened so silently. It’s such an effective way of surveilling someone that you have no idea about just how pervasive it is or what they have access to. It’s not an experience as such. It’s just something that happens and then someone tells you about later. It’s quite hard to retroactively feel something because it’s already happened at that point. It’s a very bizarre experience.
JACK: I don’t know, if I learned that a foreign government has infiltrated my computer and was looking at my e-mails, private messages, texts, and knowing what stories I was working on, I’d be extremely freaked out. I think it’s a little weird that Rori didn’t panic more.
RORI: Actually, when you talk about my response to it being weird, I think it’s because I felt safe in London. If I’d lived in the UAE under the fear of this authoritarian government that’s capable of torture and imprisonment for a long period of time, I’d have felt very differently about it.
JACK: That does make sense. If you compare torture and arrests versus being spied on, I guess he got the lesser of two consequences for speaking up against the UAE on that one. He was able to clean up his computer and wipe the spyware off, and was careful not to be infected again. But he looks back on this experience and it’s still a bit shocking to him.
RORI: Do you know, the fact that there was a whole team of people and they must have spent quite a significant sum of money on this. I do find that frightening because that’s still going on now but just to someone else, I imagine.
JACK: While Rori was writing about human rights in the UAE from London, there was another activist also writing about the same stuff, but he was an Emirati. His name was Ahmed Mansoor and Rori talked with him a lot back then.
RORI: Yeah, Ahmed was a close contact and I’d say a friend throughout the time that I covered human rights abuses in the UAE. Ahmed was the number one political and human rights activist in the UAE.
JACK: Here’s a clip from YouTube that’s Ahmed talking about human rights.
AHMED: Hello, ladies and gentlemen. [00:45:00] My name is Ahmed Mansoor from United Arab Emirates. I will focus in this presentation on the latest development related to human rights situation in UAE. The first point that I would like to talk about is the arbitrary detention.
JACK: Once again, this is another person that the UAE government was not happy about and assigned Project Raven to spy on Ahmed as well. The same tactics were used; phishing e-mails from so-called activists, tweets from people who were arrested, and Project Raven also got into Ahmed’s phone and computer and could see pretty much everything he was doing. But Ahmed had a much worse fate than Rori.
AHMED: Ahmed was arrested by the Emirati Authorities and accused of some crime that wouldn’t exist in any democratic state. I think it was communicating with a foreign enemy, something along those lines.
JACK: He was actually charged with damaging the country’s unity which kind of sounds like a made-up crime to me.
AHMED: …and sentenced to ten years in prison. There’s been credible reports of his torture and kept in really terrible conditions in the UAE.
JACK: Jeez, can you imagine? If you speak out against your government and then the government hires a bunch of ex-NSA people to spy on you, and this leads them to find where you live and what you’re doing which then gets you arrested. Then you get put in prison for ten years and placed into solitary confinement with terrible living conditions. Let’s not ignore that all of Ahmed’s family is also spied on. His wife’s phone was also hacked by this group, and she now lives in fear and social isolation as a result of all this.
AHMED: The reason that this has happened to Ahmed is because he has been the lone light in covering human rights abuses in his country for many years and led to him winning prestigious human rights awards including the Martin Ennals Award for Human Rights Defender of the Year. His growing stature as an international human rights defender is really, what I think, led to his arrest because he was known as being – he wasn’t affiliated to any religious or political group that could be used to undermine his credibility by the UAE. Ahmed stood alone as this really respected human rights activist.
I can’t stress enough how brave and courageous he was to do that work in a country where he knew that when he was going to get arrested, which is inevitable, that he would be tortured and treated in such a terrible way. Prior to his arrest, Ahmed was being surveilled in the most pernicious and obtrusive way which, as I’m sure you know, led to Apple having to issue an update to their software because of the way he was surveilled which was through – it was sent to his iPhone.
