Jump to content

FinFisher: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Typo fix
rm WP:WEASEL words - claim supported by three credible mainstream sources, no need to hedge
Line 1: Line 1:
'''FinFisher''', also known as '''FinSpy''',<ref name=NYT83012>{{cite news|title=Software Meant to Fight Crime Is Used to Spy on Dissidents|url=http://www.nytimes.com/2012/08/31/technology/finspy-software-is-tracking-political-dissidents.html|accessdate=August 31, 2012|newspaper=The New York Times|date=August 30, 2012|author=Nicole Perlroth}}</ref> is surveillance software marketed by Gamma International, a software firm with a [[United Kingdom|UK]]-based branch Gamma International Ltd in [[Andover]], [[United Kingdom]], and a [[Germany]]-based branch Gamma International GmbH in [[Munich]]<ref name="RSF-Corporate_Enemies">[http://surveillance.rsf.org/en/gamma-international/ "Corporate Enemies: Gamma International"], ''The Enemies of the Internet, Special Edition: Surveillance'', Reporters Without Borders, 12 March 2013.</ref><ref name=B72512>{{cite news|title=Cyber Attacks on Activists Traced to FinFisher Spyware of Gamma|url=http://www.bloomberg.com/news/2012-07-25/cyber-attacks-on-activists-traced-to-finfisher-spyware-of-gamma.html|accessdate=August 31, 2012|newspaper=Bloomberg|date=July 25, 2012|author=Vernon Silver}}</ref> which markets the [[spyware]] through law enforcement channels.<ref name=NYT83012 /> Gamma International is a subsidiary of the Gamma Group, specializing in surveillance and monitoring, including equipment, software and training services,<ref name="RSF-Corporate_Enemies" /> reportedly owned by William Louthean Nelson through a [[shell corporation]] in the [[British Virgin Islands]].<ref>{{cite news | first = David | last = Leigh | coauthors = Harold Frayman, James Ball | title = Nominee Directors Linked to Intelligence, Military | date = November 28, 2012 | publisher = [[Center for Public Integrity]] | url = http://www.icij.org/offshore/nominee-directors-linked-intelligence-military | work = The International Consortium of Investigative Journalists | accessdate = December 1, 2012}}</ref> Controversy has resulted from it having apparently been marketed to government security officials who were told it could be covertly installed on suspects' computers through exploiting security lapses in the [[patch (computing)|update]] procedures of non-suspect software.<ref name=Wsj2011-11-21>
'''FinFisher''', also known as '''FinSpy''',<ref name=NYT83012>{{cite news|title=Software Meant to Fight Crime Is Used to Spy on Dissidents|url=http://www.nytimes.com/2012/08/31/technology/finspy-software-is-tracking-political-dissidents.html|accessdate=August 31, 2012|newspaper=The New York Times|date=August 30, 2012|author=Nicole Perlroth}}</ref> is surveillance software marketed by Gamma International, a software firm with a [[United Kingdom|UK]]-based branch Gamma International Ltd in [[Andover]], [[United Kingdom]], and a [[Germany]]-based branch Gamma International GmbH in [[Munich]]<ref name="RSF-Corporate_Enemies">[http://surveillance.rsf.org/en/gamma-international/ "Corporate Enemies: Gamma International"], ''The Enemies of the Internet, Special Edition: Surveillance'', Reporters Without Borders, 12 March 2013.</ref><ref name=B72512>{{cite news|title=Cyber Attacks on Activists Traced to FinFisher Spyware of Gamma|url=http://www.bloomberg.com/news/2012-07-25/cyber-attacks-on-activists-traced-to-finfisher-spyware-of-gamma.html|accessdate=August 31, 2012|newspaper=Bloomberg|date=July 25, 2012|author=Vernon Silver}}</ref> which markets the [[spyware]] through law enforcement channels.<ref name=NYT83012 /> Gamma International is a subsidiary of the Gamma Group, specializing in surveillance and monitoring, including equipment, software and training services,<ref name="RSF-Corporate_Enemies" /> reportedly owned by William Louthean Nelson through a [[shell corporation]] in the [[British Virgin Islands]].<ref>{{cite news | first = David | last = Leigh | coauthors = Harold Frayman, James Ball | title = Nominee Directors Linked to Intelligence, Military | date = November 28, 2012 | publisher = [[Center for Public Integrity]] | url = http://www.icij.org/offshore/nominee-directors-linked-intelligence-military | work = The International Consortium of Investigative Journalists | accessdate = December 1, 2012}}</ref> Controversy has resulted from it having been marketed to government security officials who were told it could be covertly installed on suspects' computers through exploiting security lapses in the [[patch (computing)|update]] procedures of non-suspect software.<ref name=Wsj2011-11-21>
{{cite news
{{cite news
| url = http://blogs.wsj.com/digits/2011/11/21/surveillance-company-says-it-sent-fake-itunes-flash-updates-documents-show/
| url = http://blogs.wsj.com/digits/2011/11/21/surveillance-company-says-it-sent-fake-itunes-flash-updates-documents-show/

