But if I told you that the Canadian government actually published a manual, basically a tech
brief, I guess you call it, for its own spyware. Now, this is an official RCMP document, right?
Like it lays out in some technical detail, not totally, it's not all encompassing how they
legally hack into phones and computers using what they call an on-device investigative tool,
or ODIT. That's what we'll call it, I don't know if that's how it's actually pronounced,
but that's how we pronounce it. If you're not Canadian, you might not know who the RCMP is,
and that's the Royal Canadian Mounted Police. They're Canada's federal law enforcement agency.
Like, think of the FBI meets your local police department with horses though,
and now with legal spyware. And before we dig into the tool itself, I just want to kind of explain
something. With a tool like this, it's not anything really new, right? It's basically a
remote access trojan or rat, and they've been around forever in a day. GitHub is absolutely
full of them. They essentially let attackers control the system and turn on things like webcams
and record audio and capture keystrokes and take screenshots and access files, all kinds of stuff,
matrix, all kinds of stuff. Governments use them as well, and hackers use them. Everyone
uses them. Even board teenagers use them. So what makes ODIT different is that it's
government-developed, court-approved, and basically run by a federal agency with
explicit judicial authorization by them. And because the RCMP published their internal
briefing, we got a rare window into how these tools actually work and how they're deployed
at scale and how they talk about them in their own words essentially. ODIT installs on your device,
not your device specifically unless you're on some kind of list and they're failing you,
or if you're not subscribed, just who I had to. It targets phones, laptops, tablets, and
basically once it does it, it doesn't just watch what you do,
it becomes a part of your system. Think of it like that in-law who kind of moves in and eats all
your snacks and drains your hot water but never actually contributes to the actual eating bill,
except this one's quieter and a lot more invasive. ODIT doesn't really need to break
encryption or intercept traffic. It's already inside your system grabbing data before it even
gets encrypted or right after it's decrypted and that's kind of the difference. The encryption
isn't defeated, it's just bypassed and bypassing is always better than breaking it in my opinion.
I prefer it in physical security definitely but it's cleaner in my opinion. It's more efficient,
it's less noisy. There's a lot of benefits to it. ODIT is like having a RCMP agent kind of
sitting there watching your screen and reading your messages and watching what your keystrokes
are but in real time. You're not going to know and yes, they can absolutely listen to you or
watch you whatever they want but here's how it works. It hooks into the actual device as a IOLAR
which just stands for input output and at that point that's where your interactions kind of
hit the system before actually getting processed or encrypted as it were if that's what you're
using. Think of it like tapping a phone right inside the receiver not out on the pole.
You're grabbing the raw signal as soon as it goes in so when you type a message ODIT sees it
in plain text and before your actual secure app actually gets to see it. Now when someone sends
you a message ODIT catches it after your app decrypts it. Encryption side stepping kind of.
Now maybe you see why I've pushed a lot of the times for operating systems like tails
which is amnesiac or compartmentalization like tubes. ODIT talks to the RCMP servers over a
C2 channel and that's basically command and control. It doesn't maintain a constant
connection instead it beacons at regular intervals just like normal device telemetry or push notifications
do and that keeps it somewhat stealthy. Now some variants randomize the check-in times or do things
like mimic background traffic. What's sent back could include encrypted payloads IP data system
status, queued commands. It's basically like a heartbeat. It tells the operator that the tool
is actually alive and it's functioning as expected and listening or watching so persistence is another
layer basically. The document doesn't really go into it which is really unfortunate but
ODIT clearly has to survive things like reboots because those happen. Now this means
privilege escalation and on Android that might mean abusing device admin settings
on Windows. It could be something like involving registry changes or DLL injections
like whatever the method actually is it hides itself very deep in the system often with
rule level privileges and no RCMP isn't just exfiltrating raw data by itself. It's actually
compressing and encrypting and packaging it before it actually gets transmitted
and probably with a symmetric cipher and that minimizes things like its size it protects integrity
and it conceals the payload. So if you're scanning like your outbound traffic and you see
being encrypted blobs heading to RCMP IP addresses you're pretty much already too late
but legally the RCMP does this under a warrant and that's one way that they kind of differ
from the NSA and other intelligence agencies that are out there from what I understand from
the small amount of research that I did. Canada's law actually requires three warrants.
