Slashdot Mirror
Leaked Demo Video Shows How Government Spyware Infects a Computer (vice.com)
An anonymous reader quotes a report from Motherboard: Motherboard has obtained a never-before-seen 10-minute video showing a live demo for a spyware solution made by a little known Italian surveillance contractor called RCS Lab. Unlike Hacking Team, RCS Lab has been able to fly under the radar for years, and very little is known about its products, or its customers. The video shows an RCS Lab employee performing a live demo of the company's spyware to an unidentified man, including a tutorial on how to use the spyware's control software to perform a man-in-the-middle attack and infect a target computer who wanted to visit a specific website. RCS Lab's spyware, called Mito3, allows agents to easily set up these kind of attacks just by applying a rule in the software settings. An agent can choose whatever site he or she wants to use as a vector, click on a dropdown menu and select "inject HTML" to force the malicious popup to appear, according to the video. Mito3 allows customers to listen in on the target, intercept voice calls, text messages, video calls, social media activities, and chats, apparently both on computer and mobile platforms. It also allows police to track the target and geo-locate it thanks to the GPS. It even offers automatic transcription of the recordings, according to a confidential brochure obtained by Motherboard. The company's employee shows how such an attack would work, setting mirc.com (the site of a popular IRC chat client) to be injected with malware (this is shown around 4:45 minutes in). Once the fictitious target navigates to the page, a fake Adobe Flash update installer pops up, prompting the user to click install. Once the user downloads the fake update, he or she is infected with the spyware. A direct link to the YouTube video can be found here.
ZIKA!
The government doesn't have time to investigate most people. Unless you're clearly up to no good, you don't have to worry about spyware like this. I've never understood why Slashdot users are so paranoid about this type of surveillance. What exactly are you hiding? Terrorism? Illegal porn? Money laundering with Bitcoins? If you weren't breaking the law, you wouldn't have anything to be concerned about.
Why should the purported "spyware" be able to do anything real, when tax payer money is easier to grab than ever before?
In the video it shows that the fake flash installation is to avoid the certificate warnings about the mitm attack. Yet how is the mitm set up? Have they gained access to network devices or another section of this network
it relies on popups to work?
Slick tricks to trick user to downloading and installing malware.
All i see is a supposed "hacker" that doesn't even know that by clicking "Advanced" link button on the Chrome security warning page you can proceed, don't know how they set up the MITM attack on the users PC, and Avira is off as you can clearly see the umbrella is closed.
When I was a little kid, I learnt to not stuff into my mouth everything I found on the streets (sometimes I disregarded that advice and got what I deserved: let me assure you: fresh goat shit is round and shiny and looks somewhat like chocolate but tastes... like shit).
Why browsing people download executable content (real or fake Flash players, but Javascript counts in my book too) and execute it on their computers just escapes me.
"You computer may be infected with Spyware! Download the cleaner to fix it now"..
Soooooo elite, and beyond 0day
"Italian surveillance contractor called RCS Lab"
Rat Cunt Shits because those are the people who work there. These douchebags take money from government to spy on fellow citizens and inflict human rights abuses. They are human trash.
"Once the fictitious target navigates to the page, a fake Adobe Flash update installer pops up, prompting the user to click install. Once the user downloads the fake update, he or she is infected with the spyware"
The article forgot to mention the malware only 'infects' Microsoft Windows desktops.
That video is pure bullshit. Even the Avira AV software has been disabled for the "demonstration".
Someone correct me if I'm wrong, but if a website uses both SSL and HSTS this attack becomes much more difficult, if not impossible (depending on how your browser handles HSTS) as long as its not your first time visiting the website. If you have visited the website before and HSTS is enabled on the site a forged certificate will not work and the victim will not be able to continue. Still scary but its just further reason that more sites, even those that don't transmit critical information, should use HTTPS and HSTS.
It's a wonder that even normal computer users haven't yet associated the word 'Adobe' with the software equivalent of nuclear waste.
If you think it couldn't be done on browsers running on Linux/OSX too you're kidding yourself.
the wind appeAred ThFis post brought
"a fake Adobe Flash update installer pops up, prompting the user to click install. Once the user downloads the fake update, he or she is infected with the spyware."
The problem as usual is that people are not educated in security. Anybody being a minimum of paranoid would refuse to install a plugin like that froma random web page. Heck flash would probably not work from a random web page.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Would this infect a Chromebook? I am told they are virus proof.
