Serbia

Serbia

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 5003 bytes --]

Hi all,


I travelled through many countries in Europe earlier this month, after
attending a few conferences in Paris and Prague, using an interrail
ticket.

One of the countries I visited is Serbia.  Because the interrail ticket
covered Serbia, I thought it would be a regular European country, but
it isn't.

While inflating my bicycle in a gas station, a police car stopped me,
and the only reason I can imagin for them to stop me is that I have a
dark skin and hair.  I wasn't doing anything wrong.

After they stopped me, they searched me and all of my stuff, for at
least half an hour in the street.  Even the boss of the police station
came to the place.  They claimed there was a problem with my passport
and had to bring me to the police station.  They also looked at my
phone; they asked me to show them the pictures, but I didn't have any
recent ones.

Once in the police station, they searched me again even deeper, and
after some more time, some new people came to the police station.  These
seemed spies (intelligence agents would be the technical term, but they
lacked intelligence, so let's just call them spies), and took an SD card
with my keyring (made me questions about it), took my laptop, and also
took my phone, and ordered me to give them the PIN.  I gave it to them,
since I don't keep any personal information on the phone, precisely
because I expected this to eventually happen.  The few contacts I keep
on my phone have one or two letter names, so they can't get much from
that.  And the laptop and SD card were fully encrypted, so they couldn't
do much with them.

After around 3 hours with the laptop, SD card, and the phone, they
returned it all to me, saying "oh, btw, the phone turned off" (lol!).

Of course, they had hacked the phone.  The fact that they handled it off
already hits that they've been playing with the bootloader.  But I did
see evidence of hacked apps "calling home" to their servers after that.
I won't tell exactly how I discovered it, since it might help them
improve their hacking.  (I will tell details if you ask me in person, or
through encrypted mail.)

At first, I distrusted all of the hardware they took, so I didn't use
the laptop for a few days.  However, after seeing how simple their
attack on the phone was, and after looking at the laptop inside to see
if there was any obvious chip that shouldn't be there, I came to the
conclusion that they haven't done anything to it.  After booting, I also
didn't notice anything wrong in the software.  They could have tampered
with the bootloader or the kernel, or perhaps the hardware, but at least
it wasn't obvious.  Since the quality of the attack on the phone was
really childish, and they seem to do it often (so they should be good at
it by now; they're even using Israeli technology), I very much doubt
they could have done anything to the laptop without me noticing, so I
started using it again.

So, now the Serbian authorities have probably cloned my SSD drive, my
PGP and SSH keyrings, and my .password-store/.  I doubt they have the
ability to break the layers of encryption that protect them, so I won't
revoke my keys for now.  Maybe in 10 years or so I should.  I assume
these might end up in the hands of other countries with more interest in
breaking them.

After all this, they set me free, and in fact, one of the spies seemed
to be interested in me going out to the street.  They probably wanted to
follow where I was going, since they had my phone hijacked.

Near the border with Hungary, another policeman in the street saw me,
and quickly moved his hand to his gun, just in case, and it remained
them until well after I crossed past him.  It seems Serbian policemen
have a problem with people with dark skin, hair, and beard.

After crossing the border with Hungary, I told this experience to the
border patrol in Hungary, and they laughed between them and said this is
usual in Serbia.  It seems the country is deeply corrupt.

I'm leaving quite a few details out of this report, since I don't want
some information to reach them, in case it's useful to them.  But I'll
happily share the full story in person.  :-)

I had been curious for a long time of how indetectable these attacks
with Israeli technology on phones really are.  After this 1st person
experience, I can say that if your phone is ever hacked, you'll most
likely notice.  It was an interesting experience; it probably gave me
more information about them, than to them about me, after all.

I've updated my threat model and protections after this, to be even more
strict on not having anything on the phone.  I've bought a new cheap
phone, and this time I'm being even more strict on my policy of having
no names, no pictures, and no PI at all in it.  Just CoMaps, weather,
offline translation, and a few one-to-three letter contacts.


Have a lovely night!
Alex

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Serbia

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 5560 bytes --]

BTW, I keep the hacked phone, turned off, just in case Google or anyone
else wants to have their hands on it to learn how they hacked it, in
case this helps improve the security of Android phones.


