Slashdot Mirror
Finfisher Spyware Use By Governments Expanding, Masquerades as Firefox
nk497 writes "Mozilla has sent a cease-and-desist order to Gamma International, after it was revealed the controversial creator of spyware for governments was disguising itself as Firefox on PCs. 'We cannot abide a software company using our name to disguise online surveillance tools that can be — and in several cases actually have been — used by Gamma's customers to violate citizens' human rights and online privacy,' Mozilla said."
DavidGilbert99 writes on the wider implications of the Citizen Lab report: "Governmental spying software has been in the news a lot in recent months and today Citizen Lab has revealed its latest findings, showing that one of the most prolific tools in use, Finfisher, is now in use in 36 countries around the world [beware the auto playing video ads with sound]." And, Voulnet adds "According to analysis and report by CitizenLab of the Gamma FinFisher trojan spyware used against dissidents in the middle east and around the world, the FinFisher codebase uses the LGPL GNU Multiple Precision Arithmetic Library, possibly without adhering to its distribution restrictions."
This scum must get sued into the ground. What a disgusting company.
This is one of the big reasons for supporting open source applications - violations like this can be exposed without relying on a single central authority to uncover it and trusting that the central authority will not be beholden to other interests.
Kudos to the firefox team!
KK4SFV
How are they getting away with this in Great Britain?
Mozilla's case is a very clear one. Although the software (the source code) is free and open, the trademark (the branding) *IS* NOT. (Hence all the IceWeasel and similar source builds). Gamma company is clearly using a name registered to Mozilla to masquerade itself, and abuse end-users' confusion to make them think it's a Mozilla registered product. That's almost the book case for which Trademark was designed. :-( )
The only thing which could prevent Mozilla from winning at the court would be government meddling (although, this is likely as its a widely used *surveillance* tool
In theory, Gamma should have negociated a trademark licensing deal (just as do Linux distribution which provide their own branding on top of Mozilla's. The Firefox which comes with opensuse isn't the exact binary which is available at mozilla.org, but they are allowed to package their build and still call it "Mozilla Firefox" because they obtained a permission).
In practice, Mozilla will probably refuse to grant Gamma a license.
The libGMP case is much more interesting: they copied code which don't belong to them. Either they are violating its license and breaking copyright law. Or, they'll have to abid to the license and make their surveillance tool end-user- (or should it be more properly called "end-victim"- ) modifiable. (Either the whole package if its GPL or at least the LGPL parts if there are only LGPL parts in Finfisher).
Meaning that victims could without any restriction take-over finfisher by injecting their own libraries: it would end up completely legal and possible to tamper with a wiretapping device because the license of some part of it require the end-user to be able to customise them (in case of LGPL, or to customise the whole package in case of GPL).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I applaud Mozilla's decision to start legal action against them, but more importantly, how is it legal for this company to operate? Perhaps this is naïve, but how is it legal for a company to operate by providing surveillance software to governments? Does the State Department approve which nation's they can sell to?
The firefox part has nothing to do with "open source" or GPL violation.
Gamma isn't using a single line of code from firefox.
Instead they are abusing Mozilla's trademark.
This is a simple classical violation of trademark law. (and a clear one).
The LGPL violations are regarding some subcomponent used by finfisher, namely libGMP.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This is why you should check md5 hashes on anything you install. Installing from a distro's repositories is the easiest and safest way, but you can check hashes on windows binary installers too, to verify that what you're installing is what you think you're installing.
It's a clear trademark law violation.
"Firefox" is a name owned and controller by Mozilla, and is used to clearly designate one specific product: the Firefox browser.
Gamma are abusing the same name, Firefox, to masquerade their surveillance tool as a browser. They use the same name with intent to create confusion.
This is not allowed by trademark law and is punishable. It's almost a textbook's case.
About loss of revenue: Mozilla might not be selling copies of Firefox to end-users, they are still getting paid (by Google, among other) to produce it.
