Android Trojan Found in Targeted Attack

source

In the past, we've seen targeted attacks against Tibetan and Uyghur activists on Windows and Mac OS X platforms. We've documented several interesting attacks (A Gift for Dalai Lamas Birthday and Cyber Attacks Against Uyghur Mac OS X Users Intensify) which used ZIP files as well as DOC, XLS and PDF documents rigged with exploits.

Several days ago, the e-mail account of a high-profile Tibetan activist was hacked and used to send targeted attacks to other activists and human rights advocates. Perhaps the most interesting part is that the attack e-mails had an APK attachment - a malicious program for Android.

The attack

On March 24th, 2013, the e-mail account of a high-profile Tibetan activist was hacked and used to send spear phishing e-mails to their contact list. This is what the spear phishing e-mail looked like:

In regards to the message text above, multiple activist groups have recently organized a human rights conference event in Geneva. We've noticed an increase in the number of attacks using this event as a lure. Here's another example of such an attack hitting Windows users:

Going back to the Android Package (APK) file was attached to the e-mail, this is pushing an Android application named "WUC's Conference.apk".

This malicious APK is 334326 bytes file, MD5: 0b8806b38b52bebfe39ff585639e2ea2 and is detected by Kaspersky Lab products as "Backdoor.AndroidOS.Chuli.a".

After the installation, an application named "Conference" appears on the desktop:

If the victim launches this app, he will see text which "enlightens" the information about the upcoming event:

The full text reads follows. Notice notice the use of the mistaken "Word" instead of "World":

"On behalf of all at the Word Uyghur Congress (WUC), the Unrepresented Nations and Peoples Organization (UNPO) and the Society for Threatened Peoples (STP), Human Rights in China: Implications for East Turkestan, Tibet and Southern Mongolia

In what was an unprecedented coming-together of leading Uyghur, Mongolian, Tibetan and Chinese activists, as well as other leading international experts, we were greatly humbled by the great enthusiasm, contribution and desire from all in attendance to make this occasion something meaningful, the outcome of which produced some concrete, action-orientated solutions to our shared grievances. We are especially delighted about the platform and programme of work established in the declaration of the conference, upon which we sincerely hope will be built a strong and resolute working relationship on our shared goals for the future. With this in mind,we thoroughly look forward to working with you on these matters.

Dolkun lsa

Chairman of the Executive Committee

 

Word Uyghur Congress"

While the victim reads this fake message, the malware secretly reports the infection to a command-and-control server. After that, it begins to harvest information stored on the device. The stolen data includes:

• Contacts (stored both on the phone and the SIM card).
• Call logs.
• SMS messages.
• Geo-location.
• Phone data (phone number, OS version, phone model, SDK version).

It is important to note that the data won't be uploaded to C&C server automatically. The Trojan waits for incoming SMS messages (the "alarmReceiver.class") and checks whether these messages contain one of the following commands: "sms", "contact", "location", "other". If one these commands is found, then the malware will encode the stolen data with Base64 and upload it to the command and control server. The C2 URL is:

hxxp://64.78.161.133/*victims's_cell_phone_number*/process.php

In addition to this, the malware also reports to another script, "hxxp://64.78.161.33/android.php". First, it will get the "nativenumber" variable from the "telmark" value of "AndroidManifest.xml". This is hardcoded and equals "phone". Then, it will add the result of the public method localDate.getTime(), which simply gets the current date. An example of the string which is sent to the command-and-control would be "phone 26.03.2013".

It is interesting that the attackers used Java Base64 library developed by Sauron Software. This software is free and distributed under LGPL license.

Also, command communications with the malware are parsed with a function named "chuli()" prior to POSTing stolen data to the command-and-control server. It appears that the attackers are somewhat familiar with the language and mountain-trekking culture of the targets - the meaning of "chuli" is "summit":

The command-and-control server and parameters can be easily seen in the decompiled source code:

Command and control server interaction code

Throughout the code, the attackers log all important actions, which include various messages in Chinese. This was probably done for debugging purposes, indicating the malware may be an early prototype version. Some actions include (with rough translations):

The command-and-control server

The command-and-control server is located at IP 64.78.161.133. This IP is located in Los Angeles, U.S.A., at a hosting company named "Emagine Concept Inc".