Cheers,
Alex

> Date: 2026-10-28 02:15:52+0100
> From: Alejandro Colomar <alx+linux-man@kernel.org>
>
> Hi all,
> 
> 
> I travelled through many countries in Europe earlier this month, after
> attending a few conferences in Paris and Prague, using an interrail
> ticket.
> 
> One of the countries I visited is Serbia.  Because the interrail ticket
> covered Serbia, I thought it would be a regular European country, but
> it isn't.
> 
> While inflating my bicycle in a gas station, a police car stopped me,
> and the only reason I can imagin for them to stop me is that I have a
> dark skin and hair.  I wasn't doing anything wrong.
> 
> After they stopped me, they searched me and all of my stuff, for at
> least half an hour in the street.  Even the boss of the police station
> came to the place.  They claimed there was a problem with my passport
> and had to bring me to the police station.  They also looked at my
> phone; they asked me to show them the pictures, but I didn't have any
> recent ones.
> 
> Once in the police station, they searched me again even deeper, and
> after some more time, some new people came to the police station.  These
> seemed spies (intelligence agents would be the technical term, but they
> lacked intelligence, so let's just call them spies), and took an SD card
> with my keyring (made me questions about it), took my laptop, and also
> took my phone, and ordered me to give them the PIN.  I gave it to them,
> since I don't keep any personal information on the phone, precisely
> because I expected this to eventually happen.  The few contacts I keep
> on my phone have one or two letter names, so they can't get much from
> that.  And the laptop and SD card were fully encrypted, so they couldn't
> do much with them.
> 
> After around 3 hours with the laptop, SD card, and the phone, they
> returned it all to me, saying "oh, btw, the phone turned off" (lol!).
> 
> Of course, they had hacked the phone.  The fact that they handled it off
> already hits that they've been playing with the bootloader.  But I did
> see evidence of hacked apps "calling home" to their servers after that.
> I won't tell exactly how I discovered it, since it might help them
> improve their hacking.  (I will tell details if you ask me in person, or
> through encrypted mail.)
> 
> At first, I distrusted all of the hardware they took, so I didn't use
> the laptop for a few days.  However, after seeing how simple their
> attack on the phone was, and after looking at the laptop inside to see
> if there was any obvious chip that shouldn't be there, I came to the
> conclusion that they haven't done anything to it.  After booting, I also
> didn't notice anything wrong in the software.  They could have tampered
> with the bootloader or the kernel, or perhaps the hardware, but at least
> it wasn't obvious.  Since the quality of the attack on the phone was
> really childish, and they seem to do it often (so they should be good at
> it by now; they're even using Israeli technology), I very much doubt
> they could have done anything to the laptop without me noticing, so I
> started using it again.
> 
> So, now the Serbian authorities have probably cloned my SSD drive, my
> PGP and SSH keyrings, and my .password-store/.  I doubt they have the
> ability to break the layers of encryption that protect them, so I won't
> revoke my keys for now.  Maybe in 10 years or so I should.  I assume
> these might end up in the hands of other countries with more interest in
> breaking them.
> 
> After all this, they set me free, and in fact, one of the spies seemed
> to be interested in me going out to the street.  They probably wanted to
> follow where I was going, since they had my phone hijacked.
> 
> Near the border with Hungary, another policeman in the street saw me,
> and quickly moved his hand to his gun, just in case, and it remained
> them until well after I crossed past him.  It seems Serbian policemen
> have a problem with people with dark skin, hair, and beard.
> 
> After crossing the border with Hungary, I told this experience to the
> border patrol in Hungary, and they laughed between them and said this is
> usual in Serbia.  It seems the country is deeply corrupt.
> 
> I'm leaving quite a few details out of this report, since I don't want
> some information to reach them, in case it's useful to them.  But I'll
> happily share the full story in person.  :-)
> 
> I had been curious for a long time of how indetectable these attacks
> with Israeli technology on phones really are.  After this 1st person
> experience, I can say that if your phone is ever hacked, you'll most
> likely notice.  It was an interesting experience; it probably gave me
> more information about them, than to them about me, after all.
> 
> I've updated my threat model and protections after this, to be even more
> strict on not having anything on the phone.  I've bought a new cheap
> phone, and this time I'm being even more strict on my policy of having
> no names, no pictures, and no PI at all in it.  Just CoMaps, weather,
> offline translation, and a few one-to-three letter contacts.
> 
> 
> Have a lovely night!
> Alex
> 
> -- 
> <https://www.alejandro-colomar.es>



-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Serbia

[Stefan Puiu]

Hi Alex,

Sorry to hear about your Serbian "experience".