JACK: Oh right, Apple and the iPhone. Let’s talk about that. Project Raven had access to this crazy hacking tool called Karma. When I read about Karma, it kind of reads like how Hollywood hacking is portrayed. It’s crazy simple and it blows my mind. In 2016, the UAE purchased this hacking tool Karma from some outside vendor. We don’t know who made it or where it was purchased from. The UAE told Project Raven look, we have this great new tool and you can target iPhones with it. But this was its limitation, too; just iPhones. Here’s how it works. [MUSIC] If someone in Project Raven knew their target had an iPhone and wanted data off it, they might decide to use Karma. All you have to do is give Karma the phone number or e-mail address of your target. A text was then sent to that target’s phone. Here’s the craziest part; the user doesn’t even have to click on a link or do anything in order for this exploit to work.
The text just has to get to the phone. Once it got to the phone, the exploit could then steal photos, e-mails, text messages, and location data all without user interaction. It really was an amazing tool for getting the data off these targets. It was too easy, even. We aren’t sure exactly how, but it looks like it was exploiting a flaw in Apple’s iMessage. By sending this crafted text through iMessage, it enables the exploit. In 2017, Apple pushed an update which made this tool much less effective. There isn’t a lot known about this tool, but even just this gives us a sense of what its capabilities were and what Project Raven had at its disposal. David told me he never used Karma himself. I wonder if that just means he told other people to use it.
The UAE government terminated the contract with Project Raven and brought in a new contractor named DarkMatter. DarkMatter is a UAE company owned and operated by UAE citizens. The people who were at Project [00:50:00] Raven had the option; either join DarkMatter or quit. About a quarter of them quit but the rest moved on to DarkMatter. Lori was one of the ones that moved onto DarkMatter. You have to understand Lori was working for government contractors for a while and the NSA. She’s used to doing this kind of clandestine work. In fact, she loves doing cyber-espionage. It’s what she’s good at and this was a good-paying gig so Lori kept at it. UAE was now working with DarkMatter to carry out these objectives and offensive intelligence operations. Lori continued to work for DarkMatter for a while and at one point she got a list of targets. When she looked at the list, she saw that some of them were Americans.
[MUSIC] She looked up their occupation and saw these were American journalists. Oh, this made her sick to her stomach. She raised even more questions about this and started to say this isn’t right. DarkMatter put her on leave. They escorted her out of the building and had her passport revoked. That had to be extremely scary for her; to be in the UAE, upset with the UAE government, and to have your passport taken. She felt like she was probably now a target and being surveilled. She was stuck in this country with no way out. This had to be a very dark time for her. After two months, she was allowed to go back to America. Upon arriving in the states at the airport, the FBI agents questioned her and asked what US citizens were you spying on? But she refused to tell them anything. I think she thought she was under UAE surveillance still at that point, and it was all probably just so stressful.
The FBI still, to this day, has an ongoing investigation about all this. They want to know whether or not classified information was given to the Emiratis, and if targeting US citizens actually happened because these are both clearly illegal and the FBI wants to know if these laws were broken. Still now, DarkMatter is operating and working with the UAE government and NISSA. They’re probably continuing to do all the espionage on behalf of the UAE government. You might be wondering how do I know all this? Well, David just told us, right? But he only told us some of the story. Back in January of this year, Lori came forward and told her whole story to Reuters. Journalists Christopher Bing and Joel Schectman took her story and fact-checked it against a lot of people including eight ex-Project Raven employees.
Chris and Joel did an amazing job reporting this story and published it earlier this year. Of course, I fact-checked their story too. I made a lot of phone calls and wrote a lot of e-mails, and had some very interesting conversations about this whole story. I even called up an ex-NSA person that I know who has contacts in DarkMatter to learn a little more. Yeah, Reuters did a great job on this story and when the story came out, it made really big news. But the only one who allowed her name to be in the story was Lori. Now, for the first time, you heard a second person come forward; David. He has never spoken publically about this until now which is pretty exciting to hear someone else tell us this inside story. It’s kind of a big deal. [MUSIC] I asked Rori what he thought of this story when he read it.