I guess this is only supposed to work about people who shouldn't be using a computer with admin rights in the first place.
If I (or most people here, I hope) got a message about a Flash update:
- If it was on Slashdot or Reddit, I would go to flash.com and download the newest version.
- If it was a popup, hit Alt+F4 faster than I can read the actual content. I don't care if there's a Flash update on a non-Adobe site, I won a lottery I didn't enter, or a woman wanting to f**k who lives so close that it can only be two people, neither of whom look anything like the photo...
but most of those who use Linux/OSX think long an hard about installing Flash. If they do, they make sure it is the genuine article (or crapware).
Frankly, the sooner Flash dies a nasty horrible death the better for everyone.
Ta:lk to one of the
I've seen the fake flash installer before, at sites that are otherwise respected. I think it gets through their ad network since I started running a blocker I haven't seen it anymore.
Flash updates, that look exactly like that, are notorious for "randomly" popping up and requesting installation when trying to work, whether on a web page or not. These Falsh updates are so frequent that even I would not give much thought to one randomly popping up after I opened a browser.
I've seen many fake Flash install attempts and this one is flawless. The Flash install pop-up looks entirely real. The source URL for the Flash install shows Adobe. This source URL is not quite normal behavior, but only those very familiar with Flash installs would realize that this isn't quite right, otherwise it looks perfectly legit. The installation progress looks perfectly legit, right down to the infuriating and unnecessary slowness of Flash update installs.
I could not blame a user for falling for this trick.
This is a MITM attack. The rest is just fancy window dressing. The important and difficult part, that is not discussed, is how the MITM session was established in the first place. That is the key! The entire rest of it is simply a user installed trojan. Clearly, this attack could also be launched from a compromised website, but that's not what the story is talking about.
You CLEARLY have never tried to install Flash on Linux.....
Chrome has a built in Flash player. Always updated.
So when I see a "you must update Flash" i know it's bogus, since I'm already updated. I tell my family this, since they're non-techies and wouldn't be able to tell a legit popup from a fake. (Im not going to be 100% either).
Oh and Chrome sandboxes its built-in flash better than the plugin can.
Linux has a built-in security feature in that things like flash hardly ever work correctly, so it's less likely to be installed.
How dare the government...be a small Italian company.
whats the difference with this shit and the shit that pops up in porno sites? the fancy bot control program? nigga please
Yep. you are correct sir! Flash for Windows hardly EVER works on Linux. Of course, it hardly ever works anywhere, sooo....
I'll be here all week folks. Tip your waitresses.
but most of those who use Linux/OSX think long an hard about installing Flash. If they do, they make sure it is the genuine article (or crapware).
Frankly, the sooner Flash dies a nasty horrible death the better for everyone.
I read an article stating Adobe is reviving Adobe Flash, not merely providing security updates to the existing codebase.
Even as someone who mostly uses Windows at home, I only ever updated Flash from their official website and never through some kind of pop up. I also ditched Flash entirely as soon as *HTML5 showed up on youtube. The same goes for most of my friends. I don't even understand the need of some people to click on whatever popup is thrown at them, even after they've been told that the internet is full of cheaters and scammers.
*Yeah, HTML5 and Flash aren't really comparable, but for most intends and purposes on the internet (media streaming) they are.
Would be the best description for this post. Yes I get the overall message. Sadly this his how a low of "end-users" get pwned.
Linux software updates are delivered via signed packages from the distro, not via web popups.
Just run it in WINE then.
haha.. yea exactly.. You can't install anything in Linux via a browser popup. The only way to install software is using the package managers. Its actually kind o f irritating having to execute 'sudo apt-get update' all the damn time... ;)
however, linux users like to download and compile code...
when was the last time you really read through the linux kernel to make sure there wasn't an backdoor in it?
i supposed you can hope someone else has...isn't that the theory of open source security?
though what about that stupid library that you had to compile to make your GNU Widgets program work? now did you read that? it may not be as popular as something like the linux kernal, so does that really have enough eyes on it to ensure the NSA didn't insert some obfuscated malicious code?
links to the underhanded C or obfuscated C contests seems somewhat relevant here.
here is at least one example of the NSA trying to push a backdoor into software. this one may have been caught, but can we be sure we caught all of their attempts?
I really really hope you're wrong.