Story image

Global ISPs could be complicit in major spyware surveillance program

25 Sep 2017

Another variant of the notorious FinFisher spyware is suspected to be behind several surveillance campaigns against seven countries, and ISPs are said to be in on the game.

Researchers from ESET detected the new FinFisher variant, which is also known as FinSpy. The latest variant not only features technical improvements, but also use a previously unseen infection vector.

While ESET will not name the seven infected countries, in two cases researchers suspect that major internet providers have probably been involved in infecting the surveillance targets. In the other five cases, infections have spread via traditional methods.

Researchers further say that FinFisher is essentially spyware marketed as a law enforcement tool and sold to government agencies and oppressive regimes worldwide.

FinFisher infects its targets through a number of different methods, most notably ‘man-in-the-middle’ attacks, in which ISPs seem to be operating as the facilitators.

The company says it has evidence to back up those claims. WikiLeaks published leaked documents which showed that the creators behind FinFisher also made ‘FinFly ISP’, a solution that could give ISPs capability to conduct man-in-the-middle attacks.  The attacks are also similar across countries, suggesting that the same creator made all versions. All targets in different countries are also using the same ISP.

“Finally, the very same redirection method and format have been used for internet content filtering by internet service providers in at least one of the affected countries,” researchers state.

Traditional methods include spear phishing, manual installation, zero-days and compromising websites frequented by targets, otherwise known as watering hole attacks.

When surveillance targets try to download legitimate applications, the attack redirects them to an infected version of that application. So far researchers have spotted infected versions of Avast, Skype, VLC Player, WhatsApp and WinRAR, amongst others.

The attack facilitates download of the trojanised installation package which not only installs the application, but also the FinFisher spyware.

“The latest version of FinFisher has also received technical improvements, its authors putting even greater focus on stealth. The spyware uses custom code virtualization to protect the majority of its components, including the kernel-mode driver. In addition, the entire code is filled with anti-disassembly tricks. We found numerous anti-sandboxing, anti-debugging, anti-virtualisation and anti-emulation tricks in the spyware. All this makes the analysis more complicated,” ESET researcher Filip Kafka states in a blog.

Researchers also discovered an ironic connection: One of the FinFisher samples is titled ‘Threema’, which shares the name with a secure instant messaging app with end-to-end encryption.

“Ironically, getting tricked into downloading and running the infected file would result in the privacy-seeking user being spied upon. This special focus on users seeking encryption software is not limited solely to end-to-end communicators, apparently. During our research, we have also found an installation file of TrueCrypt – the once-very-popular disk encryption software – trojanised with FinFisher,” researchers state.

ESET products detect and block the threat as Win32/FinSpy.AA and Win32/FinSpy.AB.

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Norwegian aluminium manufacturer hit hard by LockerGoga ransomware attack
“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.