Interestingly, there is a domain which used to point there, "DlmDocumentsExchange.com". The domain was registered on March 8th, 2013:

Registration Service Provided By: SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD.

Domain Name: DLMDOCUMENTSEXCHANGE.COM

Registration Date: 08-Mar-2013

Expiration Date: 08-Mar-2014

 

Status:LOCKED

The domain registration data indicates the following owner:

Registrant Contact Details:

peng jia

peng jia (bdoufwke123010@gmail.com)

beijingshiahiidienquc.d

beijingshi

beijing,100000

CN

Tel. +86.01078456689

 

Fax. +86.01078456689

The command-and-control server is hosting an index page which also serves an APK file:

The referenced "Document.apk" is 333583 bytes in size, MD5: c4c4077e9449147d754afd972e247efc. It has the same functionality as the one described above but contains different text. The new text (in Chinese, about relations between China, Japan and the disputed "Senkaku Islands / Diaoyudao Islands / Diaoyutai Islands") is shown to the victims and reads as following:

When opened in a browser, this is what the command-and-control index page looks like:

The text on the top means "Title Title Title" in Chinese, while the other strings appear to be random characters typed from the keyboard.

Interestingly, the command and control server includes a publicly accessible interface to work with the victims:

Some of the commands with rough translations:

The command-and-control server is running Windows Server 2003 and has been configured for Chinese language:

This, together with the logs, is a strong indicator that the attackers are Chinese-speaking.

Conclusions

Every day, there are hundreds if not thousands of targeted attacks against Tibetan and Uyghur supporters. The vast majority of these target Windows machines through Word documents exploiting known vulnerabilities such as CVE-2012-0158, CVE-2010-3333 and CVE-2009-3129.

In this case, the attackers hacked a Tibetan activist's account and used it to attack Uyghur activists. It indicates perhaps an interesting trend which is exploiting the trust relationships between the two communities. This technique reminds us of a combination between ages old war strategies "Divide et impera" and "By way of deception".

Until now, we haven't seen targeted attacks against mobile phones in the wild, although we've seenindications that these were in development.

The current attack took advantage of the compromise of a high-profile Tibetan activist. It is perhaps the first in a new wave of targeted attacks aimed at Android users. So far, the attackers relied entirely on social engineering to infect the targets. History has shown us that, in time, these attacks will use zero-day vulnerabilities, exploits or a combination of techniques.

For now, the best protection is to avoid any APK attachments that arrive on mobile phones via e-mail.

We detect the malware used in this attack as "Backdoor.AndroidOS.Chuli.a".

MD5s:

c4c4077e9449147d754afd972e247efc Document.apk

 

0b8806b38b52bebfe39ff585639e2ea2 WUC's Conference.apk

When a Secretive Stingray Cell Phone Tracking "Warrant" Isn't a Warrant

An Arizona federal court this afternoon will be the battleground over the government's use of a "Stingray" surveillance device in a closely watched criminal case, United States v. Rigmaiden. And in an important development, new documents revealed after an ACLU of Northern California Freedom of Information Act (FOIA) request should leave the government with some explaining to do.

"Stingray" is the brand name of an International Mobile Subscriber Identity locator, or “IMSI catcher.” A Stingray acts as a fake cell-phone tower, small enough to fit in a van, allowing the government to route all network traffic to the fake tower. We've warned that Stingrays are dangerous because they have the capability to obtain the contents of electronic and wire communications while necessarily sucking down data on scores of innocent people along the way.

The Fourth Amendment requires searches be "reasonable," generally meaning they must be accompanied by a warrant. To get a warrant, the government must show there is probable cause to believe the place they want to search will have evidence of a crime. And it means the judge must ensure the warrant is "particular," or limited to only allow searches into areas where the evidence is most likely to be found. The only way a judge can make these tough decisions is with the government being forthright about what it's doing.

