Let's begin here in John's Gospel. We're in chapter 2, and I'm going to read verse 13 first. I'm going to give you a long introduction. Just be prepared for that. And I'll be doing that at verse 13. And then my conclusion is also going to contain a few things that will take me a little time to develop. But I'll just begin by reading verse 13 and give you an introduction that gives you a bit of information, and then we'll move through our study. So John chapter 2 verse 13, John writes, the Passover of the Jews was at hand, and Jesus went up to Jerusalem. One aside, notice with me that he says, went up to Jerusalem. Whenever you see them making a journey to Jerusalem, you will always see it saying they went up to Jerusalem. That's because Jerusalem is higher in elevation. And so you'll see that. You'll notice that as you go through your Gospels and all it's always went up to. And so it says here, the Passover of the Jews was at hand. So let me develop some things with you concerning that. The Passover of the Jews was at hand. When you look at the New Testament, the New Testament consists of 27 books. The first four books of the New Testament are called the Gospels. The word Gospels speaks of the good news. And so the first four books of the New Testament called the Gospels are intended to communicate to us the good news, the good news of salvation through Jesus Christ. So when you read the Gospels, you'll see that each Gospel that was written has a purpose. You'll see that when you read the Gospel, for example, of Matthew, you'll see Matthew wrote to the Jews and in the Gospel of Matthew, because he's writing specifically to Jewish readers. He quotes the Old Testament more than any other Gospel writer. When you read Mark and you read Luke, Mark and Luke wrote mainly to Gentiles. And Mark specifically was writing to Romans. Luke was writing more specifically to the Greeks. But as they did so, they were revealing to these people that Jesus is the world's Messiah. But John writes to a mixed audience. And so that's one of the reasons why in his Gospel, you'll see that he makes sure to explain to his reader certain things. That's why he begins by saying the Passover of the Jews. So he's actually writing an explanation as he does this. And so he's speaking now of the Passover of the Jews. Now, it's interesting that John uses the term the Jews around 66 times in his Gospel. Now, to contrast that, Matthew uses the term five times, Mark six times, and Luke uses that term five times. And so the Jews is a term that you find often here in the Gospel of John. And he's speaking of the Passover of the Jews. We'll look at that for a moment. The last time we saw that Jesus had been in the city of Capernaum, rather Cana. He was attending a wedding and he stayed a short time because he wanted to be present for Passover. So he went from Cana to Capernaum and stayed a short time because he wants to go to Jerusalem for the Passover. Jesus is what is referred to as an observant Jew. That means he celebrated the feast and all and he was celebrating Passover. And the celebration of Passover was a lifelong habit of Jesus. You see all the way back in Luke chapter two, verses 41 and 42, how that his parents, Joseph and Mary went to Jerusalem every year for the feast. And so he was someone who from really the beginning of his life was an observant Jew and would often and always celebrate Passover. And so this is the first Passover that he's observing after his baptism. When you look at Passover, Passover is one of the three major feasts, along with the Feast of Pentecost and the Feast of Tabernacles. It's a celebration that reminds the children of Israel of their deliverance from Egyptian bondage. According to the Old Testament Book of Deuteronomy 16 verse 16, it is a mandatory festival for attendance of males of a certain age. You see, they're celebrating a certain event in the history of Israel that is very important. Israel, the family of Jacob, had lived in Egypt for over 400 years and they had grown numerous. And at the end of those years, we know in our scriptures as we read the Bible that they ended up suffering in bondage and the bondage that they were enduring was great. And so when you read your Old Testament about that, you see that they began to cry out to God for deliverance. It's it's recorded in the book of Exodus. And so the Lord God appeared to Moses and told him that he had heard the cry of his people and that they would be delivered. In Exodus chapter three, verses seven and eight, it says, the Lord said, I have surely seen the oppression of my people who are in Egypt and have heard their cry because of their taskmasters, for I know their sorrows. So I have come down to deliver them out of the hand of the Egyptians and to bring them up from that land to a good and large land to a land flowing with milk and honey to the place of the Canaanites and the Hittites and the Amorites and the Parasites and the Hivites, the Jebusites, the Salulites, Uptites, Adesites and the rest of thoseites. I always say that and you still laugh. I don't get it. Lots of bites. And so we know that through a series of 10 plagues, God judged the nation of Egypt and as God was judging the nation of Egypt, he is actually judging the gods, the false gods of Egypt. According to Numbers 33, verse four on their gods, the Lord had executed judgments. And so when God brought judgment, that provoked the Egyptians to let his people go. Now, as you look at the plagues, the last plague was on all the firstborn from animals all the way to Pharaoh. According to Exodus 1212, God said, I will pass through the land of Egypt on that night and will strike all the firstborn in the land of Egypt, both man and beast. And against all the gods of Egypt, I will execute judgment. I am the Lord.  When the destroyer came and saw the blood, he would pass over the house. That's where you get the term pass over from. In Luke 12, verse 13, it says, the blood shall be assigned for you on the house where you are. And when I see the blood, I will pass over you.  And so you have the Passover. Passover was a foreshadowing of a greater deliverance, a greater redemption that was yet to come. The Passover is intended to foreshadow the death of Jesus, the Messiah and his covering us with his blood. Paul speaks of that in 1 Corinthians five, verse seven, when he says, indeed Christ, our Passover was sacrificed for us. Now, at the Passover celebration, a lamb that was slain would be consumed in a meal. The sacrificial lamb was to be kept from the 10th day to the 14th day, according to Exodus 12, three through six. On the 14th day, it was to be slain and it was to be eaten. Someone would say, why did that lamb remain with that family that was only going to slay it and eat it? Why was it there for so long? It was there for a long time so that emotional attachment would occur. They would have this lamb and the children, especially would grow attached to it. That's what happens if you have an animal that is being raised in your home and you may not, as a child, realize at first that it's being raised for a meal. My wife, Marie, grew up here in Chino and she tells me how that when she was a little girl, her dad had bought a calf and they fell in love with that calf. They even named the calf. You know, I forget what the name was, Daisy or something like that. Bessie, Bessie. Marie called her Bessie. Her dad called her dinner. And there's an attachment. There's an attachment that took place. And that's what happens when you have, especially a lamb.   A little salt, some pepper and some. No, lambs are cute and the babies would grow attached. So that's why they had them. They wanted them to have an attachment to this animal. They wanted to do that. They wanted that because when it was slain, it would cause them sorrow because the death of Messiah in the future, it ought to cause a sorrow. And there needs to be an attachment in some like that. So slain, the lamb should cause pain to the ones who slay it. Now, each family had a lamb. If the family was small, a neighbor would join them. In Exodus 12, 4, it says, if the household is too small for the lamb, let him and his neighbor next to his house take it according to the number of persons. According to each man's need, you shall make your count for the lamb. So if I had a small family, then I would join with another family. And so through these different families, I would be reminded of sacrifice. I would be reminded of deliverance. I would also realize that genuine faith is lived out in community, not simply individually. See, we call ourselves a Jesus people community to remind ourselves that we belong to each other because faith is lived out in community. And so Jesus Christ celebrated as an observant Jew this this festival celebrating the reality of the Passover where the firstborn were slain and the children of Israel were set free. We're delivered and so we know that Jesus was around 33 years old when he was crucified. And we get another observation before I get into the actual text about this as we're looking at this, because again, in verse 13, it says the Passover, the Jews was at hand. This is the first Passover that John records that Jesus celebrates. So we know that Jesus was about 33 years old when he was crucified. But sometimes people will say, how did you come to that conclusion? Let me show you how. One, we know his approximate age when he began ministry because according to Luke 323, Jesus himself began his ministry when he was about 30 years of age. John records Jesus celebrating three passovers. You have this one here found in this chapter, chapter two. But you see a second Passover mentioned in John chapter six. And the third Passover mentioned in John chapter 11. So that tells us that he celebrated three passovers. He began his ministry when he was around 30 years of age. And that's how you come to the age of 33. When people say that was the age that he died. And so Jesus is about to celebrate one of the great feasts of Israel. This is again a feast that celebrates God's deliverance from bondage. And it's one of those celebrations that is filled with joy. Now, as he's about to celebrate, there's something he encounters as he enters into the court of the Gentiles. In verse 14, he found in the temple those who sold oxen and sheep and doves and the money changers doing business. When he had made a whip of the cords, he drove them all out of the temple with the sheep and the oxen and poured over the changers money and overturned the tables. And he said to those who sold doves, take these things away. Do not make my father's house a house of merchandise. So we get to see sweet and gentle Jesus angry. You know, a lot of times we have this picture of Jesus that's just not biblically balanced. We artists of old have pictures of him very often with kind of a sad look in his face. Sometimes