Story image

Global ISPs could be complicit in major spyware surveillance program

25 Sep 17

Another variant of the notorious FinFisher spyware is suspected to be behind several surveillance campaigns against seven countries, and ISPs are said to be in on the game.

Researchers from ESET detected the new FinFisher variant, which is also known as FinSpy. The latest variant not only features technical improvements, but also use a previously unseen infection vector.

While ESET will not name the seven infected countries, in two cases researchers suspect that major internet providers have probably been involved in infecting the surveillance targets. In the other five cases, infections have spread via traditional methods.

Researchers further say that FinFisher is essentially spyware marketed as a law enforcement tool and sold to government agencies and oppressive regimes worldwide.

FinFisher infects its targets through a number of different methods, most notably ‘man-in-the-middle’ attacks, in which ISPs seem to be operating as the facilitators.

The company says it has evidence to back up those claims. WikiLeaks published leaked documents which showed that the creators behind FinFisher also made ‘FinFly ISP’, a solution that could give ISPs capability to conduct man-in-the-middle attacks.  The attacks are also similar across countries, suggesting that the same creator made all versions. All targets in different countries are also using the same ISP.

“Finally, the very same redirection method and format have been used for internet content filtering by internet service providers in at least one of the affected countries,” researchers state.

Traditional methods include spear phishing, manual installation, zero-days and compromising websites frequented by targets, otherwise known as watering hole attacks.

When surveillance targets try to download legitimate applications, the attack redirects them to an infected version of that application. So far researchers have spotted infected versions of Avast, Skype, VLC Player, WhatsApp and WinRAR, amongst others.

The attack facilitates download of the trojanised installation package which not only installs the application, but also the FinFisher spyware.

“The latest version of FinFisher has also received technical improvements, its authors putting even greater focus on stealth. The spyware uses custom code virtualization to protect the majority of its components, including the kernel-mode driver. In addition, the entire code is filled with anti-disassembly tricks. We found numerous anti-sandboxing, anti-debugging, anti-virtualisation and anti-emulation tricks in the spyware. All this makes the analysis more complicated,” ESET researcher Filip Kafka states in a blog.

Researchers also discovered an ironic connection: One of the FinFisher samples is titled ‘Threema’, which shares the name with a secure instant messaging app with end-to-end encryption.

“Ironically, getting tricked into downloading and running the infected file would result in the privacy-seeking user being spied upon. This special focus on users seeking encryption software is not limited solely to end-to-end communicators, apparently. During our research, we have also found an installation file of TrueCrypt – the once-very-popular disk encryption software – trojanised with FinFisher,” researchers state.

ESET products detect and block the threat as Win32/FinSpy.AA and Win32/FinSpy.AB.

NZ Internet Task Force joins iSANZ Hall of Fame
NZITF chair Barry Brailey and former chairs Mike Seddon and Paul McKitrick received the award in Auckland last week.
Quantum computing: The double-edged sword for cybersecurity
Quantum computing is quickly moving from science fiction to reality.
Three ways to achieve data security whilst enabling BYOD
"A mobility strategy is now more important than ever before, that said, selecting the right one is often no small task."
How IoT and hybrid cloud will change in 2019
"Traditional VPN software solutions are obsolete for the new IT reality of hybrid and multi-cloud."
WatchGuard’s eight (terrifying) 2019 security predictions
The next evolution of ransomware, escalating nation-state attacks, biometric hacking, Wi-Fi protocol security, and Die Hard fiction becomes reality.
GCSB's CORTEX project scoops iSANZ Award
“I believe this award is particularly significant as it is acknowledgement from our peers in the information security industry and from across the private sector."
NZ firms lack cybersecurity confidence, HP survey says
Out of 434 of New Zealand’s small and large businesses, only half (50%) feel confident that they would be able to cope if they experienced a significant cybersecurity breach.
SonicWall secures hybrid clouds by simplifying firewall deployment
Once new products are brought online in remote locations, administrators can manage local and distributed networks.