If suddenly Firefox becomes knkown as a filthy malware (which is exactly what Gamma is doing, and which exactly against what trademark law was designed) Mozilla might lose revenue though from sponsors instead of end-users.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
So will i have issues with my extensions if I use it?
Do most providers of Windows binary installers even provide hashes? I thought the common practice in Windows was for each developer to buy a commercial code signing certificate.
...They didn't get Al Capone for murder, they got him for distributing LGPL code without attribution.
I'm going out on a limb here, I hope it doesn't break...
As has been noted here, and is very obvious to those with any modicum of insight, the brand and trust value in FF has been greatly tarnished:
Will the general public be more reticent to use FF?
Will computer techs be less likely to reccommend FF to users?
Will enterprises be less likely to use FF?
I think the answer is yes on all counts.
Gamma International(AKA major cunts) picked the obvious choice of "trusted" and "independent" browsers to smear. And they have done a great job. Also, they smeared the browser that has the smallest legal coffers, because it had to be obvious to the major kunts that Mozilla would get wind of this and then litigate. We could hope that Mozilla can, as has been noted earlier, "sue the living daylights" out of major kunts.
How far will they get?
How will Mozilla reclaim their "street cred" as the independent and trusted browser?
Then we need to think about who this action helps, indirectly... Well, we all know the answer that.
Now, I wouldn't go so far as to suggest that either of the other major browsers had anything to do with this smear, but, it does cause one to pause and perhaps reflect on the long term implications of this smear against FF.
We can only pray that Mozilla is able to see that justice is done against this despicable band of hoodlums and scumbags.
We play the game with the bravery of being out of range
You're not as good as signal11.
captcha: mostly
Try reading the actual text of the act or at least check snopes.com
http://www.snopes.com/politics/medical/kithil.asp
Best outcome of this trademark abuse is enough publicity which can be turned public awareness in long run. I bet that's not exactly Gamma is after thinking of this shady low key game they try to play.
Ergo. More publicity the case gets the better :)
ac
How do we know malware removal vendors have no "agreements" with government agencies to leave certain "official" spyware (of course called "forensic" or "surveillance" tools) out of their sights? Can anybody shed some light on that?
You can't sue for damages if there aren't any. I don't care if you think it shouldn't be that way, that is how it actually is. Civil court is largely for remedying economic damages. Like if you hire me to do work on your house, I cause damage, and then refuse to pay for it, that is what civil court would be for.
So if I do something to you that is not illegal and causes you no economic harm, well you'll have trouble suing me (successfully) for it. There are cases and trademark infringement is one of them that there is no need to show harm, but not all that many.
So maybe less bitching about capitalism form you, more learning about the court system. Asking if something has done enough harm to warrant damages is a real issue for civil cases. That is how it works, regardless of if you like it or not.
You can't sue for damages if there aren't any.
Simply because Firefox is free to download does not mean that Mozilla does not derive any income from Firefox. Mozilla does not run off donations from people like you and I, they provide a service to a number of companies that pay they many many millions of dollars.
Loss is reputation results in fewer downloads results in a product association that is worth less to these companies.
If you want news from today, you have to come back tomorrow.
Slashdot should add "P.S.=>" to the lameness filter.........
How about, evil is as evil does!
There's an article in that rag owned by notorious dog killer, Blethens (the Seattle Times) describing "white hats" --- a most muddied description when it pertains to those who support the status quo, which is coding software to track everyone today!
Narus, now a Boeing subsidiary, would describe themselves as "white hats" --- yet their DPI technology (Deep Packet Inspection) has been used to track down, torture and murder pro-democracy activists in China, Syria, Egypt and elsewhere.
The Narus DPI technology has been incorporated into the ultimate automated spy/intelligence platform, the Trovicor Monitoring Center, originally developed at Nokia Siemens Networks, it is now owned and sold through a private equity fund based in Germany, of unknown ownership.
It has been sold to one hundred countries, including China, America, Iran and Bahrain; the last two countries having used it in the kidnapping, torture and murder of various dissidents and pro-democracy activists.
