Finfisher Spyware used by governments is Covertly Collecting Data Under Firefox Logo

[Poly Hedra]

Please see post no. 2

http://www.bbc.co.uk/news/technology-22372027

=============

[PurpleLama]

Bad link, here ya go:

http://www.bbc.co.uk/news/technology-22372027

The Mozilla Foundation has accused UK software group Gamma International of falsely associating one of its products with the Firefox name.

Finfisher is a legitimate surveillance software thought to be used by governments to covertly obtain data.

It is installed unknowingly by its target computer user, often by disguising itself as an update to a well known programme such as Firefox.

Gamma International has not responded to emailed requests for comment.

University of Toronto research group The Citizen Lab claims it has found possible evidence of Finfisher in the servers of 36 different countries, reports the Associated Press.

In 2011 the BBC found documents in the state security building in Egypt, looted during the uprising, which suggested that the Hampshire-based firm had offered to supply Finfisher to the Egyptian government to monitor activists.

Gamma International denied supplying it but the files seen by the BBC described a five month trial which included successful access to email accounts and the recording of encrypted Skype calls.

The Mozilla Foundation has now sent a cease and desist letter, warning Gamma International not to use the name of Firefox, its open source browser, as camouflage for the programme.

"Our brand and trademarks are used by the spyware as a method to avoid detection and deletion," said Mozilla chief privacy officer Alex Fowler in a statement.

"As an open source project trusted by hundreds of millions of people around the world, defending Mozilla's trademarks from this abuse is vital to our brand, mission and continued success."

[Poly Hedra]

Thanks Reilly

Here is a link to the group mentioned called Citizen Lab. Looks like a good website to visit on a regular basis to keep track of what these dirty scumbags are doing to monitor us. Hope the link works this time.
http://www.citizenlab.org/about/

A recent PDF report published on May 01st 2013 by citizen lab titled For Their Eyes Only: The Commercialisation of Digital Spying.
Legends!
http://www.citizenlab.org/2013/04/fo...r-eyes-only-2/

[mosquito]

I wonder if there's a simple way of finding out if the version of firefox one is using has been hijacked.

[Poly Hedra]

It's probable that anyone that uses Firefox has this malware in their computer. Although dissidents, activists and other people of interest were especially targetted.
The spyware was found in 36 countries including USA and UK.

It was sent to dissident pro democracy people in Bahrain. They were sent emails and the attachment was the malware. The spyware used a file system that was readable from right to left which meant that a file looking innocent eg. Exe.fhgg.jpg looks like a harmless jpg but in fact the file is an executable file: jpg.fhgg.exe
the dissidents were sent an email asking them to look at pictures that involved wrong-doings in their country.
The IP address's that were collecting the data were traced to Gamma International (the UK based company) and the Bahrains largest telecommunications company.



To give you an idea of what the malware does I have written down an excerpt from the report.

"publicly available descriptions of the FinSpy tool collected by Privacy Interenational among others and posted in Wikileaks make a series of claims about functionality:

*bypassing of 40 regularly tested antivirus systems

*covert communication with headquarters

*full Skype monitoring (calls, chats, file transfers, video, contact lists)

*recording of common communication like email, chats and voice-over-IP

*live surveillance through webcam and microphone

*country tracing of target

*silent extracting of files from hard disk

*process-based key-logger for faster analysis

*live remote forensics on target system

*advanced filters to record only important information

*supports most common operating systems Mac OSX, Windows and Linux."

Well I would have to say that its possible a few people here may have this spyware.
I don't know how they get rid of it because of the advanced evasion capabilities.

[Poly Hedra]

I think it's important that people are aware of this malware so bump bump bump

[ThePythonicCow]

Posted by conec (here)
It's probable that anyone that uses Firefox has this malware in their computer.

That is, I suspect, misleading .

Finspy has a variety of means of invading Windows, Mac OS or Linux systems. Looking like it is Firefox software is just one means. So two implications of your statement, that using Firefox puts one at particularly increased risk, or that the majority of Firefox users have this malware on this system, may well both be false.

They can "get to" almost anyone who uses a computer or phone to access the web, unless they really want to, in which case they can get to any of us. Until "recently" (for some unknown value of "recently") their primary limitation was the human brain power required to analyze and act on collected data. This spyware shows that limitation ... it enables human access to data we thought confidential. They only have so many smart humans they can rely on for such work.

To the extent that they can automate analysis and action (rather like a weaponized and automated drone in the physical world), to that extent their limited human intelligence is greatly amplified. That threat is not evident in this Finfish/Finspy story. That threat is a grave one for humanity as we know it. The reach of their sensors, when amplified by the automated data storage and analysis capacity they are developing, will make it increasingly difficult for any human, outside the privacy of their own mind, to have any communication or take any action covertly.

