Re: Serbia

[Alejandro Colomar <alx+linux-man@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 5560 bytes --]

BTW, I keep the hacked phone, turned off, just in case Google or anyone
else wants to have their hands on it to learn how they hacked it, in
case this helps improve the security of Android phones.


Cheers,
Alex

> Date: 2026-10-28 02:15:52+0100
> From: Alejandro Colomar <alx+linux-man@kernel.org>
>
> Hi all,
> 
> 
> I travelled through many countries in Europe earlier this month, after
> attending a few conferences in Paris and Prague, using an interrail
> ticket.
> 
> One of the countries I visited is Serbia.  Because the interrail ticket
> covered Serbia, I thought it would be a regular European country, but
> it isn't.
> 
> While inflating my bicycle in a gas station, a police car stopped me,
> and the only reason I can imagin for them to stop me is that I have a
> dark skin and hair.  I wasn't doing anything wrong.
> 
> After they stopped me, they searched me and all of my stuff, for at
> least half an hour in the street.  Even the boss of the police station
> came to the place.  They claimed there was a problem with my passport
> and had to bring me to the police station.  They also looked at my
> phone; they asked me to show them the pictures, but I didn't have any
> recent ones.
> 
> Once in the police station, they searched me again even deeper, and
> after some more time, some new people came to the police station.  These
> seemed spies (intelligence agents would be the technical term, but they
> lacked intelligence, so let's just call them spies), and took an SD card
> with my keyring (made me questions about it), took my laptop, and also
> took my phone, and ordered me to give them the PIN.  I gave it to them,
> since I don't keep any personal information on the phone, precisely
> because I expected this to eventually happen.  The few contacts I keep
> on my phone have one or two letter names, so they can't get much from
> that.  And the laptop and SD card were fully encrypted, so they couldn't
> do much with them.
> 
> After around 3 hours with the laptop, SD card, and the phone, they
> returned it all to me, saying "oh, btw, the phone turned off" (lol!).
> 
> Of course, they had hacked the phone.  The fact that they handled it off
> already hits that they've been playing with the bootloader.  But I did
> see evidence of hacked apps "calling home" to their servers after that.
> I won't tell exactly how I discovered it, since it might help them
> improve their hacking.  (I will tell details if you ask me in person, or
> through encrypted mail.)
> 
> At first, I distrusted all of the hardware they took, so I didn't use
> the laptop for a few days.  However, after seeing how simple their
> attack on the phone was, and after looking at the laptop inside to see
> if there was any obvious chip that shouldn't be there, I came to the
> conclusion that they haven't done anything to it.  After booting, I also
> didn't notice anything wrong in the software.  They could have tampered
> with the bootloader or the kernel, or perhaps the hardware, but at least
> it wasn't obvious.  Since the quality of the attack on the phone was
> really childish, and they seem to do it often (so they should be good at
> it by now; they're even using Israeli technology), I very much doubt
> they could have done anything to the laptop without me noticing, so I
> started using it again.
> 
> So, now the Serbian authorities have probably cloned my SSD drive, my
> PGP and SSH keyrings, and my .password-store/.  I doubt they have the
> ability to break the layers of encryption that protect them, so I won't
> revoke my keys for now.  Maybe in 10 years or so I should.  I assume
> these might end up in the hands of other countries with more interest in
> breaking them.
> 
> After all this, they set me free, and in fact, one of the spies seemed
> to be interested in me going out to the street.  They probably wanted to
> follow where I was going, since they had my phone hijacked.
> 
> Near the border with Hungary, another policeman in the street saw me,
> and quickly moved his hand to his gun, just in case, and it remained
> them until well after I crossed past him.  It seems Serbian policemen
> have a problem with people with dark skin, hair, and beard.
> 
> After crossing the border with Hungary, I told this experience to the
> border patrol in Hungary, and they laughed between them and said this is
> usual in Serbia.  It seems the country is deeply corrupt.
> 
> I'm leaving quite a few details out of this report, since I don't want
> some information to reach them, in case it's useful to them.  But I'll
> happily share the full story in person.  :-)
> 
> I had been curious for a long time of how indetectable these attacks
> with Israeli technology on phones really are.  After this 1st person
> experience, I can say that if your phone is ever hacked, you'll most
> likely notice.  It was an interesting experience; it probably gave me
> more information about them, than to them about me, after all.
> 
> I've updated my threat model and protections after this, to be even more
> strict on not having anything on the phone.  I've bought a new cheap
> phone, and this time I'm being even more strict on my policy of having
> no names, no pictures, and no PI at all in it.  Just CoMaps, weather,
> offline translation, and a few one-to-three letter contacts.
> 
> 
> Have a lovely night!
> Alex
> 
> -- 
> <https://www.alejandro-colomar.es>



-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]