they'll have a sheep on his shoulder with a sad look. And you see him in a certain way. This is one of the introductions that we see of Jesus, where he actually has a zeal. He actually has a ferocity of righteousness that we get to see in the cleansing of the temple. And we'll be seeing that in some detail in just a moment. Let me develop this where he's at is called the court of the Gentiles. As he enters into this court of the Gentiles, he's encountering people who do business. When we go to Israel, we go to a place called the southern steps. The southern steps are the steps that Jesus. These are actual steps. This is one of the places in Israel that you know, beyond a shadow of doubt that you are actually walking in the exact place Jesus himself would have walked. That's how old these steps are. And these steps called the southern steps will take you up into what is called an area that was called the court of the Gentiles. And as he's walking into this court of the Gentiles, he begins to encounter people and they're doing business. There had been booths that were set up for the purchase of sacrificial animals, as well as for changing money. What had happened is the area had been turned into a marketplace. And you have to picture it that way. It's crowded. It's noisy. And it smells. There are merchants who are selling oxen. They're selling sheep and doves. They're selling oil. They're selling salt. All of these are ingredients for the Passover supper. And they had concession fees that were being charged. And so the people with the concession stands were profiting off of the religious devotion of those pilgrims. You see, the sincere pilgrims who had come to celebrate were being robbed. You see, to celebrate Passover, it was necessary for them to have an offering. And so the priests had established inspectors to ensure that the offering that was being offered was acceptable. So they they actually had people there who were inspecting the animals, looking for imperfections. According to the Old Testament Book of Leviticus 22 verses 21 and 22, it says, when anyone brings from the herd or flock a fellowship offering to the Lord to fulfill a special vow or as a free will offering, it must be without defect or blemish to be acceptable. Do not offer to the Lord the blind, the injured or the maimed or anything with warts or festering or running sores. Do not place any of these on the altar as an offering made to the Lord by fire. And so these priests would inspect the animals that were about to be offered and they would reject them. And when they rejected the animal that was being presented, they would sell them another animal. They would confiscate theirs and they would make a profit off of the people by selling them a more expensive animal. One writer says that the pilgrim often paid up to ten times the actual value of the animal. Now, at the same time, many would pay what they call the temple tax. The temple tax was a maintenance tax for the temple. So if they brought in foreign currency, they would recognize foreign currency as unclean. And so you had to exchange it. They had the money changers and so they would take the foreign money. They would exchange it for Jewish shekels. And the rate of exchange was up to 25 percent. So they were ripping them off with the animals and with the money exchange. One commentator said that the priests and Levites very often sold the animals they had received for sacrifices to the dealers in cattle at a lower rate that they might sell them again with profit. So that the same sacrifices were often sold to different persons and the profits were divided between the priests and the salesman. And this is well known and Jesus sees this taking place. So as he walks in again, verse 14, he found in the temple those who sold oxen and sheep and doves and the money changers doing business. When he made a whip of cords, he drove them all out of the temple with the sheep and the oxen and poured out the changers money and overturned the tables. And he said to those who sold doves, take these things away. Do not make my father's house a house of merchandise. I can't I can't imagine what a scene that would have been. Here comes Jesus and you can almost see him standing there. Looking at what's taking place. And it's not as if that's the first time by the way that he's ever seen this. He's more than likely seen this many times, but now it's time for him to do his ministry and he walks in. And as he's looking there and you wonder if his if his disciples, his apostles were standing with him as he was looking and perhaps they had no idea what was about to take place. And then Jesus goes up to a table and you can see all the coins and stacks and all and he grabs the table and he throws it. Can you picture that and the coins that are on the table? They're all just scattering. And he goes to another table and another table and he's throwing tables and the people at that point are and now he picks up some cords, some some reed that's on the and he fashions it into a whip.  But it's something that will sting and he begins to use this and drive the people out with it. It just would have been an amazing thing that was taking place. He was angry. It was angry. Why was he angry? Well, cleansing God's house was first the first and the last care of Jesus Christ. We need to remember that the temple is where the people came to worship God. This outer court where they were at was the only place all nations could assemble in the temple precincts. There were other courts. There was the court of the women, court of the men, court of the priests, but those were restricted to Jews alone. The court of the Gentiles allowed both Jew and Gentile to assemble and the Jews and the Gentiles would assemble together. And it was a place that there were actual teachings in prayer. Jesus, very often in his ministry, would teach in the court of the Gentiles. Rabbis would go there and very often their their disciples that they were mentoring would come in and be seated around them. So this was a common practice. Jesus went there quite often. But it was a place that was was intended to to be for all nations so that people could hear the things of God. And and they would come together that there might be worship of God. All the nations could gather there to learn of God.  This is what is called the first cleansing. But in Mark, Chapter 11, verse 17, at the second cleansing, Mark said that he, Jesus, taught them, saying them, saying to them, Is it not written, my house shall be called the house of prayer for all nations. You have made it a den of thieves. And so that was what was taking place. Jesus is there. He walks in. He sees all these people making a profit off the religious faith of those pilgrims who come. They're they're they're getting ripped off with the maintenance tax. They're getting ripped off with with their offerings that they're making, their sacrifices and his zeal and his passion for the father fuels him. And he cleanses the courtyard, seeing his father blasphemed, his temple desecrated and people being stumbled, angers him. God's house is to be a house of prayer for all nations and not just for Israel because God cares for the world. And Jesus is pointing this out. God so loved the world. John will later on say the whole world, not just you, but the whole world. And this is a place where worship of God was supposed to take place. This is a place where Israel could speak to the Gentiles and tell them about the wonderful works of God. This is a place that was set apart for the worship of the Lord and it's being polluted by materialism and sinful greed. And it caused Jesus to be passionately angry. And God wanted people to know who he is. And so it's interesting to note here that as this is taking place in verse 17, his disciples remembered that it was written, Zeal for your house is eating me up. Zeal for your house. It causes them to to think of a scripture from the Psalms. It's Psalm 69 verse nine. This is the act of a reformer. This is the act of the Messiah and the zeal of the Lord causes a righteous indignation. To just come out of the Lord Jesus Christ. I suspect and I'll just say this briefly. I want you to think with me for just a moment. I'm certainly not saying that every pastor should be mad in the pulpit. In the Allen carry on, I don't believe that at all. But I do know that we're in a time when people people are not understanding the holiness of God. And even the church itself has a difficult time coming to terms with Jesus actually being angry over something. We have we have been so wrapped up in in his grace and goodness and love for us that we sometimes forget that he's also one who has a righteous anger. And when you see Jesus entering in and you see him doing this and cleansing the temple, it ought to cause us as believers to to think and to understand that there are some things that really get the Lord angry. There are some things that really provoke him. And this is one of them when his house is to be a house of prayer, but it's being transformed into a den of thieves. And there have been times and I'll say it like this, that I as I have taught I have I've made a statement about something that's going on in the church world. And and I'll say this is really a wrong thing, whatever it may be, whether it's some TV evangelist saying, I need another forty million dollars for an airplane so I can fly around the world, bringing the gospel to people, you know. And and I'll say that is truly a wrong thing.  What do you think you're the only person who can preach the gospel? And people even in my church will get upset at me for saying something like that, thinking that I'm judging somebody when, in fact, there should be an indignation within our hearts. When somebody is profiting off the gospel of Jesus to the loss of souls, because people only see this guy saying, give me money and his self importance and they won't listen to the gospel when it's being preached. And that grieves me. And so there have been times when I have stood up over the years. I've been doing this for a while here and I have said, this is wrong. And you'll be surprised at how some people respond.  What makes you and that there's no discernment in the body of Christ today? We simply accept everything as being OK. And I wonder what we the church would do if a John the Baptist type showed up. Repent.   