Revision as of 18:48, 1 May 2013

FinFisher, also known as FinSpy,[1] is surveillance software marketed by Gamma International, a software firm with a UK-based branch Gamma International Ltd in Andover, United Kingdom, and a Germany-based branch Gamma International GmbH in Munich[2][3] which markets the spyware through law enforcement channels.[1] Gamma International is a subsidiary of the Gamma Group, specializing in surveillance and monitoring, including equipment, software and training services,[2] reportedly owned by William Louthean Nelson through a shell corporation in the British Virgin Islands.[4] Controversy has resulted from it having been marketed to government security officials who were told it could be covertly installed on suspects' computers through exploiting security lapses in the update procedures of non-suspect software.[5][6][7] Egyptian dissidents who ransacked the offices of Egypt's secret police following the overthrow of Egyptian President Hosni Mubarak reported they discovered a contract with Gamma International for €287,000 for a license to run the FinFisher software.[8]

Elements of the FinFisher suite

In addition to spyware the FinFisher suite offered by Gamma to the intelligence community includes monitoring of ongoing developments and updating of solutions and techniques which complement those developed by intelligence agencies.[9] The software suite, which the company calls "The Remote Monitoring and Deployment Solutions" has the ability to take control of target computers and capture even encrypted data and communications. Using "enhanced remote deployment methods" it can install software on target computers.[10] An "IT Intrusion Training Program" is offered which includes training in methods and techniques and in use of the company supplied software.[11]

The suite is marketed in Arabic, English, German, French, Portuguese, and Russian and offered worldwide at trade shows which offer intelligence support system, ISS, training and products to law enforcement and intelligence agencies.[12]

Method of infection

The surveillance suite is installed after the target accepts installation of a fake update to commonly used software.[5] Code which will install the malware has also been detected in emails.[13] The software, which is designed to evade detection by anti-virus software, has versions which work on mobile phones of all major brands.[1]

A security flaw in Apple's iTunes allowed unauthorized third parties to use iTunes online update procedures to install unauthorized programs.[6][7] Gamma International offered presentations to government security officials at security software trade shows where they described to security officials how to covertly install the FinFisher spy software on suspect's computers using iTunes' update procedures.

The security flaw in iTunes that FinFisher is reported to have exploited was first described in 2008 by security software commentator Brian Krebs.[6][7][14] Apple did not patch the security flaw for more than three years, until November 2011. Apple officials have not offered an explanation as to why the flaw took so long to patch. Promotional videos used by the firm at trade shows which illustrate how to infect a computer with the surveillance suite were released by Wikileaks in December, 2011.[3]