One for transmission of data and another for intercepting computer functions
and a third under part six of the criminal code in Canada which is basically for private
communications but once they've got those in place the gloves come off. So Odit can actually grab
stored app data documents messages even stuff like cloud data that's accessible from the device.
Now this isn't like full forensic imaging it's much more selective right so Canada the RCMP's
covert access and interception team decides what gets pulled right it keeps it stealthy and
official or officially within the scope of the warrant so they say but honestly like 99%
of the time these tools are absolutely abused we've seen that across almost every single agency
including the most technically proficient ones so Odit logs everything you type or tap keystrokes
passwords chats right before encryption kicks in like so before and that's kind of like what
the UK tried with chat control which now they rebranded into something as equally Orwellian
but it takes screenshots right periodically or when certain apps are open up so like imagine
you're checking your encrypted email right too bad it's already grabbed the screen so
the video calls it's the same story tools like signal encrypt audio in transit but
Odit records it before it's encrypted on your end or after decryption on the other
party's end so the RCMP then reassembles the stream server side and when we talk about things like
video calls like does it work on video calls from what the documentation says not directly
with screenshots kind of make up that difference microphone can be activated remotely signal
leave it records the room it records conversations it records ambient sound right it's it's not a
live wire tap so to speak but it's more like a hidden recorder that like you didn't know your own
that you take everywhere with you and the camera as well like let's not forget that the front or
the back or both no shutter no flash like no indication whatsoever that it's actually happening
just kind of silent snapshots in the background installation can be physical or remote just like
any other rat it that there's no difference really with any of this stuff if they have the device
they can also side load it if not it's delivered over the network through things traditional means
your exploits and vulnerabilities or just plain old good old-fashioned social engineering it
identifies target devices and basically removes itself from other ones which it's really discreet
quiet and targeted from its again from its own documentation so now if it detects itself on another
device or the wrong device it removes itself so it's it's fairly discreet and quiet and targeted
and every so often it checks it right it uploads data gets commands metadata IP addresses included
obviously that's very handy geolocation data data integrity is verified when it's used
via hashing so before and after an upload if it fails the check the data is basically thrown away
if it passes it's deleted from the device captured data isn't always sent straight to investigators
if it includes privileged or irrelevant material it's stored securely filtered and basically
only what's approved is actually handed off or so the rest of the data is supposed to be
deleted do they actually delete it who knows right probably not so they're also saying it if no charges
are actually filed then the data is also purged if there are charges it may be retained through
appeals and that could be in the federal system down here that could be yours i don't know about
canada but the target never gets notified there's no alerts no performance hits no antivirus flags
very small footprint maximum invisibility the tool is powerful it's it's invasive and it's powerful
and it's legal and that's why it matters basically when a government rat comes with a badge and a
budget and a core order like the optics might change a little bit right they might look cleaner
but the effect really doesn't encryption is irrelevant in that case but you can't protect
what's already stolen from the inside of your system and the only reason we're actually having
this discussion is because i think it's interesting to look at government malware or or how they say
they implement it and because at the end of the day reading their own documentation about how they
use tools like this can absolutely have an upside to understanding who you're actually
dealing with and even though this isn't a us-based document it's not a us agency
that's fine because we can still learn from we still look at it and evaluate it and hopefully
get some value at it i found it i thought it was interesting so i figured i'd make a video
about it maybe i figured you guys might see it as interesting as well let me know what you think
in the comments i definitely like to hear about it in any case i did look i'd look this up in
doing some research on this it was very interesting finding some of the weird articles that would
pop up where they would talk about how they're not using malware on phones and it was just really
weird i think it's kind of a open thing now which is why i ended up actually making this video about
it if it was something that was still very secretive i don't know if i actually would have i would
have to actually get into the whole legally is it a loud kind of thing but whatever um i didn't
do that on this one i just i was like oh look it's common knowledge i'm gonna talk about it
so i hope you guys enjoyed learning about it i definitely enjoyed reading about it and the
link for the actual pdf will be down in the description so thank you for watching i'll see you in the next video