[Poly Hedra]

Sorry Paul. I was under the mistaken impression that this was the case. The premise was that finfisher was masquerading as a Firefox update so I assumed wrongly.
An ill-considered statement.
Here is a link from Mozilla explaining it properly.

http://www.blog.mozilla.org/blog/201...ware-provider/

"It’s important to note that the spyware does not affect Firefox itself, either during the installation process or when it is operating covertly on a person’s computer or mobile device. Gamma’s software is entirely separate, and only uses our brand and trademarks to lie and mislead as one of its methods for avoiding detection and deletion."

The reason I think this is important is because finfisher has targeted dissidents, activists, journalists and pro-democracy protesters. Could this include outspoken people like Alex Jones or other people in the last year who have died in suspicious circumstances?
I'm not trying to say this is fact but I'm asking these questions myself. Just wondering if anyone else is wondering this too.
I think Bill could fall into one of these categories, among others on this forum, so many confidential emails, Skype, live access and recording of webcam and microphone.
So whether this finfisher is able to be so prolific or not I think it does not matter because the people who are fighting our corner are being targeted.

[InCiDeR]

Posted by conec (here)
Sorry Paul. I was under the mistaken impression that this was the case. The premise was that finfisher was masquerading as a Firefox update so I assumed wrongly.

Here is a link from Mozilla explaining it properly.

http://www.blog.mozilla.org/blog/201...ware-provider/

"It’s important to note that the spyware does not affect Firefox itself, either during the installation process or when it is operating covertly on a person’s computer or mobile device. Gamma’s software is entirely separate, and only uses our brand and trademarks to lie and mislead as one of its methods for avoiding detection and deletion."


After doing more searching on the subject of how to find out if finfisher is on someone's pc I have come across This blog describing how to detect and remove it.

http://www.kingsoftsecurity.com/blog/?p=3151

I would not recommend that solution which Kingsoft Security suggest.

PC safe doctor is rogue anti-spyware according to many report I see on the Internet. You should NEVER install any program unless you have checked it out first. It is too late when the program you thought would clean your computer already installed masses of spyware itself...

Here is a better alternative in my opinion: http://www.malwarebytes.org/

Malwarebytes been around for quite some time, they are well reputed and has a free version of their malware software.


It is interesting though, that they feel the need of Finfish/Finspy to act covertly, when millions of people by free will use spyware software and even add them to their computers everyday: Skype, Facebook, Linkedin, etc etc... just saying.

Firefox seems to be the target, but that might just be a cover up for the real target, mainly the open source community. Open source is no good for "their" control mechanism, so if they can misscredit that community people might buy their controlled software instead.

By the way, the only secure way to not being tracked on internet, no matter what you do or how many firewalls/antivirus/spyware-program you install... is simply to unplug!

[Poly Hedra]

Ok, thanks for the heads up about Kingsoft, I will remove that section of my post in case anyone tries to download that software.

I agree with you that we are constantly being spied on by Facebook, Skype etc. and the only way to avoid such intrusion is to plug out. Totally agree.

I think the point I'm trying to make about how this software was used in 36 countries, how it is so sophisticated, how it specifically targets certain people and how it has complete access to everything on a persons pc once installed.
There's a reason why this is being reported in every tech website, newspaper and blog.

I'm trying really hard to point out why this malwa is different to your usual run of the mill spyware. Read the report people if your interested. I'll leave it at that as I'm getting a bit tetchy.





Oiche maith goodnight in Irish pronounced eeha mah

[InCiDeR]

Posted by conec (here)
Ok, thanks for the heads up about Kingsoft, I will remove that section of my post in case anyone tries to download that software.

I agree with you that we are constantly being spied on by Facebook, Skype etc. and the only way to avoid such intrusion is to plug out. Totally agree.

I think the point I'm trying to make about how this software was used in 36 countries, how it is so sophisticated, how it specifically targets certain people and how it has complete access to everything on a persons pc once installed.
There's a reason why this is being reported in every tech website, newspaper and blog.

I'm trying really hard to point out why this malwa is different to your usual run of the mill spyware. Read the report people if your interested. I'll leave it at that as I'm getting a bit tetchy.

Yes, I totally agree with you conec. I wish that all computer users were more aware about this kinds of threats. It certainly is a new kind of spyware, at least when it comes to how many cover this story. Personally, this is nothing new, similar malware/spyware/rootkits have been around for a very long time... for not talking about the old famous ECHELON!

No one seems to talk about ECHELON anymore, and that in itself is quite interesting. With ECHELON there is no real need to install a remote malware on a computer... even though it makes it easier to access it, especially when it is behind strong shields.

[Poly Hedra]

Judging by your signature your a bit of a tech geek, in the nicest possible way of course. I am a little bit of a tech geek.
Cheers for the link. I read the article. it doesn't say whether echelon is still in use, do you know if it is? I guess that the new spyware is the same thing, different decade and technology perhaps?

[InCiDeR]

Posted by conec (here)
Judging by your signature your a bit of a tech geek, in the nicest possible way of course. I am a little bit of a tech geek.
Cheers for the link. I read the article. it doesn't say whether echelon is still in use, do you know if it is? I guess that the new spyware is the same thing, different decade and technology perhaps?