Use by repressive regimes

Its wide use by governments facing political resistance was reported in March 2011 after Egyptian protesters raided State Security Investigations Service and found letters from Gamma International UK Ltd., confirming that SSI was using a trial version for 5 months.[15] A similar report in August 2012 concerned e-mails received by Bahraini activists and passed on (via a Bloomberg reporter) to University of Toronto computer researchers Bill Marczak and Morgan Marquis-Boire in May 2012. Analysis of the e-mails revealed code (FinSpy) designed to install spyware on the recipient's computer.[1][13] A spokesman for Gamma claims no software was sold to Bahrain and that the software detected by the researchers was not a legitimate copy but perhaps a stolen, reverse-engineered or modified demonstration copy.[16]

Gamma International: Corporate Enemy of the Internet

On 12 March 2013 Reporters Without Borders named Gamma International as one of five "Corporate Enemies of the Internet" and “digital era mercenaries” for selling products that have been or are being used by governments to violate human rights and freedom of information. FinFisher technology was used in Bahrain and Reporters Without Borders, together with Privacy International, the European Center for Constitutional and Human Rights (ECCHR), the Bahrain Centre for Human Rights, and Bahrain Watch filed an Organisation for Economic Co-operation and Development (OECD) complaint, asking the National Contact Point in the United Kingdom to further investigate Gamma’s possible involvement in Bahrain. Research has shown that FinFisher technology was used in Australia, Bahrain, Bangladesh, Britain, Brunei, Canada, the Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, the United Arab Emirates, the United States and Vietnam.[2][3][17][18]

Firefox Masquerading

FinFisher is capable of masquerading as other more legitimate programs, such as Mozilla Firefox. On April 30, 2013, Mozilla announced[19] that they had sent Gamma a cease-and-desist letter for trademark infringement.

Detection

Bill Marczak said of FinSpy mobile "As we saw with respect to the desktop version of Finfisher, antivirus alone isn't enough, as it bypassed antivirus scans."[20] Sara Yin predicts that antivirus vendors are likely to have updated their signatures to detect FinSpy mobile.[20] ESET have announced detection of the desktop FinFisher as Win32/Belesak.D Trojan,[21][22] and antivirus vendors have claimed they detect malware they know about regardless of origin or purpose.[22][23]