But when it comes to Stingrays the government has been extremely secretive about its use, withholding documents in FOIA requests, failing to explain (or even understand) the technology to a Texas federal judge and in Rigmaiden, misleading the court about the fact it's even using one at all.

Daniel David Rigmaiden is charged with a variety of tax and wire fraud crimes. Hoping to pinpoint Rigmaiden's precise location within an apartment complex, federal agents applied for an order requesting the court to order Verizon to help the agents pinpoint the physical location of a wireless broadband access card and cell phone they believed Rigmaiden was using. The order is clearly directed towards Verizon:

The Court therefore ORDERS, pursuant to Federal Rule of Criminal Procedure 41(b); Title 18, United States Code, Sections 2703 and 3117; and Title 28, United States Code, Section 1651, that Verizon Wireless, within ten (10) days of the signing of this Order and for a period not to exceed 30 days, unless extended by the Court, shall provide to agents of the FBI data and information obtained from the monitoring of transmissions related to the location of the Target Broadband Access Card/Cellular Telephone...

Ultimately, it turns out the government did not just get Verizon to give it the data. It also used a Stingray device to find Rigmaiden, sucking up loads of other data from other electronic devices in the complex as well, which it deleted.

When Rigmaiden filed a motion to suppress the Stingray evidence as a warrantless search in violation of the Fourth Amendment, the government responded that this order was a search warrant that authorized the government to use the Stingray. Together with the ACLU of Northern California and the ACLU, we filed an amicus brief in support of Rigmaiden, noting that this "order" wasn't a search warrant because it was directed towards Verizon, made no mention of an IMSI catcher or Stingray and didn't authorize the government—rather than Verizon—to do anything. Plus to the extent it captured loads of information from other people not suspected of criminal activity it was a "general warrant," the precise evil the Fourth Amendment was designed to prevent.

The FOIA documents bolster our argument that this isn't a warrant. The documents are a series of internal emails from DOJ attorneys in the United States Attorney's Office for the Northern District of California, the district where the order in Rigmaiden's case was issued. Theemails make clear that U.S. Attorneys in the Northern California were using Stingrays but not informing magistrates of what exactly they were doing. And once the judges got wind of what was actually going on, they were none too pleased:

As some of you may be aware, our office has been working closely with the magistrate judges in an effort to address their collective concerns regarding whether a pen register is sufficient to authorize the use of law enforcement's WIT technology (a box that simulates a cell tower and can be placed inside a van to help pinpoint an individual's location with some specificity) to locate an individual. It has recently come to my attention that many agents are still using WIT technology in the field although the pen register application does not make that explicit.

While we continue work on a long term fix for this problem, it is important that we are consistent and forthright in our pen register requests to the magistrates… 

These emails, combined with the text of the disputed order itself, suggest agents obtained authorization to use a pen register without indicating they also planned to use a Stingray. Either at the time of the application or after the fact, the government attempted to transform that order into a warrant that authorized the use of a Stingray.

Judicial superivison of searches is most needed when the government uses new technologies to embark into new and unknown privacy intrusions. But when the government hides what it's really doing, it removes this important check on government power. We hope the court sees its been duped, and makes clear to the government that honesty and a warrant are requirements to using a Stingray.

source

Multiplatform Wiper widespread in attacks against South Korea

Recently South Korea has been hit by powerful cyber attack malware based, network provided by LG UPlus Corp was hacked by a group calling itself the “Whois Team”. The attack targeted also media and banking of the country, television networks YTN, MBC and KBS and Shinhan Bank and NongHyup Bank, two major banks of the country, suffered serious outage. Fortunately according South Korea’s representative none of critical infrastructures of the country was interested by the attacks.  

All principal security firms are investigating on the event analyzing the malicious code used for the attacks that revealed the capability to erase data also on Linux machines.  The source code of the Windows malware used by attackers presented an unexpected surprise, it was in fact equipped with a module able to work on Linux systems erasing the disks.