On Wed, Oct 28, 2026 at 2:49 PM Alejandro Colomar
<alx+linux-man@kernel.org> wrote:
>
> BTW, I keep the hacked phone, turned off, just in case Google or anyone
> else wants to have their hands on it to learn how they hacked it, in
> case this helps improve the security of Android phones.
>
>
> Cheers,
> Alex
>
> > Date: 2026-10-28 02:15:52+0100
> > From: Alejandro Colomar <alx+linux-man@kernel.org>
> >
> > Hi all,
> >
> >
> > I travelled through many countries in Europe earlier this month, after
> > attending a few conferences in Paris and Prague, using an interrail
> > ticket.
> >
> > One of the countries I visited is Serbia.  Because the interrail ticket
> > covered Serbia, I thought it would be a regular European country, but
> > it isn't.
> >
> > While inflating my bicycle in a gas station, a police car stopped me,
> > and the only reason I can imagin for them to stop me is that I have a
> > dark skin and hair.  I wasn't doing anything wrong.
> >
> > After they stopped me, they searched me and all of my stuff, for at
> > least half an hour in the street.  Even the boss of the police station
> > came to the place.  They claimed there was a problem with my passport
> > and had to bring me to the police station.  They also looked at my
> > phone; they asked me to show them the pictures, but I didn't have any
> > recent ones.
> >
> > Once in the police station, they searched me again even deeper, and
> > after some more time, some new people came to the police station.  These
> > seemed spies (intelligence agents would be the technical term, but they
> > lacked intelligence, so let's just call them spies), and took an SD card
> > with my keyring (made me questions about it), took my laptop, and also
> > took my phone, and ordered me to give them the PIN.  I gave it to them,
> > since I don't keep any personal information on the phone, precisely
> > because I expected this to eventually happen.  The few contacts I keep
> > on my phone have one or two letter names, so they can't get much from
> > that.  And the laptop and SD card were fully encrypted, so they couldn't
> > do much with them.
> >
> > After around 3 hours with the laptop, SD card, and the phone, they
> > returned it all to me, saying "oh, btw, the phone turned off" (lol!).
> >
> > Of course, they had hacked the phone.  The fact that they handled it off
> > already hits that they've been playing with the bootloader.  But I did
> > see evidence of hacked apps "calling home" to their servers after that.
> > I won't tell exactly how I discovered it, since it might help them
> > improve their hacking.  (I will tell details if you ask me in person, or
> > through encrypted mail.)
> >
> > At first, I distrusted all of the hardware they took, so I didn't use
> > the laptop for a few days.  However, after seeing how simple their
> > attack on the phone was, and after looking at the laptop inside to see
> > if there was any obvious chip that shouldn't be there, I came to the
> > conclusion that they haven't done anything to it.  After booting, I also
> > didn't notice anything wrong in the software.  They could have tampered
> > with the bootloader or the kernel, or perhaps the hardware, but at least
> > it wasn't obvious.  Since the quality of the attack on the phone was
> > really childish, and they seem to do it often (so they should be good at
> > it by now; they're even using Israeli technology), I very much doubt
> > they could have done anything to the laptop without me noticing, so I
> > started using it again.
> >
> > So, now the Serbian authorities have probably cloned my SSD drive, my
> > PGP and SSH keyrings, and my .password-store/.  I doubt they have the
> > ability to break the layers of encryption that protect them, so I won't
> > revoke my keys for now.  Maybe in 10 years or so I should.  I assume
> > these might end up in the hands of other countries with more interest in
> > breaking them.
> >
> > After all this, they set me free, and in fact, one of the spies seemed
> > to be interested in me going out to the street.  They probably wanted to
> > follow where I was going, since they had my phone hijacked.
> >
> > Near the border with Hungary, another policeman in the street saw me,
> > and quickly moved his hand to his gun, just in case, and it remained
> > them until well after I crossed past him.  It seems Serbian policemen
> > have a problem with people with dark skin, hair, and beard.
> >
> > After crossing the border with Hungary, I told this experience to the
> > border patrol in Hungary, and they laughed between them and said this is
> > usual in Serbia.  It seems the country is deeply corrupt.