I really don't think you'd see him on many Christian TV programs. And he probably wouldn't have a great following in churches. I'm sure he wouldn't. And if you look at some of the messages Jesus gave and we will be doing that as we go through John's gospel and I'll bring you to Matthew 23, I'm sure, in various places. There were times when Jesus spoke in such a straight and convicting way and people seem to forget that God is the God of truth. And the things that he says are of great importance to hear. And when you see Jesus turning over tables and saying to them, take these things away. Don't make my father's house a house of merchandise. Don't reduce the house of God, which is to be a house of prayer for all men in all nations. Don't reduce that to a place where you profit off of people's faith. And I have to tell you, the church sometimes is very guilty of that. Not every church, but some are guilty of profiting off of the devotion and love of people and their faith in God. And God hated it then and he hates it now. And as this is taking place, his men, his disciples are remembering a scripture. Zeal for your house has consumed me.  Well, as this takes place, the Jews answered and said to him, what sign do you show to us since you do these things? And Jesus answered and said to them, destroy this temple. And in three days, I will raise it up. And so they ask him, by what authority are you doing these things? It's interesting to note this. They didn't dispute with him that what he did was right. But they're saying, who, who, who are you to do these kinds of things? And so what does Jesus do? Well, he gives the answer in verse 19, destroy this temple. And in three days, I'll raise it up. Now, this is the clearest sign that you will ever have of my authority. Destroy this temple is speaking of his resurrection.  Later on in John 10, verses 17 and 18, he says it like this. He says, therefore, my father loves me because I lay down my life that I may take it again. No one takes it from me, but I lay it down of myself. I have power to lay it down and I have power to take it again. This command I have received from my father. What authority do I have? The authority of the resurrection. And that's what he's speaking about. So they're taking him literally, notice their response in verse 20. The Jews said it's taken 46 years to build this temple. And will you raise it up in three days? And so. They're thinking of how Herod, a builder, had been repairing and beautifying the temple for many years. Now, Herod is known for that. Again, when you go to Israel, you'll see places that still are lasting to this day that he built. And so he's known as a builder. Now, he would do this because he worked on the temple because he liked to build, but he was also trying to win over the Jews. And like they said, this work has been continuously going on for 46 years. And so when they say it's taken 46 years to build this temple and and will you raise it up in three days, they're taking him literally. But notice verse 21, I want to develop this with you for a moment. He was speaking of the temple of his body. Now, this is a very important, essential of Christian doctrine. And I want to spend a moment with you developing this. This is an important thing for us as believers to get a hold of. So I'll take a drink and begin. One of the essentials of the Christian faith is the physical resurrection of Jesus's actual body. If you take notes, you might want to note that. One of the essentials of the Christian faith is the physical resurrection of Jesus's actual body. There are theologians who do not believe in his actual physical resurrection. Some say that the Gospels are just inconsistent in their accounts. And so the resurrection of Christ as recorded in the Gospels, they'll say, are simply stories. There are other theologians who believe that myths influence the beliefs of the early Christians. And so they were incorporating resurrection myths, they say. And these are, quote unquote, Christian theologians who say this. Some think that his resurrection is a story that actually gained influence years later and not during the period of time he was crucified, died and was buried. And there are others who say that Jesus's resurrection was only spiritual and was not a physical resurrection. When I was in Bible college, I took a course in Azusa Pacific. And one of my Bible teachers was teaching on this subject and he said something like this. He said, does it really matter if you believe in the actual physical resurrection of the body of Jesus Christ? He says, why can it not be only a spiritual resurrection, only spiritual, but not physical? And that is something that one of my professors at Azusa Pacific was postulating as a possible answer because he did not apparently believe in the physical resurrection of Jesus Christ. And his question was, is this an essential for us as believers to actually hold fast to or cannot you believe that it was spiritual in nature and not physical? So I want to supply an answer for that. I'll take it one step further and I'll say that there is a cult called the Jehovah's Witnesses. All of us are familiar with at least the name Jehovah's Witness. And the Jehovah's Witnesses teach that Jesus was not physically resurrected in their booklet. You can live forever on Paradise Earth. They say Jesus rose as a spirit creature and that the material body of Jesus was taken away by Jehovah. That's what Jehovah's Witnesses believe. They may have come to your door, Easter just passed. They came to mine. I wasn't home. I was looking out the window. No, I wasn't home when they came, but they leave their brochures in the material. Perhaps they did with you. They go through all of our neighborhoods and leave their material during Easter. That's what they believe. They believe and this is taken from one of their sources. In the booklet, you can live forever on Paradise Earth. This is what they say. They say Jesus rose as a spirit creature, the material body of Jesus was taken away by Jehovah. That's what they teach. They do not believe in the physical resurrection of Jesus Christ. They say that he was spiritually resurrected. They teach that Jesus took on different physical forms when he rose from the dead. And they use as examples the fact that that they say that he appeared as a gardener to Mary Magdalene. They say that he assumed a different body when he appeared on the road to Emmaus to those two disciples. And they'll they'll say, well, see, Mary, he was a gardener. And the two there on the road to Emmaus didn't recognize him because he had assumed a different form. I don't know if you've ever spoken to Jehovah's Witnesses. That's what they'll tell you. That's what they say. They'll say that that Mary saw him as a gardener because Jesus looked like a gardener. That's what they'll say. They'll say when these two disciples on the road to Emmaus were joined by Jesus in conversation, they will tell you that he was in a different form and that he didn't look like Jesus, but assumed a different likeness. That's what Jehovah's Witnesses will tell you. Is that true? Did Jesus assume the body of a gardener? Well, when Jesus spoke to Mary in John 20, verse 15 and asked, why are you weeping? Whom are you seeking? John tells us that she supposing him to be the gardener. So that tells us that she made a mistake. When you take into consideration that Mary, it was dark, that she was weeping, she is emotionally traumatized.  When he appeared to the two disciples on the road to Emmaus, Luke tells us that they didn't recognize him because according to Luke 24, 16, their eyes were restrained so that they did not know him. Their eyes were restrained. It wasn't that he assumed a different form. It's that their eyes were restrained, they were unable to see him because he intentionally restrained them from recognizing him. And that's what's going on. So no, he wasn't assuming different bodies. As for Jesus having a spirit body, Luke tells us that when Jesus appeared before his 11 apostles, that they thought they were seeing a spirit and Jesus told them, why are you troubled? Why do doubts arise in your hearts? Behold, my hands and my feet, that it is I myself handle me. And then he goes and says, for a spirit does not have flesh and bones, as you see, I have. So a spirit does not have flesh and bones, though they'll say, well, wait a minute, the Bible says that flesh and blood cannot inherit the kingdom of God. Well, Jesus said he had flesh and bones. Why flesh and bones and not flesh and blood because he poured out all of his blood on the cross. And so he doesn't have blood anymore. And so that scripture doesn't apply. Jesus's body was flesh and bones. Somebody said the bodily resurrection of Jesus is the most important event in history, providing irrefutable evidence that Jesus is who he claimed to be the Son of God. The resurrection was not only the supreme validation of his deity. It also validated the scriptures, which foretold his coming and resurrection. Moreover, yet authenticated Christ claims that he would be raised on the third day and it is the event that provides hope that we will also be resurrected. Apart from Jesus's bodily resurrection, we have no savior, no salvation and no hope of eternal life. As the Apostle Paul said, our faith would be useless and the life giving power of the gospel would be eliminated. The resurrection of Jesus Christ is the foundation of our faith. If he was not resurrected, our faith in him is useless. In 1 Corinthians 15, 17, Paul said, if Christ has not been raised, your faith is worthless.  And so Jesus Christ is already in John chapter two, speaking of his resurrection. That's what he's referring to when he says, destroy this temple. And in three days, I will raise it up. He's prophesied his death, his burial and his resurrection at the beginning of his ministry. They took him literally and they say it took 46 years for this temple to be built, meaning that Herod had been working on it and doing different different things for many years. But verse 21 says, no, he's not talking about the physical temple. He's speaking of the temple of his body. Therefore, verse 22, when he had risen from the dead, his disciples remembered that he had said this to them and they notice, believe the scripture and the word which Jesus had said. And so Jesus is hinging his authority on the validity of scripture. He is saying. And John is pointing out that the scriptures point to that central fact of resurrection. In John 5 39, Jesus says, you search the scriptures because you think that in them you have eternal life and it is they that bear witness about me. And that's what they're saying in verse 22 when it says that they remembered that he had said this to them and believe the scripture and the word which Jesus had said. You search the scriptures. They testify about me in the scriptures. His resurrection is foretold Psalm 16 verse 10. You will not leave my soul in shale, nor will you allow your holy one to see corruption. Paul made it clear in Romans chapter one, verse four that Jesus was declared to be the son of God with power, according to the spirit of holiness by the resurrection from the dead. The scriptures point out that Jesus Christ was to be resurrected. Jesus says, if you destroy this temple, I will raise it up in three days. He says that in response to their