Story image

Global ISPs could be complicit in major spyware surveillance program

25 Sep 2017

Another variant of the notorious FinFisher spyware is suspected to be behind several surveillance campaigns against seven countries, and ISPs are said to be in on the game.

Researchers from ESET detected the new FinFisher variant, which is also known as FinSpy. The latest variant not only features technical improvements, but also use a previously unseen infection vector.

While ESET will not name the seven infected countries, in two cases researchers suspect that major internet providers have probably been involved in infecting the surveillance targets. In the other five cases, infections have spread via traditional methods.

Researchers further say that FinFisher is essentially spyware marketed as a law enforcement tool and sold to government agencies and oppressive regimes worldwide.

FinFisher infects its targets through a number of different methods, most notably ‘man-in-the-middle’ attacks, in which ISPs seem to be operating as the facilitators.

The company says it has evidence to back up those claims. WikiLeaks published leaked documents which showed that the creators behind FinFisher also made ‘FinFly ISP’, a solution that could give ISPs capability to conduct man-in-the-middle attacks.  The attacks are also similar across countries, suggesting that the same creator made all versions. All targets in different countries are also using the same ISP.

“Finally, the very same redirection method and format have been used for internet content filtering by internet service providers in at least one of the affected countries,” researchers state.

Traditional methods include spear phishing, manual installation, zero-days and compromising websites frequented by targets, otherwise known as watering hole attacks.

When surveillance targets try to download legitimate applications, the attack redirects them to an infected version of that application. So far researchers have spotted infected versions of Avast, Skype, VLC Player, WhatsApp and WinRAR, amongst others.

The attack facilitates download of the trojanised installation package which not only installs the application, but also the FinFisher spyware.

“The latest version of FinFisher has also received technical improvements, its authors putting even greater focus on stealth. The spyware uses custom code virtualization to protect the majority of its components, including the kernel-mode driver. In addition, the entire code is filled with anti-disassembly tricks. We found numerous anti-sandboxing, anti-debugging, anti-virtualisation and anti-emulation tricks in the spyware. All this makes the analysis more complicated,” ESET researcher Filip Kafka states in a blog.

Researchers also discovered an ironic connection: One of the FinFisher samples is titled ‘Threema’, which shares the name with a secure instant messaging app with end-to-end encryption.

“Ironically, getting tricked into downloading and running the infected file would result in the privacy-seeking user being spied upon. This special focus on users seeking encryption software is not limited solely to end-to-end communicators, apparently. During our research, we have also found an installation file of TrueCrypt – the once-very-popular disk encryption software – trojanised with FinFisher,” researchers state.

ESET products detect and block the threat as Win32/FinSpy.AA and Win32/FinSpy.AB.

Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.