I'm from a country neighbouring Serbia - Romania. I've been there a
few times, though it's been a while - in 2007, 2011 and 2012 (the
latter two for the Exit Festival, which was quite nice). In 2007 a
police car stopped us and started checking our papers, and were a bit
aggressive verbally, but eventually they let us go, they did not find
anything wrong. They only spoke Serbian, which I don't understand,
luckily we had a guy who could translate with us. Also, they had a
system where foreigners had to tell the police when they were staying
somewhere in Serbia; they were a bit pissed off in 2007 when we did
not have the paper from the police when crossing the border back to
Romania. My impression was that they still had the old police state
behavior from communist times, and also suspicion towards foreigners
of any kind. Were you there before the elections? Maybe there was some
paranoia in the mix as well, who knows... Ceaușescu was quite paranoid
before his overthrow, he was suspecting all kinds of foreign
interference, who knows, maybe Vucic took a page from our guy's
manual.

Anyway, I hope you are OK now.

Regards,
Stefan.

> >
> > I'm leaving quite a few details out of this report, since I don't want
> > some information to reach them, in case it's useful to them.  But I'll
> > happily share the full story in person.  :-)
> >
> > I had been curious for a long time of how indetectable these attacks
> > with Israeli technology on phones really are.  After this 1st person
> > experience, I can say that if your phone is ever hacked, you'll most
> > likely notice.  It was an interesting experience; it probably gave me
> > more information about them, than to them about me, after all.
> >
> > I've updated my threat model and protections after this, to be even more
> > strict on not having anything on the phone.  I've bought a new cheap
> > phone, and this time I'm being even more strict on my policy of having
> > no names, no pictures, and no PI at all in it.  Just CoMaps, weather,
> > offline translation, and a few one-to-three letter contacts.
> >
> >
> > Have a lovely night!
> > Alex
> >
> > --
> > <https://www.alejandro-colomar.es>
>
>
>
> --
> <https://www.alejandro-colomar.es>

Re: Serbia

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 2258 bytes --]

Hi Stefan,

> Date: 2026-10-29 20:49:06+0200
> From: Stefan Puiu <stefan.puiu@gmail.com>
>
> Hi Alex,
> 
> Sorry to hear about your Serbian "experience".

Thanks!

[...]
> 
> I'm from a country neighbouring Serbia - Romania. I've been there a
> few times, though it's been a while - in 2007, 2011 and 2012 (the
> latter two for the Exit Festival, which was quite nice). In 2007 a
> police car stopped us and started checking our papers, and were a bit
> aggressive verbally, but eventually they let us go, they did not find
> anything wrong. They only spoke Serbian, which I don't understand,
> luckily we had a guy who could translate with us.

The cop that stopped me was actually quite nice.  Other than the evident
discomfort of being retained for so many hours, I must say he was nice
verbally, and he was very transparent when searching my bad so that I
saw he didn't take any money (or anything else) from it.  And he spoke
good English.

His boss also offered some soap when I went to his bathroom (which was
quite dirty).

And they didn't hand-cuff me at any time.

> Also, they had a
> system where foreigners had to tell the police when they were staying
> somewhere in Serbia; they were a bit pissed off in 2007 when we did
> not have the paper from the police when crossing the border back to
> Romania. My impression was that they still had the old police state
> behavior from communist times, and also suspicion towards foreigners
> of any kind. Were you there before the elections? Maybe there was some
> paranoia in the mix as well, who knows... Ceaușescu was quite paranoid
> before his overthrow, he was suspecting all kinds of foreign
> interference, who knows, maybe Vucic took a page from our guy's
> manual.

Hmmmm, I entered the country on 2026-10-14, the incident happened on
2026-10-15, and I left the country on 2026-10-16.  It seems I was there
10 days before the election (I only learnt about that election yesterday
night, after writing the email).  That probably made them suspect of
foreign interference, indeed.

> Anyway, I hope you are OK now.

Yup!  Thanks!  :-)


Have a lovely night!
Alex

> 
> Regards,
> Stefan.

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]