RORI: I remember telling my partner about this story before it was going to come out. She obviously doesn’t think I’m a liar, but she thought it sounded a bit crazy and that maybe I had been duped into thinking that this had happened because of just how crazy it sounded. I had that response myself a little bit when the Reuters guys phoned me initially. I felt that even that at that point, even with all my knowledge and experience of the UAE and the Gulf, I still felt that this side of it had gone a bit far. Like, really? Would they really have gone through this much effort to surveil me? I was still a bit surprised by it all.
I was glad that it came out because I think that people should know the truth about a country that invests huge sums of money to portray itself as a friendly, open, global country that is tolerant and happy but in reality is nothing more than a tin-pot dictatorship with billions and billions of dollars to keep hold of power and lock up anyone who challenges them. That’s a really important thing to know when they’re a close ally of not only my country, the UK, but also America and other European allies.
JACK: Do you think you’ll ever go to the UAE again?
RORI: I wouldn’t feel comfortable going to the UAE even if the president of the country gave me a personal assurance that nothing would happen to me if I went there. Again, it’s not because I feel important or whatever; it’s just that I wouldn’t trust authorities to not harm me because they’ve so consistently done that to a whole range of people from petty [00:55:00] criminals who’ve been there on drugs charges or written a cheque in bad faith, to political activists. I would never feel comfortable going to the UAE.
JACK: Project Raven was a hacking unit working for a company called Cyber Point which is based in Baltimore. The CEO of Cyber Point was questioned about all this and flat-out said the mission of Project Raven was to help the Emiratis defend their network, very similar to what that Purple Meeting said they were doing. But perhaps the CEO didn’t actually know. Perhaps that unit was initially set up to do that but somehow transformed to become offensive all on its own without proper oversight from Cyber Point. David even said over time, the missions changed. This was a secret operation in the UAE; how much of a secret operation is really going to be reported back to Baltimore? DarkMatter has publically said that this entire story written up in Reuters is false, made up. It’s defamatory and it’s unsubstantial and they deny any wrongdoing.
Oh, and check this out; you might have a DarkMatter root certificate in your browser. In 2017, DarkMatter applied to be a sort of certificate authority. They wanted to issue SSL certificates to websites so those websites are secure. All major browsers granted DarkMatter the ability to become a certificate authority with provisional status. Ah! Yes, their root certificates were trusted in all our browsers. After that happened, DarkMatter approved 275 websites to be trusted but this year, that changed. When Reuters published that report, Firefox and Google read it and they saw what DarkMatter was doing. They decided to revoke that root certificate from being trusted. Now certificates from them will show up as untrusted sources.
I helped the other browsers follow suit, too. While I was putting this episode together, I went to Black Hat, the security conference in Vegas. There, Natalie Silvanovich gave a presentation on exploiting iMessage. Let me tell you about Natalie because in my book, she’s amazing. Natalie works for Project Zero and Project Zero is amazing, too. It’s a project that Google started. Basically, the Project Zero team at Google has the job of finding vulnerabilities in software of any kind. It doesn’t have to be just Google vulnerabilities. It could be software with Microsoft or Apple or anything. Natalie works on this team and simply obsesses over finding vulnerabilities in software. After hearing about Karma and what this Project Raven was doing, she decided to take a deep dive and try to figure out how Karma could have worked because it’s really remarkable to just send a message to an iPhone and to get back pictures, texts, location, and more.
Natalie began trying to exploit iMessage on the iPhone. I won’t go into how she found the bugs, but she found three vulnerabilities on the iPhone. Now, when someone at Project Zero finds a vulnerability, they tell the vendor and they give them ninety days to fix it. If it’s not fixed in ninety days, they’re gonna publically disclose this vulnerability. Software companies better move quick once Project Zero tells them about the bugs. Natalie told Apple about these three bugs I think back in May of this year, then she waited. Apple acknowledged the bugs and patched their phones. Once that happened, Natalie published her report about the vulnerabilities found and gave a presentation on it at Black Hat. What she found was really interesting. It’s not the smoking gun and there’s no evidence that this is what Karma was or used, but it might be.