question, who gives you the authority to do what you're doing? You're driving people out. You're you're overturning the tables. What gives you the authority to do that? And Jesus is pointing to the fact that he has God in the flesh, that he is the Messiah and the authority that he has is from heaven. That's what he's saying. They don't see it at that time. As a matter of fact, majority of them will not see it to the very end. But that's what Jesus is pointing out. And the resurrection of Christ is that which that which validates everything and gives him authority. You see, the resurrection of Jesus is what we we place all of our trust on. Again, like Paul had said, if there's no resurrection, our faith is in vain. You think of you think of a of a young girl. She was about between 14 and 16 at the time. And you and you think of how that she had a visitation by an angel and how the angel had said to her that you're going to conceive in your womb the Son of God. And and that young girl, Mary responds by saying, how can this thing be seen? That I have not known a man. And she's saying, how is it possible for me to have a child seen that I'm a virgin? That's what Mary was saying. And the angel makes it very clear to her, you know, that holy thing she will be conceived by the spirit himself. And so you have to put yourself in her place back 2000 years ago, and you have to ask yourself how how Mary, how did she survive? I mean, she was from a small village in Nazareth. When you think of the city of Nazareth, don't get caught up thinking it was large. It was very small. It was a very small community, very small village. Some commentators say that the number of citizens in Nazareth during the days that Mary was there, it could have been as few as 60 people. It was a small community. When you read Nazareth, don't don't start thinking in terms of cities like Ontario and Pomona and other large. No, it was a very small village.  If there's only 50, 60 or less than 100 people there, you know everybody's business. You know what's going on. You know everything. You know everybody. And that's how it would have been. And and Mary was was a girl. She was a girl. She was 14, 15, 16 years old commentators say she was no more in 16. So there's this girl. She'd be trod to a man by the name of Joseph. And she leaves for a while. And she spends time with the with the relative by the name of Elizabeth. And she comes back and she's pregnant. Now you tell me what you would think in this small village or anywhere else. There's only one way to get pregnant. And so Mary is carrying this, this, this shame and reputation. And Joseph, being a just man, the scripture says, wanted to to put her away privately because she had committed a sin according to Jewish law and he had the right to demand her death. But he was a just, he was a righteous man. He was a kind man, a good man. And he didn't want that to take place in in this young woman's life. And so he was minded, the scripture says, to put her away privately. But but that's when the angels spoke and said, don't be afraid to take Mary, your wife for that, which is conceived in hers of the Holy Spirit. And and in faith, Joseph received that. Don't think about that for a minute. What man is going to say, oh, really, you're knocked up by God. I don't think so. That's a paraphrase, probably not a proper one. But it is nonetheless. That's how guys think. Fact. But but the angel, that's why the angel had to speak to him. Don't be afraid. Don't be afraid. You don't have to divorce her. She's pure. You don't have to. How do you think Joseph felt? A noble man, a good man. How do you think he felt? His heart was crushed. His heart would be broken. It would be shattered. He loved this girl. It's my wife. She came back from visiting her cousin and she's pregnant. I must have broken his heart and he was so troubled. And he's, what am I going to do? And God sends the angel to comfort him. But everybody believed that Mary did what people do to have babies, everybody. She gives birth to her firstborn son, Jesus. She loves him, cherishes him, nourishes him, cares for him 30 years. And the people who were alive when that announcement was made of her pregnancy, when everybody discovered it, could have lived for another 20, 30 years.  And in the back of their mind, they may be wondering what's going on with this young man who came out of Nazareth, this young man that was born to Mary, Mary, the girl who became pregnant before she married Joseph. And Mary keeps these things in her heart and she ponders them holding fast to the promises of God and the reality of knowing that she was pure and this is a miracle. And then one day they take this little one who became a man and they hang him on a tree and his mother is there at the foot of the cross watching as her son is dying for ours. John is there with her and some of the other ladies. She hears her son as he's praying, Father, forgive them for they know not what they do. Then he looks at her and looks at John, woman, behold your son.    They take his body, they hastily bury him. Three days later he's risen from the dead and not only is Jesus alive but his mother's claims of innocence are finally validated by the resurrection of her son Jesus Christ, the one who was born to the Virgin and this is all scripture. And that's why you hold fast to scripture. That's why Jesus points to scripture. That's why he quotes scripture, destroy this temple and in three days I will raise it up as a prophetic word concerning the fact that the Psalmist had said you will not leave my soul in shield. There will be a resurrection. And so we place our trust and our faith in what the scriptures say. And that's why it says in verse 22 when he had risen from the dead his disciples remembered that he had said this to them and they believed the scripture and the word which Jesus had said. When he was risen from the dead they remembered. You see after his resurrection they were able to remember he had told them that this would happen. In Luke 24 verses six through eight after his resurrection when the women came to the tomb the angels said to them he's not here. He's risen. Remember how he spoke to you when he was still in Galilee saying the son of man must be delivered into the hands of sinful men and be crucified. And the third day rise again and they remembered his words. If you want to make it, let me give you application if you want to make it through your hard times remember his word. Remember his word. God doesn't lie. God will never leave you nor forsake you. God is with you. I can do all things through Christ to strengthens me. Shall be no weapon formed against me forged against me that will be able to have any success why because God is my shield and my strength. And though I go through things and we all do I don't go through these things without hope because I know that all things work together for the good of those who love God to those who are the called according to his purpose. And I know that God has taught me that if I if I he said if you obey my command I will manifest myself to you. And it's in the midst of times of those times in my life when I'm wondering God what are you going to do that I have to just rest on the things that I know the things I don't know are out of my control so I rest on the things that I do know because those things are in his control. And you learn that over time. And it's not kind of a haphazard. I'm not a person who just kind of whistles in the dark and pretends they're not bad things there. I realize there are bad things but I also know who's with me. I know that too. And I know that the Lord will deliver me in one form or another.  I'm not gonna live there.  And so when I'm going through whatever I go through I know I'm gonna go through and I'm gonna end up with him.  And that's what's going on here. You see they remembered the word that Jesus had said because his word brings comfort. Without the Holy Spirit ultimately scriptures won't make sense. So we need his illumination. It's like what he says in John 1426 the helper of the Holy Spirit whom the father will send in my name he will teach you all things and bring to your remembrance all things that I said to you. And so they believed the scripture. Finally verse 23 when he was in Jerusalem at the Passover during the feast many believed in his name when they saw the signs which he did but Jesus did not commit himself to them because he knew all men and had no need that anyone should testify of man for he knew what was in man. People began to show an interest in him because of the works he's performing but he didn't notice he did not entrust himself to this kind of faith because that faith was not fully in him. Their level of belief was centered on his ability to do works not his ability to save. You can believe that Jesus can do works but that doesn't mean that you're saved because the work and the greatest work that I wanna believe is the work he did for me in salvation. I believe in a God who performs miracles. I don't know a scripture in the New Testament that says he can't. I just don't know one. I don't know a scripture in the New Testament that says he sees doing miracles. I believe he still does. He continues to work. I believe that. Do I see him every day? No. Have I seen him? I think I have. But even if I hadn't, I walk by faith, not by sight. I believe that the Lord does what God says he'll do. And that's the end of it. He said it, I believe it, that settles it. I just trust him in all of that. That's how the Lord is. But he didn't entrust himself to all men. Why? Because he knew what was in man. One of the things that you have to learn in life is to know who to trust and who to love at a distance. Who to trust. Because some of you have been hurt by trusting the wrong people, haven't you? All of us have. All of us have. Did you learn anything? Don't hate them. Don't hate them. Just learn. Just learn that some people you can entrust yourself to. Others, you can't. It's not a judgment on them. May God work in them so that they become trustworthy.  