News
The hacker who humiliated spyware makers and was never caught
Over the last few decades, several mysterious hackers have captured the public’s imagination, but none quite like Phineas Fisher. A decade after their most famous hack, Phineas remains, by most accounts, the most prolific and public hacker never to have been caught.
As part of our series on the biggest cybersecurity mysteries of all time, we’re delving into the enigma of Phineas, the hacktivist who hacked controversial spyware makers FinFisher and Hacking Team. The latter, an Italian startup, was among the first to turn government spyware into a viable global business, paving the way for spyware makers such as the Israeli NSO Group. Phineas’ hack against Hacking Team eventually led to the startup’s demise years later.
Apart from Anonymous, an amorphous amalgam of hacktivists with a mixed track record of mostly stunt hacks designed to gather publicity rather than have real impact, Phineas is perhaps the most well-known hacktivist in history. Their story is made of impressive hacks and endless unanswered questions.
Who is Phineas Fisher?
Variously called an anarchist, a cybercriminal, a hacktivist, and a vigilante, the hacker has said they “use a lot of different names” for different hacking escapades.
The hacks we know about were big enough to turn Phineas into a legend among hackers. “I would like to meet Phineas Fisher so that I could buy them a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock,” a well-known security researcher once wrote on Twitter. There’s even a song about them.
Phineas first emerged in August 2014, when they announced they had hacked Gamma Group, the makers of the FinFisher spyware — which is where the nickname comes from. They publicized the hack via a Twitter account cheekily called @GammaGroupPR, leaking stolen data including mobile spyware, product manuals, and a price list. The damage was limited, and FinFisher carried on. Phineas published a post-mortem that doubled as a leftist manifesto, then vanished.
A year later, they came back with a bang, hacking Hacking Team, another spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico, and Panama. Years later, Hacking Team’s CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’ hack was the beginning of the end.
Phineas went on to hack the union of the Mossos d’Esquadra, which is the police force of Catalonia, publishing a post-mortem and a 39-minute tutorial video — consistent with their stated anti-police ideals. Their next victim was the ruling party of Turkey’s authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria that Turkey was fighting against.
Phineas’ last known victim was Cayman National Bank’s branch in the Isle of Man, a self-governing island between England and Ireland. The hack hinted at a different side of Phineas. “I look for illegal ways to make money in order to free my time so I can do something useful with it. Once I had that figured out, I started scaling it up and making more money than I need and giving the extra away,” Phineas said in an interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)
Phineas kept the hack — which happened in 2016 — quiet for three years later before announcing the “Hacktivist Bug Bounty Program,” an initiative to reward hacktivists who expose companies’ illegal and unethical activities. When Cayman National Bank confirmed the hack, it claimed it “was amongst a number of banks targeted.” Phineas confirmed they had been hacking several banks for years.
That was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no online trail. FinFisher never contacted law enforcement, according to a former company employee. The Italian authorities’ investigation into the Hacking Team hack ended without finding any evidence pointing to Phineas’ real identity. What I can say, from my own reporting, is that Phineas is alive and well — they have been in contact with me within the last couple of years.
So who is Phineas Fisher? Taking their claims at face value, they’re a hacktivist with anarchist ideals, but also a cybercriminal. Could they instead be a fabricated persona controlled by a spy agency — Russia, say, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and it’s unclear why Moscow would go after all of Phineas’ chosen targets.
Their origins are equally murky. Phineas has name-dropped Spanish-speaking anarchists, wrote the Hacking Team post-mortem in Spanish, and followed numerous Latin American leftist accounts on Twitter. They told me their first language is neither English nor Spanish, though they have acknowledged living in a Spanish-speaking country. It’s all worth taking with a grain of salt. “Everything I say that contains clues about my identity is half trolling,” Phineas once told me. “I’m in the habit of saying misinformation.”
It’s also possible that the Phineas persona was passed around between 2014 and 2019 and used by different individuals. But there is no evidence of that, and after 10 years of conversations, my gut says Phineas truly is the hacktivist they claim to be.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
If there was one thing that was obvious from Meta Connect this year, it’s that the social media giant is all-in on its burgeoning line of smart glasses.