Basically, Natalie found that if you send a zip file to an iPhone, the iPhone then tries to peek inside it to look at the object file within it and then display on the iPhone what kind of files are in there. It does this automatically without the user even trying to open the file or click anything. Here’s the crazy part; when your iPhone gets this file and looks inside it, it looks at this object file inside it which can instruct your phone to go to a URL without the user clicking anything. This alone is useful information; just by visiting a URL you get that phone’s IP address and other metadata about the browser type. This could give you a rough idea of where that person is. But on top of that, it’s requesting a certain thing from that URL and if you send it back a malicious payload to execute, you could do extra stuff to the phone that you shouldn’t be able to do.
This is a fascinating exploit but it doesn’t quite capture all the texts and pictures. But remember that Apple did a patch to iMessage back in 2017 which Project Raven operatives said made Karma less effective. Hm, hopefully now that Natalie has found three vulnerabilities in the iPhone, hopefully this makes Karma completely useless. We don’t know for sure. Now, I wanted to give the last word to David because one of the main reasons why he wanted to come on and share this story is because he wants to give a warning to anyone accepting foreign contract work; if a recruiter comes to you with a high-paying job in another country, [01:00:00] you might want to think twice about it.
DAVID: I guess my encouragement from that perspective is if you are transitioning out of a space like, you know, from a technical or offensive space and you hear of a job tailing, go ahead and take this job over there and do this ‘cause it’s gonna mean it’s a low-level networking position. Just understand and know that what you’re signing up for may not be actually what you’re doing. Where you’re gonna go, what you’re being promised, or what the job description is – is more if you’re going overseas, it’s more than likely not what you’re gonna do. Creating a safety net for yourself is really the right way forward. Say for instance, if you’re married and you’re gonna go take a foreign job and you don’t actually know what you’re gonna be doing, then go without your spouse for the first couple weeks. Kind of see, go over there and fill it out.
That way if you do have to leave and you have to leave in a hurry, you’re not buying two plane tickets out of a country; you’re only buying one. Or if you’re deciding this is not the right space for you, then you can leave significantly faster. If you are going over a certain spot and you have experience doing things and people contact you and reach out to you that you don’t know, you’ve never heard of before, especially if it’s a foreign contracting vehicle, if it’s not an American contracting company, that should of course be a significant red flag. If you’re being recruited for DarkMatter and you have any type of cyber or offensive background in the cyber-security world, chances are you’re not going to be doing what you think you’re doing.
JACK (OUTRO): [OUTRO MUSIC] A big thank you to David for being brave enough to come forward with this story. Amazing, amazing. Thanks so much to Rori Donaghy for sharing his story. Also, thanks to Christopher Bing and Joel Schectman from Reuters. Their article is titled Inside the UAE’s Secret Hacking Team of American Mercenaries. That article is amazing and you should all check it out. It’s got the floorplan of the villa and it goes into so much more detail. Of course, thank you to Lori Stroud. None of this would even be known if it wasn’t for your bravery bringing all this to the light.
For show notes and links, check out darknetdiaries.com and while you’re there, you might as well check out the shop where you can buy stickers and shirts and trust me, it’ll make your friends jealous if you have one of these and you’ll also look really good in one of the shirts from there. This show is created by me, the Pewlett Hackard, Jack Rhysider. Editing help this episode was by the .matrix Damienne and the theme music is by the helmet-wearer, Breakmaster Cylinder. Even though my name is probably put on a list somewhere within DarkMatter, whenever I say it, this is Darknet Diaries.
[OUTRO MUSIC ENDS] [END OF RECORDING]