So I am very selective who I entrust myself to. I will entrust myself to the one that is trustworthy. The one who has proven themselves. Now, if I have a friend who talks to me about other people, I guarantee you he talks about me to other people. And so, if he's talking to me about others, he talks about me to others. So that tells me right away, this isn't a person I'm gonna entrust myself to. I can love him and I do. I can care for him and I will. But will I tell him my heart? No. Of course not. Because this is a person who doesn't know how to be trustworthy yet. Now, we all have to learn to keep our mouths shut. We all have to learn when to speak and when not to speak. That's a good lesson to learn over time. You know, my dad, when I was a kid, my dad used to have a real problem with me because he says, David, you're too open-hearted. You just say things. And some of you have noticed that that's still true at my age, I still open my heart and share my heart. I still do. My dad had a difficult time with that because I used to say, you know what? If it's real for me, I'm gonna tell you about it. That's the way it is. But over time, I learned, hmm, some things I keep to myself. Some things I only share with some people. My wife knows everything that needs to be known about this man because I trust her with my life because I know she's trustworthy. And I have others that I can trust certain things to. But Jesus, he didn't show himself to everybody. He didn't say these things to everybody. He said them to certain things, certain people. That's what it's saying here. Jesus did not commit himself to them because he knew all men and had no need that anyone should testify of man for he knew what was in man. So be careful. One, become a person that people can trust. Become a person that they know they could share with and they can trust you. Be that person. And two, be discerning who you trust when you're sharing. Be discerning. Not every person is capable of hearing the things that you share. Just be aware of that. Doesn't make them bad people, per se. Simply means they're people you don't share everything with. That's okay. There's nothing wrong with that.  Maybe they'll learn to be trustworthy. And there have been times when I've told people and I've said, you know what? You've got to learn not to speak. You've got to learn to listen. You've got to learn to just hold things to yourself. Take it to the Lord.  Be wise with that. Be wise with that.


Good morning from sea base the space station beyond or under Berlin Welcomes you to day two of the RC three streaming. We are starting in a few seconds with Catching the NSO groups Pegasus spyware. This is something that has caught attention Among the security and hacker communities over the world in the last I would guess two years or so There had been some spectacular cases of murder kidnappings Journalists being threatened other things The infamous software doing this is called Pegasus. It's marketed by a company Known by the three letter acronym NSO whatever this stands for and Actually Amnesty International and its IT department so to say has invested quite some effort into detecting Whether a device has been infected by Pegasus or not NSO Marketed this among other things as so-called undetectable Undetectable as in software on a device as we see and our speaker today Donica, Donica O'Call from Ireland and from Amnesty International will be presenting How they developed detection tools for this nasty piece of spyware that's had has become so popular among secret Secret actors state actors and others around the world Okay, enough for the introduction. Donica the scene and the stream is yours. Good morning Good morning, thank you for that introduction So as the intro said today, I'd like to talk to you about NSO groups Pegasus spyware I'm pretty sure I'd like to explain a little bit about how we at Amnesty has been investigated Pegasus over the past few years and now also Explained and demonstrate some of the tools we have developed and published that others also Investigate and detect Pegasus spyware potentially on their devices on the devices of other people in civil society So my name is Derick O'Call and I'm a technologist based at the Amnesty International Security Lab in Berlin with a small team who focuses on investigating Target digital threats such as spyware Fishing and other kinds of surveillance that's directed against civil society and human rights offenders around the world So as the intro said Pegasus got a lot of attention in the past in the past few months So you may have seen this a Pegasus project revelations that were published in July during the summer So the Pegasus project was a global investigation into abuses linked to nxco groups Pegasus spyware This investigation was based on a leaked leak data set of 50,000 potential Pegasus targets Which Amnesty International and forbidden stories had access to and so this global media investigation was coordinated by forbidden stories With the participation of about 80 journalists from 17 different meters organizations around the world During the Pegasus project Amnesty International Was the rotator rule of a technical partner and the focus from international was to perform detailed innovative forensic analysis on the devices of potential targets and Through this kind of forensic analysis and this technical work. We're able to identify traces of Pegasus Either targeting on affecting affecting targeting or infection on my devices So over the multi-model project Amnesty Security Lab analyzed about 67 Devices and from these 67 devices of potential targets At least 37 should clear traces of Pegasus targeting or infection So this is really quite a quite a high number of infected devices and these devices included journalists activists opposition political figures All kinds of people who are being unlawfully surveilled using Pegasus Overall of the phones we have checked which were iPhones and which hadn't been replaced, you know Which took 10 data of the targeting more than 80% of the phones That were on of this list of potential targets showed traces of Pegasus So in July these stories came out and they highlighted cases of of civil society being targeted such as journalists in in Hungary activists in Morocco activists Saudi Arabian dissidents Also family members of Jamal Khashoggi Which investigation showed had been targeted with Pegasus spyware both before and after his his brutal murder So yeah, you can you can go and read many of these stories online Today, I'd like to focus on again how we get how we got there how we developed these these tools how we develop this methodology for profiling Pegasus And also she explained about how you can also go and do this kind of searching for for Pegasus and for other mobile spyware So let's take a step back for a second and ask so what exactly is Pegasus? This name is well-known, but what exactly is the software and how does it work? So a first thing to remember is that actually what Pegasus has been got more well known in the last two years It's not actually a new a new tool or a new product So we know Pegasus has been around and been developed by NSO group since at least 2010 On the left hand side here of the diagram you can see a Pegasus brochure from 2010 where it describes how Pegasus can be Installed on Blackberry devices and we believe the original version of Pegasus was focused on Blackberry because back in 2010 Smartphones were less prevalent than they are now and so Blackberry is kind of a key target for some of the This security agencies you may want to buy this kind of spyware So it developed over time here on the on the right hand side We can see some diagrams that were from a leaked Pegasus brochure that was published in 2014 In the first diagram here it talks about how Pegasus is installed on a phone in this example it's showing how a Pegasus Kind of infection link can be sent over SMS to the target device And then it opened how the data that can be collected and passed back to the the operator of Pegasus software So that's just one example of from from their own diagrams And here in the circle below you'll see a little bit of what Pegasus claims to be able to monitor And if you look at you can see it's it's basically everything on the device So it's talking about collecting email addresses collecting SMS messages tracking location data Even reading the calendar, um turning on the microphone of the phone And so bear in mind while this this diagram is quite old It's like six or seven years old you get an idea of what kind of data the Pegasus software will try to collect from the phone It's basically it can access every kind of data on the phone that might be of you of interest to somebody who's carrying out this surveillance um one important thing to remember is that The Pegasus Bioware is able to get a very kind of deep access to the phone So it's fundamentally able to access Every day on the phone that the user is able to access and more So even if you're using a messaging app such as signal or telegram, which may be encrypted At the Pegasus software is able to access that data and those messages before they are encrypted on the device So even once their spy were running on the phone itself, none of these encrypted messaging apps Will help because it has such low level access to the device So it's a little bit about what exactly Pegasus tries to collect and what it uh Yeah, what it what people can do with using the Pegasus software So where exactly did the investigations in the Pegasus start? So if we go back as far as 2016 was when Pegasus was first kind of identified in the wild being being used to target an activist So in this case in 2016 Pegasus was first found by Citizen Lab And Citizen Lab is a group of researchers Based in the University of Toronto in Canada who who also works on investigating a spyware targeting civil society So in this case A UE based human rights defender named admin and sewer Began to receive suspicious messages over SMS. So you can see some screenshots of the messages on the right Um, so i'm a sewer with his cautious abilities because in the past he had previously been targeted with other kinds of spyware jewels Including including finfisher. So when he began to receive these messages He he was cautious about them and he shared them with Citizen Lab who then began to investigate them So what Citizen Lab realized is that um, these look to be an attack message And they opened these attack links on their own testing phone. Uh when they did this They're able to capture um The exploit that was being delivered over these these links and also able to capture a copy of the Pegasus payload So what happens when these links are opened is that the link is open in a in a web browser such as safari When the link is opened, uh The Pegasus server would return some javascript some code that would exploit um an unknown flow in the safari web browser And by kind of manipulating the safari web browser and exploiting this unknown flow They could then get their own code to start running inside this very web browser and eventually what's the help of some additional Uh flaws they could then get more privileged access on the iphone and eventually install the full Pegasus payload So, yeah, Citizen Lab first found in 2016. It was it was a very important discovery and it showed just how how serious some of the threats, uh facing um Civil society were that there were people willing to use these kinds of very expensive exploits to start targeting, uh human rights offenders Who are just doing their human rights work Uh, fortunately after this i'm the minister continued to get harassed And he was