This platform can be set to automatically intercept emails, or phone calls of any type, alter their content (as in meeting place location, etc.) then dispatch a kidnap team or kill team.
Say a member of the global elite requires a new organ. The Chinese government will match the target to Trovicor's DNA database, run an audio program search and match on wi-fi/landline to identify the target and his/her whereabouts, then dispatch an organ harvesting team to do a forced organ theft. The victim will end up either disappeared, or in the next Chinese "Bodies Exhibition" --- a profitable endeavor for the ghouls who pay to view such amoral travesties!
Welcome to the next level, dood!
Read & Learn:
http://www.buggedplanet.info/
http://wikileaks.org/the-spyfiles.html
POST ABORTED: use less timecube, it's like APKing!
Slashdot should add "P.S.=>" to the lameness filter.........
Or simply too much boldface.
The Tao of math: The numbers you can count are not the real numbers.
under the GPL, making the source code available under some form is mandatory, no matter what.
So Gamma is violating because there's no way to get the source code of their copyleft parts.
In addition to that, the forensics using finfisher to spy are deploying it - thus distributing binaries, and should alsoprovide the parts of source code which are required by the license.
Failure to do so would be a copyright violation:
- Gamma can't copy libGMP without a license, and the license asks Gamma to provide some source.
- the Gamma clients/spies in turn aren't allowed to deploy the software on victim's PCs without a license. Again, the (L)GPLed parts ask for source.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Even if they swap a few letters around, this is clearly made on the sole purpose of creating confusion and make the victim think it's mozilla's firefox.
That's exactly what trademark law was made against.
If Microsoft can sue anything containing "Windows" in the name, if Bethesda can sue anything containing "Scrolls" in the name, if even Apple can sue everything whose name merely begins with lower case 'i' letter... Then Mozilla could certainly sue a company whose product is designed to make use think it's Firefox.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
United States v. ElcomSoft and Sklyarov
You fail it, Paul. Your skill is not enough.
Presumably the customers of this product aren't going to sue, as it would expose them publicly as users of the software.
But the victims got a copy of the binary (although against their will) but did not recieve anything clearly identifying the binary, contact information, licensing of free/libre opensource components nor source code. In fact everything is done to clearly identify the binary as something completely false and different - masquerading as Mozilla's Firefox (hence the trademark violation I mention above).
Because Gamma tries to hide Finfisher from the victim, the victim isn't properly informed of her/his rights regarding source code and freedom to modify. This alone could be a violation of the GPL.
The "victims" will have binaries on the PC but will they count as "any third party" under the GPL merely because they found a binary on their computer? Wouldn't the government agencies just claim that they did not relinquish ownership of their spyware binary, or Gamma claim that the binaries were not properly re-transfered according to the license?
The various *GPL licenses go to a great deal to properly define what counts as "distribution". (Even with subtypes like AGPL for which making a service available over the network counts as distributing).
A binary was given to the victims - even if it was against their wishes. More precisely, a *copy* of the binary was made onto the disk of the victim (hence the *copy*right law kicking in). To be able to make such copy, either Gamma has to be the owner of the code (which isn't the case with 3rd party component like libGMP whose rights still belong to the original authors), or Gamma has to have a license (an authorisation given by the authors) which allows them to make said copy. The license coming with the LGPL components comes with very precise requirements about what should be made with the code and the freedom to modify it. Gamma didn't respect it, thus the GPL is void for them and they don't have any license. The copy made and written on the victims disk is unlawful.
Gamma needs either to conform with the current license, or ask all the authors and copyright holder of libGMP a different license. (Which might not even be possible: not all project transfer the right to a single entity. Very often, every contributor retains the rights over his/her own contribution. To ask the right-holders for a different license could in some circumstance mean having to ask every single developer who has ever contributed any line of code. Which is partically impossible (that's why the Linux kernel is still licensed as GPLv2) and nothing guarantee that absolutely all of them would accept to change a license to help a spy).
Without such steps, Gamma is violating copyright law and liable.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]