See also

References

  1. ^ a b c d Nicole Perlroth (August 30, 2012). "Software Meant to Fight Crime Is Used to Spy on Dissidents". The New York Times. Retrieved August 31, 2012.
  2. ^ a b c "Corporate Enemies: Gamma International", The Enemies of the Internet, Special Edition: Surveillance, Reporters Without Borders, 12 March 2013.
  3. ^ a b c Vernon Silver (July 25, 2012). "Cyber Attacks on Activists Traced to FinFisher Spyware of Gamma". Bloomberg. Retrieved August 31, 2012.
  4. ^ Leigh, David (November 28, 2012). "Nominee Directors Linked to Intelligence, Military". The International Consortium of Investigative Journalists. Center for Public Integrity. Retrieved December 1, 2012. {{cite news}}: Unknown parameter |coauthors= ignored (|author= suggested) (help)
  5. ^ a b Jennifer Valentino-Devries (2011-11-21). "Surveillance Company Says It Sent Fake iTunes, Flash Updates". The Wall Street Journal. Retrieved 2011-11-28. Perhaps the most extensive marketing materials came from Gamma's FinFisher brand, which says it works by "sending fake software updates for popular software," from Apple, Adobe and others. The FinFisher documentation included brochures in several languages, as well as videos touting the tools.
  6. ^ a b c Christopher Williams (2011-11-24). "Apple iTunes flaw 'allowed government spying for 3 years'". The Daily Telegraph. Archived from the original on 2011-11-28. Retrieved 2011-11-28. A British company called Gamma International marketed hacking software to governments that exploited the vulnerability via a bogus update to iTunes, Apple's media player, which is installed on more than 250 million machines worldwide. {{cite news}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  7. ^ a b c Marcel Rosenbach (2011-11-22). "Firm Sought to Install Spyware Via Faked iTunes Updates". Der Spiegel. Archived from the original on 2011-11-28. Retrieved 2011-11-28. Apparently, at least according to a video promoting FinFisher, the software uses Apple's popular iTunes in order to load snooping software onto the computers of the intended suspects. {{cite news}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  8. ^ John Leyden (2011-09-21). "UK firm denies supplying spyware to Mubarak's secret police: RATs nest found in Egyptian spook HQ". The Register. Archived from the original on 2011-11-28. Retrieved 2011-11-28. Documents uncovered when the country's security service headquarters were ransacked during the Arab Spring uprising suggest that Egypt had purchased a package called FinFisher to spy on dissidents. {{cite news}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  9. ^ "Portfolio". FinFisher IT Intrusion. Gamma Group. Retrieved August 31, 2012. Gamma addresses ongoing developments in the IT Intrusion field with solutions to enhance the capabilities of our clients. Easy to use high-end solutions and techniques complement the intelligence community's knowhow enabling it to address relevant Intrusion challenges on a tactical level.
  10. ^ "Portfolio". FinFisher IT Intrusion. Gamma Group. Retrieved August 31, 2012. The Remote Monitoring and Deployment Solutions are used to access target Systems to give full access to stored information with the ability to take control of target systems' functions to the point of capturing encrypted data and communications. When used in combination with enhanced remote deployment methods, the Government Agencies will have the capability to remotely deploy software on target systems.
  11. ^ "Portfolio". FinFisher IT Intrusion. Gamma Group. Retrieved August 31, 2012. The IT Intrusion Training Program includes courses on both, products supplied as well as practical IT Intrusion methods and techniques. This program transfers years of knowledge and experience to endusers, thus maximizing their capabilities in this field.
  12. ^ "News". Gamma Group. Retrieved August 31, 2012.
  13. ^ a b Nicole Perlroth (August 13, 2012). "Elusive FinSpy Spyware Pops Up in 10 Countries" (blog by reporter). The New York Times. Retrieved August 31, 2012.
  14. ^ Brian Krebs (2011-11-23). "Apple Took 3+ Years to Fix FinFisher Trojan Hole". Krebs on Security. Archived from the original on 2011-11-28. Retrieved 2011-11-28. I first wrote about this vulnerability for The Washington Post in July 2008, after interviewing Argentinian security researcher Francisco Amato about "Evilgrade," a devious new penetration testing tool he had developed. {{cite news}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  15. ^ http://www.shorouknews.com/columns/view.aspx?cdate=23102012&id=c5b92fd7-d56e-484c-865b-f7856fde2a48#.UIgxY6rEuk5.facebook
  16. ^ Vernon Silver (July 27, 2012). "Gamma Says No Spyware Sold to Bahrain; May Be Stolen Copy". Bloomberg News. Retrieved August 31, 2012.
  17. ^ "FinFisher Mobile Spyware Tracking Political Activists", Mathew J. Schwartz, Information Week, 31 August 2012
  18. ^ "Researchers Find 25 Countries Using Surveillance Software", Nicole Perlroth, The New York Times, 15 March 2013
  19. ^ "Protecting our brand from a global spyware provider", Mozilla Foundation, April 30, 2013
  20. ^ a b Sara Yin (August 30, 2012). "Lessons Learnt From FinFisher Mobile Spyware". PC Magazine. Retrieved September 3, 2012.
  21. ^ Cameron Camp (August 31, 2012). "FinSpy and FinFisher spy on you via your cellphone and PC, for good or evil?". ESET. Retrieved September 3, 2012.
  22. ^ a b David Harley (August 31, 2012). "Finfisher and the Ethics of Detection". ESET. Retrieved September 3, 2012.
  23. ^ Mathew J. Schwartz (August 31, 2012). "FinFisher Mobile Spyware Tracking Political Activists". Information Week. Retrieved September 3, 2012.
Retrieved from "https://en.wikipedia.org/w/index.php?title=FinFisher&oldid=553081376"