sentenced to prison and he's currently still in prison Uh from since 2017 sort of for about Uh four years now So where did we to honestly start investigating this? So our team has been investigating these kinds of threats for a while Uh, but really we started focusing on on nso and investigating nso Uh in 2018, um after an amnesty colleague of ours started to receive some suspicious messages So this recall this colleague received in may 2018 received this message. You can see here on the left uh, the message is written in arabic, but it um This claims that there is going to be a protest uh happening shortly outside the Saudi Arabian embassy And they asked the embassy staff member to to support the the protest and then to click on this link for for more information So fortunately our embassy colleague when they received this message, they got quite suspicious They were like, this is this is weird. I don't know this person And so they shared a screenshot of this message with uh us at the embassy's screen lab and we began to investigate So quite quickly when we started looking at this uh the main name and the server Um, we we agreed to look kind of suspicious Um, we also managed to identify some additional domains and servers that were related to this original akbar arabia domain And quite quickly it started to appear to us that um, this was indeed something suspicious And maybe it was some kind of attack message. So at the time we didn't know it was necessarily nso group Um by by looking at the original initial servers here, we managed to create kind of a fingerprint So some way of identifying the particular configuration Of the domain name and the server uh sent inside of this message Uh with the aid of this fingerprint, we then began to Do what's called an internet scan. So we connected to every single server in the internet Uh, send a particular request and then find any other server in the internet that matched this particular fingerprint This particular configuration from the server So by doing this internet scanning, what we found was 600 different domains all across the internet That matches fingerprint and that appeared to be related to the same kinds of attacks So what was really was really key is that we found that uh these these um domains were actually related to pegasus because nso group had made one kind of Key mistake or key flow when they were setting up this infrastructure. So what happened is um As as described earlier a system lab had previously identified Uh servers being used by nso group in 2016 after they were exposed in 2016 And so shut down all of these domains and infrastructure and then began to set up new kind of infrastructure That would be not uh related to nso or not linkable to nso unfortunately made a mistake because they had reused One domain name from the previous set of infrastructure And also being used this new set of infrastructure So uh by finding this one domain out of 600 that had previously been been uh used by nso We're able to show that these 600 domains were also related to pegasus And so we're able to show that this uh message that was sent to our amnesty international colleague uh was indeed uh Related to pegasus and it was an attempt to to compromise their device So we published this these our findings in uh august 2018 And at the time we also identified that another Settler had been activist had similarly been targeted With a pegasus exploit message uh over whatsapp Following this amnesty international also supported a legal action in israel Which asked the israeli ministry of defense To revoke nso's export licenses to prevent this pegasus software being sold to countries that would abuse it to target amnesty and also target other human rights activists Unfortunately later the israeli court um rejected The the legal complaint um and said that the Israeli ministry of defense had adequate safeguards in place to prevent um nso's exports um being sold to countries who would abuse it Um here on here on the bottom on the left you can see that um You can see a chart which shows the number of pegasus servers um online at the time I can see here that when we published this report and it so acted quite quickly to shut down Whole 500 or 600 servers that were being used to deliver pegasus So this just shows that you know nso Is kind of reading this research is paying attention what it is trying to Avoid getting their infrastructure and servers discovered by by researchers who are investigating these kinds of abuses So this was back in uh in 2018 so um after just after discovering this attack against the amnesty staff member We'd amnesty continue trying to investigate pegasus continue trying to find more cases of abuse and we next found um As pegasus targeting happening in in morocco in 2019 So you can see here on the right um This time we found that a moroccan uh human rights defender named mati manjib Was being retargeted repeatedly with pegasus When we checked his phone, uh, we found that he had some uh suspicious messages They're saying that the messages claimed that there is some some scandal or there's some news story and they're asking Uh the target to to click on these links to find out more information So when we looked at these these links, we knew immediately that there were pegasus links Uh because we had previously identified these domains as one of the 600 domains that Were being used in 2018 So for example, you can see the in the second message here on the right We see the the main videos download.co We need those pegasus because we had previously identified uh and and published this domain in 2018 So this time we knew mati was being in the entire pegasus But we we realized we needed to do some more investigation to see if his phone was indeed compromised or if we could collect More information from his device So when we did this we actually found um something quite interesting on mati's phone because we found what we believed was evidence of a new type of Of targeting on his phone instead of um relying on the target Being tricked into clicking on a link, which is maybe not reliable or maybe The target can can see something suspicious. We instead saw them using what's called a network injection attack So how a network injection attack works is like this. So a network injection involves um Having some kind of equipment or software running on the Uh with access to the internet connection of the the mobile device So this can either be at the mobile phone network or potentially having some Some software or hardware running on the same Wi-Fi network as the target And what it does is when the target is is browsing the web on their phone Uh, eventually the target um Browses and clicks on a link that goes to a regular htp website. So without htps And so when this regular htp request is made The software that's running on the upstream network can see this htp request Uh, and when the htp request happens you can instead instead of returning the correct response or the correct content instead returns a htp redirect Uh, and the htp redirect will then send the browser of the phone to a malicious exploit site where which can then hack the phone So in the case of mati, we found that he tried to go and check his email He typed in yahoo.f4 on his browser when he typed in yahoo.f4 The software running on the on the upstream network Um, saw this a clear text connection and then redirected this phone to this exploit link we see above So you see the domain is quite suspicious get it now the free 247downloads.com Uh, and again, it has um some random characters at the end which looks like a kind of export link So at the time we suspected this was was pegasus And it was a new way of delivering pegasus without tricking the user and clicking our link But we weren't certain that it was pegasus potentially with some other kinds of um uh of spyware Unfortunately for us, um nso helped uh to confirm that this really was pegasus because before we published this report Um, i missed the road to nso group sharing our findings And interestingly one day after we shared the findings with nso this um spyware server got shut down and went offline And this is almost already a week before the report was publicly available So I kind of confirmed to us that nso really was controlling this infrastructure and we're able to get it shut down Even when we only privately shared this information with with nso A bit later we found some more information about how this attack may have been done um nso um At a trade fair was demonstrating some new type of hardware they had developed which you can see here on the photo on the right and we believe this this photo is of um some kind of mz capture or fake base station Which can run a fake mobile phone network And then uh target's phone So just not that you could connect to this uh fake mobile phone base station and from that position It could be possible for nso to redirect the phone to a malicious uh A malicious exploit link So we're not sure what happened what happened in this case if it was the advice that this was used but We we believe the nso is demonstrating or testing these kinds of are called tactical interaction methods So this is this is what our findings were in morocco. We started to realize that Actually relying on checking for sms semesters checking for links or relying on people coming to us um With some suspicious wasn't going to work anymore because we began to see what we're called zero click attacks And so all the zero click attack is is any way of infecting a device That doesn't rely on some interaction from the user doesn't rely on the user clicking on a link So we can see here some examples of other um zero click attacks that have been discovered over the past A couple of years I guess one of the first ones here was in 2019 Where uh nso group developed an exploit for for whatsapp And it was then used by their their customers to target at least uh 1400 uh different people around the world um all of this How this worked was that the The target would simply need to receive a call over whatsapp even a missed call And the exploit would be able to kind of compromise their phone without the user clicking anything As i described earlier, we saw these kinds of network rejection attacks happen and then later in 2020 since lab also found um An i message zero that being used uh to again compromise uh iPhone users without any interaction in in 2020 So from our own investigations, we have found that nso has been using uh various zero click exploits Since at least summer 2017 until uh july of this year um So we know it's not something that's quite new for nso But at least something we've started uh money recently discovering in the past few years and we've seen Yeah, nso putting a lot of focus into developing these kinds of complicated But very powerful as your click exploits So now that we know that nso is is uh and