Indeed, the glasses were pretty much everywhere at the annual event, where Meta shows off its newest hardware and AI products. Both Meta staff and the flocks of influencers who frequent the event seemed to arrive with the glasses glued to their faces. Most of the demos the company offered this week also involved the glasses.
I swiftly joined the bespectacled masses and found myself trying on pair after pair of Meta’s high-tech specs.
One of the more notable products I had an opportunity to demo were Meta’s new, still-unreleased, audio-only smart glasses. News of these glasses emerged not long after the company weathered accusations that it was selling “pervert glasses,” with critics alleging that its camera-equipped specs could be used for nefarious surveillance purposes.
The new glasses come equipped with six microphones, but no camera, and they have no native way to record your surroundings, which should go a long way toward easing privacy concerns. They are significantly lighter than any of the other smart glasses I’ve worn, and they were quite comfortable.
The Meta staffer I talked to emphasized the glasses’ entertainment and communication options: You can listen to music easily (they’re more comfortable than earbuds) and take phone calls without reaching for your phone.
The glasses will also integrate with Muse, Meta’s personal agentic system, which can carry out tasks on the user’s behalf. The new integration, which isn’t yet available to the public, lets wearers speak to Muse and give it commands verbally. Meta also plans to personalize the agent, letting users pick from an assortment of cute digital avatars that can represent the agent when it communicates with them.
I was given an opportunity to try this out, which was fun but also somewhat comical. You have to be very direct with the agent, and you can’t talk to anyone else at the same time or it will get confused. Problematically, I kept chatting intermittently with the Meta staffer who’d given me the glasses, and the agent kept thinking I was speaking to it, so it would talk over her.
Still, in the right context, it’s easy to see how this new integration could be incredibly useful. If you don’t mind being seen in public talking to your own sunglasses, you’ll be able to ask Muse to take care of various digital tasks for you, like sending emails or reciting to-do lists, and it will handle them while you’re out grocery shopping or having a beer. You can also ask the glasses anything, and like a mobile version of ChatGPT, they’ll spit out an answer. (I asked the glasses a question about World War II, and they gave me a succinct and historically accurate response.)
Finally, I also got to test-drive a second audio-only pair: Meta’s new glasses for the hearing impaired. Given that hearing loss affects many families (some 50 million Americans are said to have some level of hearing loss), this device, unlike a lot of other modern tech gadgets, serves a clear and practical purpose.
I spoke briefly with a member of Meta’s research team who said the glasses had been in development for about five years, and he pointed out a price difference that could make them appealing: Whereas a lot of hearing aids can run as high as $1,600, the glasses will sell for $150.
The experience of wearing these glasses was interesting. Meta had me put earplugs in before trying them on to simulate the hearing loss that the glasses are meant to help users overcome. Once the glasses were on, they seemed to amplify the voice of the person I was talking to. Users can switch the amplification from focused, which zeroes in on the person in front of them, to omnidirectional, which picks up sound from all around them, depending on how they want to experience their surroundings.
Mark Zuckerberg has made it clear that he believes smart glasses are the future, and it’s evident that his company is doing its best to fulfill that vision. But smart glasses remain a niche that has yet to truly find its footing. What was most obvious at Connect is that Meta has — in an attempt to succeed where others have failed — cast a very wide net, trying to make its glasses stylish, functional, and, most of all, useful.
Is this the future? Unsurprisingly, everyone at Connect seemed to think so. I suppose we’ll have to see if the rest of the world follows suit.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
-
Featured3 days agoPLATEAU STATE: IS THERE PEACE, OR ONLY THE ABSENCE OF VIOLENCE?
-
News3 days ago
Plateau Killings: Rotjimwa Yilyok Urges Security Agencies to Intensify Action
-
Business3 days ago
General Business to Drive 72% of Mutual Benefits Assurance’s Projected ₦96.82bn GWP
-
Business3 days ago
Shettima Urges African Leaders to Process Minerals Locally