Hahaha... that was a nice way to put it! Well, I guess I am a tech geek as well... or more truly, not anymore! I left that scene a couple of years ago, but still keep a little interest up.

I know that ECHELON was very alive and kicking as late as 2011, and far more advanced at that stage than what wikipedia say. Since then, I don't know for sure, but they invested lots and lots of money into that system, so I can't really see why they shouldn't use it anymore. Here is an excerpt:

The United States government has gone to extreme lengths to keep ECHELON a secret. To this day, the U.S. government refuses to admit that ECHELON even exists. We know it exists because both the governments of Australia (through its Defence Signals Directorate) and New Zealand have admitted to this fact. However, even with this revelation, US officials have refused to comment.

This "wall of silence" is beginning to erode. The first report on ECHELON was published in 1988. In addition, besides the revelations from Australia, the Scientific and Technical Options Assessment program office (STOA) of the European Parliament commissioned two reports which describe ECHELON's activities. These reports unearthed a startling amount of evidence, which suggests that Echelon's powers may have been underestimated. The first report, entitled "An Appraisal of Technologies of Political Control," suggested that ECHELON primarily targeted civilians.

Source


Here are some interesting things about Google, that not many know about either:

Google is, in fact, is a key participant in U.S. military and CIA intelligence operations involving torture; subversion of foreign governments; illegal wars of aggression; and military occupations of countries which have never attacked the U.S. and which have cost hundreds of thousands of lives in Afghanistan, Iraq, Pakistan, and elsewhere.

To begin with, Google is the supplier of the core search technology for 'Intellipedia, a highly-secured online system where 37,000 U.S. spies and related personnel share information and collaborate on their devious errands.

Agencies such as the so-called 'National Security Agency' have also purchased servers using Google-supplied search technology which processes information gathered by U.S. spies operating all over the planet.

In addition, Google is linked to the U.S. spy and military systems through its Google Earth software venture. The technology behind this software was originally developed by Keyhole Inc., a company funded by Q-Tel http://www.iqt.org/ , a venture capital firm which is in turn openly funded and operated on behalf of the CIA.

Google acquired Keyhole Inc. in 2004. The same base technology is currently employed by U.S. military and intelligence systems in their quest, in their own words, for "full-spectrum dominance" of the planet.

Moreover, Googles' connection with the CIA and its venture capital firm extends to sharing at least one key member of personnel. In 2004, the Director of Technology Assessment at In-Q-Tel, Rob Painter, moved from his old job directly serving the CIA to become 'Senior Federal Manager' at Google.

As Robert Steele, a former CIA case officer has put it: Google is "in bed with" the CIA.

Googles Friends spy on millions of Internet Users

Given Google's supposed concern with 'break-in's to several of its email accounts, it's worth noting that Google's friends at In-Q-Tel, the investment arm of the CIA, are now investing in Visible Technologies, a software firm specialized in 'monitoring social media'.

The 'Visible' technology can automatically examine more than a million discussions and posts on blogs, online forums, Flickr, YouTube, Twitter, Amazon, and so forth each day. The technology also 'scores' each online item, assigning it a positive, negative or mixed or neutral status, based on parameters and terms set by the technology operators. The information, thus boiled down, can then be more effectively scanned and read by human operators.

The CIA venture capitalists at In-Q-Tel say they will use the technology to monitor social media operating in other countries and give U.S. spies “early-warning detection on how issues are playing internationally,” according to spokesperson Donald Tighe. There is every possibility that the technology can also be used by the U.S. intelligence operatives to spy on domestic social movements and individuals inside the U.S.

Finally, there is a curious absence from the statements emanating from Google - and from U.S. media reports - of any substantive evidence linking the Chinese government with the alleged break-in attempts to several Google email accounts.

Words like 'sophisticated' and 'suspicion' have appeared in the media to suggest that the Chinese government is responsible for the break-ins. That may be so. But it is striking that the media has seemingly asked no questions as to what the evidence behind the 'suspicions' might be

It should be noted that the U.S. government and its intelligence agencies have a long history of rogue operations intended to discredit governments or social movements with whom they happen to disagree. To see how far this can go, one need only recall the sordid history of disinformation, lies, and deceit propagated by U.S. government and media to frighten people into supporting the Iraq war.

Whether the attacks on Google email originated from the Chinese government, or from elsewhere, one thing is clear: A company that supplies the CIA with key intelligence technology; supplies mapping software which can be used for barbarous wars of aggression and drone attacks which kill huge numbers of innocent civilians; and which in general is deeply intertwined with the CIA and the U.S. military machines, which spy on millions, the company cannot be motivated by real concern for the human rights and lives of the people in China.

Source


Sorry for derailing the thread, I will keep to the subject next time!

[Poly Hedra]

No worries about derailing the thread, I'm very glad to learn more about this and the connections with google and the cia. Thanks

I didn't realise it was this insidious at all, depressing. The Internet is well and truly not safe.