their customers are using these kind of zero click attacks We realized we needed to do something kind of more advanced to try and uh find these cases cases of surveillance um The big problem with mobile devices is a lack of visibility Whereas on that's our laptop computers. We have antivirus available or we have edor systems available There's really nothing similar that was available from mobile devices So these kinds of attacks, especially zero click attacks are often going undetected Um when we began to investigate this we realized that it was difficult to perform forensics on mobile devices It's actually not impossible We were somewhat surprised to realize that iphone's actually allow a significant amount of Relevant data to be extracted from the phones themselves In the form of an iphone backup And so it's actually quite um quite possible to start doing our forensic analysis on iphone's Unfortunately android devices we found were much more limited And because of restrictions on the android operating system It isn't possible to extract much data in an android backup And so all we've really been able to do on android is to simply check the sms messages and maybe the browser history For some traces of of targeting but again, it's just it's just much less data is available on androids compared to iphone's The other big problem we realized is that there's There's a lack of any kinds of public tools for consensual mobile forensics All of the forensic tools that are out there are designed for for people to Extract data from phones that they don't want whatever phones that have been seized or phones that have been somehow otherwise obtained There's no there's no tools available to really check your own phone for signs of spyware So this is where the mobile verification toolkit comes into play So mbt is a public tool developed by Amazon international that's designed to simplify the process of analyzing mobile devices for traces of spyware And here it's available on github. You can go check it out And just to highlight all of the all of the cases of pegasus targeting that i've described previously and all of the cases And traces that i'll just i'll present for the rest of the presentation All of these have been found using mbt so mbt really works to Detect advanced spyware including spyware using zero click zero day exploits And really sophisticated stuff such as pegasus So while all of these different spyware vendors try to say how to think it's un-detectable It is definitely advanced. They definitely spend a lot of money in developing this stuff, but it's not magic and if you're Careful and diligent about checking for traces. There's always mistakes that are made. There's always ways of Identifying potential suspicious behavior on these devices So mbt is is written in python. It's a very easy to install if you have pip you can just go pip tree install mbt And here's how it's how it's used again. It's it's very straightforward To check an iphone you simply make a backup of the iphone and you run this one command. So it'll be mbt ios check backup And you provide the backup folder Um in the command here, we also see what's called a sticks file. So sticks file is simply a file containing indicators There's maybe like the main names or ip addresses or process names that are known to be linked to a spyware tool and so mbt is a generic tool it can be used with Pegasus indicators, but also can be used with indicators for other spyware tools and can be used to detect other spyware So mbt is a modular framework. It has modules for parsing different kinds of databases such as sms messages or browser history or other kinds of files in the device I'm going to go through explain a few of the modules that are available mbt and show how this can be used to To find traces of Pegasus or other similar spyware tools So one module that is is quite useful Is the sms module, which is quite straightforward. It simply reads the sms database in iphone backup It will extract all of the links from those sms messages Then check out any of those sms messages and then links to known malicious domains So in this case, we're checking a backup that isn't targeted with Pegasus and we see that We see that there's multiple domains that are Found there related to Pegasus. We see this one revolution news.com to co stop sms.biz From what we know about nso, we've seen these kinds of exploit sms messages used primarily between 2016 and 2018 We've also seen Pegasus links as far back as 2014 and as recently as 2020 So this has been quite common and I and if zero click attacks are not available, I think we'll still see these kinds of exploit links being sent in sms So another data source that's quite useful and quite helpful for finding traces of targeting is the safari browser history Um, so what we've seen is we've seen uh, sometimes we identify traces of exploit being Recorded in safari browser history, especially after a network injection attack So in this case while there's no link in sms when the network injection hub attack happens The exploit server domain will be recorded in the browser history and so by checking the browser history. We may be able to find Uh evidence that this attack had happened So on the on the right here, you can see a screenshot and this screenshot was actually taken By uh, moroccan, uh, journalist umar adi when he was being targeted with one of these network injection attacks in morocco So when he uh, yeah was browsing the web he clicked the link and then soundly redirected into this webpage And when the screenshot was taken it was actually running the javascript trying to exploit his phone So unfortunately, uh following the publication of this research Umar adi was uh repeatedly harassed by the moroccan authorities and then he was Uh, eventually jailed after an unfair trial and he's currently currently in jail So another another file that was quite useful. Um in our investigations is something called the id status cache file So, uh, the id status cache file is a file on iphone's and it can track contains traces of any iCloud accounts Which interacted with a device? This can be interacting with a device over a bunch of different apple services including iMessage airdrop apple photos Um, and so what was really useful about this file is it showed us Uh, which malicious accounts? Which like kind of taxes related? accounts had been Tagging a particular device So what we know about pegasus, uh, we believe that Uh, these malicious accounts are have been set up And have been used by one individual, uh pegasus customer So you can see here in the in the first row we see this email address luna keller um, and we saw this um This account being used to deliver iMessage zero day to quite a number of the different activists So we seem to be being used to deliver exploits to two different Two different Moroccan activists, uh A couple of french political figures So by by looking at, uh, which individuals have been targeted by the same The same account or by the same customer We're able to kind of get a better idea of who that customer might be and have some idea about the attribution for that attack Um, the same in these other in these other cases For example, we see that jessica davies 1345 email. Uh, this was found on the phone of two different, uh, hungarian journalists Uh, same for the emit davies address Again for the this final address here Williams any, um We found this on the phone of two different, uh hungarian hungarian Individuals and our hungarian activist So this was really useful for us in our investigation because it really helped us get a better idea of who might be behind Some of the attacks that we were we were seeing So the previous logs I showed about sms data and browser history These, um, show kind of traces of targeting. They showed somebody's been sent a malicious link But they don't necessarily prove that a phone has been successfully compromised So what I'll show now is some of the logs we can use to show that a device was indeed compromised One of these files that was very useful for us in our investigations was the so-called a data usage file So the data usage file on our iphone is a file that records information about how much, uh, mobile data traffic Each process on the phone is used This may be used to like help the iphone keep track of you know, which apps on your phone are using the most of your mobile data But what was really helpful for this is that it actually recorded Uh, the names of some of the pegasus processes Um, and how much data each of these pegasus processes are reusing So for what we know about nso pegasus, we believe that when pegasus is installed on a phone It will kind of pick a Random name that it uses to kind of hide itself when running on the system uh, to our investigation we found about 50 different process names that the pegasus process was was using to try and hide itself And once we'd identified these process names, then we could go and look for these pegasus known pegasus process names on uh devices of potential targets What's up in this database is it also shows um A timestamp of when this process name was first kind of started on the device when it was last seen on the device And also it gives you some kind of information about how much data, um, this process transferred And in some cases this has been gigabytes of data which shows that really the the pegasus spyware is extracting a lot of data from the device Uh, and again, this is all automated mbt. So if you check, uh, a phone using mbt with the pegasus indicators It'll show um quite clearly if any of these um processes have been found on the device Uh, another feature that's been uh very helpful for us in in our analysis is the timeline feature of mbt So how the timeline feature works is it takes all of the different, uh Indicators and modules on the phone. So if you look up it checks the sms messages It checks the the file system and every every event like every sms message every Web browser lookup will all be recorded in a single file With the date that it happened So by looking at this timeline, we can often see what different events happened Uh around the same time as each other and this can give us some of the uh, be some idea about how attacks were actually delivered on the device So I want to just give you just one example of of how this timeline can be used Uh, just so you know how to use this timeline in in your own investigations So this is actually um a demonstration of a phone um of a rowan than activist who was uh targeted in june uh 2021 using uh the force entry i message uh zero day So we can see here on the timeline that on At 8 p.m. 8 45, uh, we see the phone began to receive some push notifications or i message So it seems it receives like 46 push notifications and then what we saw was that um sms attachments began to be written to the the phone So in the final line