Google engineer finds British spyware on PCs and smartphones
FinSpy turning up in dictatorships across the world
Two security researchers have found new evidence that legitimate spyware sold by British firm Gamma International appears to be being used by some of the most repressive regimes in the world.
Google security engineer Morgan Marquis-Boire and Berkeley student Bill Marczak were investigating spyware found in email attachments to several Bahraini activists. In their analysis they identified the spyware infecting not only PCs but a broad range of smartphones, including iOS, Android, RIM, Symbian, and Windows Phone 7 handsets.
The spying software has the capability to monitor and report back on calls and GPS positions from mobile phones, as well as recording Skype sessions on a PC, logging keystrokes, and controlling any cameras and microphones that are installed.
They report the code appears to be FinSpy, a commercial spyware sold to countries for police criminal investigations. FinSpy was developed by the German conglomerate Gamma Group and sold via the UK subsidiary Gamma International. In a statement to Bloomberg, managing director Martin Muench denied the company had any involvement.
"As you know we don't normally discuss our clients but given this unique situation it's only fair to say that Gamma has never sold their products to Bahrain," he said. "It is unlikely that it was an installed system used by one of our clients but rather that a copy of an old FinSpy demo version was made during a presentation and that this copy was modified and then used elsewhere."
Parallel research by computer investigators at Rapid7 found command and control software servers for the FinSpy code running in Indonesia, Australia, Qatar, Ethiopia, the Czech Republic, Estonia, Mongolia, Latvia, and the United Arab Emirates, with another server in the US running on Amazon's EC2 cloud systems. Less than 24 hours after the research was published, the team noted that several of these servers were shut down.
Gamma and FinSpy gained notoriety last year when documents apparently from the company were found in the Egyptian security service headquarters when it was ransacked by protestors after the fall of Hosni Mubarak. These appear to be a proposal that the Egyptian government buy a five-month license for the software for ?287,000. Again Gamma denied involvement.
But Marquis-Boire and Marczak told The New York Times that they appear to have found a link to Gamma in these latest code samples. The malware for Symbian phones uses a code certificate issued to Cyan Engineering, whose website is registered to one Johnny Geds.
The same name is listed as Gamma Group's sales contact on the FinSpy proposal uncovered in the raid on Egypt's security headquarters. Muench has confirmed they do employ someone of that name in sales but declined to comment further.
Commercial spyware is an increasingly lucrative racket, as El Reg has pointed out, and there's growing evidence that Britain is one of the leading players in the market. Privacy International has formally warned the British government that it will be taking legal action on the issue and this latest research only adds weight to the issue
> Google engineer finds British spyware on PCs and smartphones
> FinSpy turning up in dictatorships across the world
> Two security researchers have found new evidence that legitimate spyware
> sold by British firm Gamma International appears to be being used by some of
> the most repressive regimes in the world.
> Google security engineer Morgan Marquis-Boire and Berkeley student Bill
> Marczak were investigating spyware found in email attachments to several
> Bahraini activists. In their analysis they identified the spyware infecting
> not only PCs but a broad range of smartphones, including iOS, Android, RIM,
> Symbian, and Windows Phone 7 handsets.
> The spying software has the capability to monitor and report back on calls
> and GPS positions from mobile phones, as well as recording Skype sessions on
> a PC, logging keystrokes, and controlling any cameras and microphones that
> are installed.
> They report the code appears to be FinSpy, a commercial spyware sold to
> countries for police criminal investigations. FinSpy was developed by the
> German conglomerate Gamma Group and sold via the UK subsidiary Gamma
> International. In a statement to Bloomberg, managing director Martin Muench
> denied the company had any involvement.
> "As you know we don't normally discuss our clients but given this unique
> situation it's only fair to say that Gamma has never sold their products to
> Bahrain," he said. "It is unlikely that it was an installed system used by
> one of our clients but rather that a copy of an old FinSpy demo version was
> made during a presentation and that this copy was modified and then used
> elsewhere."
> Parallel research by computer investigators at Rapid7 found command and
> control software servers for the FinSpy code running in Indonesia,
> Australia, Qatar, Ethiopia, the Czech Republic, Estonia, Mongolia, Latvia,
> and the United Arab Emirates, with another server in the US running on
> Amazon's EC2 cloud systems. Less than 24 hours after the research was
> published, the team noted that several of these servers were shut down.
> Gamma and FinSpy gained notoriety last year when documents apparently from
> the company were found in the Egyptian security service headquarters when it
> was ransacked by protestors after the fall of Hosni Mubarak. These appear to
> be a proposal that the Egyptian government buy a five-month license for the
> software for ?287,000. Again Gamma denied involvement.
> But Marquis-Boire and Marczak told The New York Times that they appear to
> have found a link to Gamma in these latest code samples. The malware for
> Symbian phones uses a code certificate issued to Cyan Engineering, whose
> website is registered to one Johnny Geds.
> The same name is listed as Gamma Group's sales contact on the FinSpy
> proposal uncovered in the raid on Egypt's security headquarters. Muench has
> confirmed they do employ someone of that name in sales but declined to
> comment further.
> Commercial spyware is an increasingly lucrative racket, as El Reg has
> pointed out, and there's growing evidence that Britain is one of the leading
> players in the market. Privacy International has formally warned the British
> government that it will be taking legal action on the issue and this latest
> research only adds weight to the issue
What do we have on our PCs that is worth to spy of ?
In 2004 I hat a lot of British Internet Porns on my PC.
Ever an ever I put in the search engines :
Elder Sex
Sex matured
Elder women Sex
.......... an the Police came and took my PC away.
Munich Psychiaters are saying : " You are sick, .... Sick !!!! ...
SIIIIICK !!!!!! ....."
> What do we have on our PCs that is worth to spy of ?
<copied>
The spying software has the capability to monitor and report back on calls and GPS positions from mobile phones, as well as recording Skype sessions on a PC, logging keystrokes, and controlling any cameras and microphones that are installed.
Unfortunately, a family s PC may be compromised and provide hackers with valuable information that could include addresses and phone numbers, bank user names and passwords, and credit card numbers.
Identity thieves and hackers target home computers because they know families often do not maintain adequate security protection on their PCs. This makes these family users easy, lucrative marks. Many hackers access your personal information in order to steal your money and your identity. Others might want to use your home computer as a shield to mask their identity as they steal from others.
> Google engineer finds British spyware on PCs and smartphones
> FinSpy turning up in dictatorships across the world
> Two security researchers have found new evidence that legitimate spyware
> sold by British firm Gamma International appears to be being used by
> some of the most repressive regimes in the world.
> Google security engineer Morgan Marquis-Boire and Berkeley student Bill > Marczak were investigating spyware found in email attachments to several
> Bahraini activists. In their analysis they identified the spyware
> infecting not only PCs but a broad range of smartphones, including iOS,
> Android, RIM, Symbian, and Windows Phone 7 handsets.
> The spying software has the capability to monitor and report back on
> calls and GPS positions from mobile phones, as well as recording Skype
> sessions on a PC, logging keystrokes, and controlling any cameras and
> microphones that are installed.
I never expected the British to write malicious software aimed at supporting repressive Middle East regimes.
I think the British have a gentlemanly image and performed neat cultural starting and ending ceremonies at the summer Olympics. Maybe it was clever public relations propaganda.
