Cyber Attacks On Activists Traced To Gamma Group's FinFisher Spyware

Sherloqq sends this quote from a Bloomberg report: "FinFisher, a spyware sold by U.K.- based Gamma Group, can secretly take remote control of a computer, copying files, intercepting Skype calls and logging every keystroke. For the past year, human rights advocates and virus hunters have scrutinized FinFisher, seeking to uncover potential abuses. They got a glimpse of its reach when a FinFisher sales pitch to Egyptian state security was uncovered after that country's February 2011 revolution. In December, anti-secrecy website WikiLeaks published Gamma promotional videos showing how police could plant FinFisher on a target's computer. ... Researchers believe they’ve identified copies of FinFisher, based on an examination of malicious software e-mailed to Bahraini activists, they say. ... The findings illustrate how the largely unregulated trade in offensive hacking tools is transforming surveillance, making it more intrusive as it reaches across borders and peers into peoples’ digital devices. From anywhere on the globe, the software can penetrate the most private spaces, turning on computer web cameras and reading documents as they are being typed."

Comments

Gamma Group - For All Your Fascist E-Needs

[ohnocitizen]

Want to trample activists? Stop dangerous ideologies like Democracy in its tracks? Trust Gamma Group as much as you don't trust your citizens. "We'll help you spy on your people(tm)".

If ever there was a company aching for a PR disaster...

Re:Gamma Group - For All Your Fascist E-Needs

[ackthpt]

i dont think a company that sells spyware to government entities is worried about their public image...

Actually, they prefer to be completely opaque .. to the point people are unaware they exist. It is the glare from the spotlight of attention they squirm under.

Nothing to see here, nothing at all, we're just a bunch of chickens, nothing special .. why don't you go see what Rebecca and Andy are up to?

Re:Criminal?

[pseudofengshui]

That depends on how many pirated MP3s come bundled with FinFisher.

Moving to other platforms?

[mlts]

With all the malware tools becoming available for Windows and Mac, perhaps Linux, I wonder if this will encourage people to move to lesser known platforms that would function just as well.

Moving to a non-mainstream CPU and OS would stop most malware in its tracks. Making sure that cross-platform items like Java are either not run, or are run in a chrooted, jailed space, perhaps as a different user, might also be the par for the course.

Hmm... time to see where I put the old Indy and see if Chromium or Firefox would port to IRIX without some substantial effort or rewriting... Barring that, there are always some old POWER5 boxes on eBay with graphical consoles, as well as SPARC boxes.

Maybe it is time to go back to the days of Solaris for being on the Internet.

Re:Moving to other platforms?

[Anonymous Coward]

If you look at these videos there is at least one video which suggests this requires a bit of stupidity on the users part.

It assumes Microsoft Windows / Mac

1. Insertion of payload to EXE / DMG download (semi assumed although this is this would be feasible and thus I'm sure how they are doing it)
2. Instant message to blackberry user with link to trojan (spam)
3. They show USB keys being physically inserted (I'd assume this is a non-locked down system and the trojan is opened through autorun, but that doesn't even work in Vista/7, which means user interaction, which if you are physically at the computer this would be easy to hit ok, if there are no screen saver passwords)

Platform based solutions:
1. Don't enable downloading of executable content (limit programs to trusted, vetted, and verifiable sources like repositories)
2. Don't enable downloads of executable content
3. Don't leave the system unattended, ever, and boot from removable media, the system should also be kept secure from adversaries and checked for physical hardware devices that could intercept key strokes

Some other things:
4. Disable scripting (libre office macros, adobe flash, PDF reader, browsers, etc)
5. Use publicly verifiable encryption software (this excludes truecrypt as the source code is not easily vetted even though it's available, a public CVS is needed)
6. NOT SKYPE! Anything but Skype. I mean. Really. Are you stupid? There are some alternative options. GPG email / instant messaging is probably ideal with limited protocols (personal jabber server, NOT GTalk, MSN, AIM, etc).
7. Don't leave the data unencrypted and don't utilise third party systems (at least not repeatedly- you can easily attack a user by simply monitoring them and then infecting the systems they use even if in Internet cafes, how many Internet cafes do you have in your area? chance are you end up using one of a dozen at the most, all easily infected)

I don't know who I'm more afraid of

[cultiv8]

what the NSA is doing or unbridled capitalism.

Re:Fags and spics

[John Hasler]

It is abut a UK comany exporting malware to what was a dictatorial regime to spy on political dissidents.

Right. Export controls: that's the ticket. It worked so well for encryption software and inconvenienced no one.