here, we see that our file is written into the sms attachments directory And if you look at the end of the line, we see that the The file being read to disc actually had a dot gif attachment So at the time we we thought this was something to do with the the exploit and somehow, uh nso was delivering their exploit in uh that that gif file If we look a little bit later in the timeline, we see that about 10 minutes later on the same day Uh pegasus process starts running on the phone is otp grfd process Uh shortly afterwards, it's some additional files are on disc and and some more pegasus processes start So by looking at this timeline together, we can see quite clearly that The phone's gonna receive i message messages these key attachments start to be written on disc and then about 10 minutes later Um the phone was was compromised with the pegasus So remember here like there was no interaction from the user that didn't click any link Uh as far as our word, they didn't even notice anything happening on the device It's simply suddenly these messages were being delivered and after 10 or 20 minutes, um pegasus began to uh gain access to the device So we'd shared some of these findings with apple and then later in september 2021, uh apple citizen lab uh identified a copy of this um Exploit on another uh phone of another activist and I shared it with apple and apple punched this uh vulnerability in september 2021 So that's a little bit of how mvt works and how some of this methodology works. Um to identify Uh treasure pegasus on a device So since we published our our forensic methodology and our tools many other groups and organizations have been using uh these tools and methodology to check Other devices for signs of pegasus and I've found quite a number of new cases Are you here at the top right? We can see an example of uh another ngo front line defenders Who identified uh six palestinian human rights defenders who had their devices hacked using pegasus And instead of cases, we see um that the belgian milgian territory and salvage services I'd use this similar methodology To check the phones of journalists in belgium and they found that uh A journalist belgianist uh peter vernlinden had his iphone hacked who they suspected by orwanda Again, we see another case where french intelligent services I confirmed that a number of french journalists Had their phones hacked using using pegasus again using a similar methodology So what they'd like to highlight is like mvt can really uh be useful in In identifying traces of pegasus, but also mvt is designed as a kind of a generic mobile forensic tool So when you use a pegasus indicator, it'll find pegasus But it also can be used to go and proactively search for new kinds of spyware So I really recommend that if you're suspicious that phones May be targeted with this kind of spyware You can use mvt to extract some data and then dig into it. Um if the person is a Remember civil society or an activist then Amnesty and other organization would be happy to help support some of these investigations Uh, also mvt is an open source tool. Um, it's based on different modules And so we're always open to ideas for for new modules and new detection ideas to help Make this tool better and better able to detect new kinds of threats one thing to remember that mvt is it's It's designed to detect certain kind of spyware Unfortunately, the people who develop these spyware they're They're smart people and they read these reports and they watch these kinds of presentations And every time we publish some information about how to detect Uh, these kinds of spyware targeting civil society Um The different spyware vendors and actors will try to improve their tools to avoid them being detected We'll try to kind of upgrade their infrastructure to to hide it again to the better obscure their activities So just to give an example. Here's some of the developments of, uh, NSO's, uh, own infrastructure over time. We see that after we published Amnesty publisher report in 2018 which infrastructure was shut down And then later over the next two years it began to run instead of more infrastructure. Um, Which was again shut down after discovery in in 2021 So it's a constant arms race and so um While while these tools are useful to tech packages now it's not always going to be just automatic And it's important to do further research to try and identify new traces and new kinds of attacks So what is the future for mobile spyware? So one thing I'd like to reiterate is that while we focus a lot on NSO group and Pegasus In this in this in this research in this talk and also there's been a lot of folks at NSO group It's not the only mobile spyware out there. And there's definitely many other players Who are trying to get into the space and trying to also develop similar kinds of spyware tools Um, which are then sold to Two different customers We've seen that from this investigation we we found at least 180 journalists who are potential targets of Pegasus And many other human rights activists and opposition politicians who have been targeted with these tools over the last number of years so far these threat actors and these These state agencies have been able to target activists in civil society with impunity Due to a lack of visibility and telemetry on mobile platforms They've simply just been getting away with it because they haven't been detected So tools such as mbt can help expose some of these threats But they need to be used more widely and need to be used with more civil society to It's really understand the full scope of these kinds of threats Um, I think it's also important that industry The tech industry and security industry work closely with civil society To help detect and expose these threats because unfortunately the people most at risk From these kinds of really serious attacks Are also some of the people who are least equipped both financially and technically to to defend against them So to conclude, I think we're going to continue to see attackers focusing on mobile And mobile is where all the data is no other Place gives you as much insight into somebody's life into all their most innermost thoughts Even just having a microphone in everybody's pocket in someone's pocket is such a powerful Uh, but this isn't a be-in that we think um companies and states will be thinking you're trying to develop these kinds of tools Uh, we know that I think zero click exploits are going to be highly desirable So while uh, apple and others have done a great job in making attacks against iMessage more difficult um, it's almost certain that These kinds of uh cyber surveillance companies will continue trying to develop zero click exploits And if not for iMessage and maybe for other chat platforms, I don't know like Signal or telegram or whatsapp They're going to try and attack um other applications that activists are using um, unfortunately it's not possible um for activists and civil society to Protect themselves from these kinds of zero day attacks from a technical sense. So we definitely need um more to take collaboration between civil society and key platform vendors to help identify and defend against these threats and also we urgently need um better regulation to prevent These kinds of really sophisticated spyware tools being sold To states and agencies, which have a long history of abusing them To target civil society and the global opposition So thank you all for listening. I'm happy to answer some questions though. If you have some questions or if you're concerned about You're a member of civil society or an activist and concerned about civilians. Please feel free to contact us at shareanamnesty.tech Thank you Thank you, donica. Thank you from sea base We have already taken some overtime this early hacker morning There have been popping up some small questions on our internal pet here from our tiny audience at sea base We don't have that much time left Just can you give us an indication? What is the pace of this ongoing war? Do you feel that nso group is actively fighting mvt and your tool development or did didn't you get this honor yet? um Definitely we've seen even in the past year. We saw nso starting to be more careful about Cleaning up their forensic traces And since you know 2020 they began to already clean some of the traces that we've been using And and it's clearly realized that people are investigating that there is a risk of people discovering this stuff And I feel like after the revelations this summer they're going to have a much more practically trying to to clean up some of these traces But as I said nso is one company out there. There's also many other companies trying to compete in the same space um So even if nso gets better then you know other companies are still out there and can still be be caught using mvt And fundamentally even if they they clean up some traces um for any kind of failed attacks These traces are still going to be left around because it won't be possible to For the spyware to clean up the traces mm-hmm so one could still After an attack eventually eventually on an old device years later discovered that there had been some spyware activity Which may be in the long one interesting information about dark campaigns and things so nso is not the only actor there there will be more Do you feel that there are just copycats in the market or do you think there will be completely new uh threats in the future? So I guess there's always uh, there's lots of smart people or companies who are trying to develop these tools um, just uh last uh earlier this month, uh citizen lab published a report about another um cyber surveillance fender called sidetracks, uh based in north mcdonald's north macedonia And they were selling similar spyware Which is using kind of one click attacks using links, um to help compromise iphone's android phones Um, so that's that's one company that's competing the space. Um, there's other companies doing doing similar Kind of targeting what we believe You know nso was definitely the biggest company in the space And they had a lot of money to invest and especially invest in these kind of zero click attacks so for now, um We don't know if another company that's as big or sophisticated as nso But I think many others will be trying to take their place if nso Uh becomes less popular I see I see Okay, thank you very much. We uh have to go over to the c3 morning show in a few seconds Thank you very much, uh for this interesting talk this morning Again share at msd.tech is the address to go to and this is Probably one of the talks you want to watch again on media dot ccc dot de in a few days when this has been published So greetings to island. Thank you very much and uh We will meet and see again Uh in real I hope thank you. Thank you very much. Have a good day Everything is licensed under cc by 4.0 and it is all for the community