The malware include also a BASH shell script, attempts to erase partitions Unix systems, including Linux and HP-UX.

“The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions. It wipes out the /kernel, /usr, /etc, and /home directories.”

The discovery was announced by Symantec firms that dubbed it Jokra, following an extract from its blog post:

” The dropper for Trojan.Jokra contains a module for wiping remote Linux machines. We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat.”

The trojan Jokra runs on Windows XP and 7 invoking an open source remote access manager, named mRemote, that could be used to manage devices on different platforms.

The malware is able to overwrite the Master Boot Record of the infected machine making impossible the bootstrapping, according McAfee analysis the agent wiped out the MBR on the hard drives overwriting it with either one of these strings:

• PRINCIPES
• HASTATI
• PR!NCPES
• HASTATI and PR!NCPES in combination
• PRINCPES

 

Malware analysts at McAfee explained in their post on the topic:

“The attack also overwrote random parts of the file system with the same strings, rendering several files unrecoverable,” “So even if the MBR is recovered, the files on disk will be compromised too.”

“Three wipers are packaged as a position-independent executable (PIE) and a fourth as a dynamic-link library (DLL) injection. There are also some differences in regard to the timing.”

Another interesting behavior observed by researchers is that the malware also try to kill processes related two South Korean antivirus products commercialized by the companies Ahnlab and Hauri.

Avast security firm discovered the alleged source of the attack against Korean banks, it seems started from website of the Korean Software Property Right Council compromised to serve up an iframe that delivered an attack hosted on a third website.

Officials confirmed that the analysis of IP addresses did not reveal the real responsible for the attacks, due this reason Government of Seoul hasn’t speculated about the event, neither it has blamed North Korea, the situation is very complex and cyber attacks observed on this day may have been triggered by independent groups of hackers or by other states interested in exacerbating tensions in the area.

source

CrySyS Lab revealed a decennial cyber espionage operation by TeamSpy

Last week was monopolized by discussion on cyber attacks that hit North and South Korea, but was found a news equally stunning, researchers at Hungary-basedCrySyS Lab have discovered a decade-long cyber espionagecampaign that targeted high-level political and industrial entities in Eastern Europe.

The attackers, dubbed by security researchers TeamSpy, used the popular remote-access program TeamViewer and a specially crafted malware to steal secret documents and encryption keys from victims.

TeamSpy used various methods for cyber espionage including the use of a digitally signed malicious version of TeamViewer in which has been included “DLL hijacking” library to allow spying activities in real-time. Once installed the compromised program provides attackers with a backdoor to control victims.

Which are the targets of cyber espionage campaign?

The hackers hit a large variety of high-level subjects including Russia-based Embassy for a not reveled undisclosed country belonging to both NATO and the European Union, multiple research and educational organizations in France and Belgium, an electronics company located in Iran and an industrial manufacturer located in Russia. Following the list provided by the post in the correct timeline.

• 11/2012: Hungarian high profile governmental victim.
• 03/2013: Embassy of NATO/EU state in Russia
• 04/2010: Electronics company in Middle-East, Govt. background
• 03/2013: Multiple research/educational organizations in France and Belgium
• 03/2013: Industrial manufacturer in Russia

All started when Hungary’s National Security Authority revealed that an unnamed “Hungarian high-profile governmental victim” was hit by the TeamSpy.

What is really concerning is that the analysis of the malware dated the beginning of the cyber espionage operations to many years ago, and exactly as many other campaigns the attacks may have involved a great variety of countries all over the world.

The surprises do not end here, security researchers found that techniques adopted by TeamSpy are quite similar to methods implemented by the authors of an online banking fraud ring known as Sheldon, meanwhile researchers at Kaspersky Labfound similarities to the Red October cyber espionage campaign.

Both the TeamViewer technique and command servers used in the attack reminded to the researchers the  modus operandi of Sheldon malware.

The Kaspersky security experts wrote in the report:

“For at least several years, a mysterious threat actor infiltrated and tracked, performed surveillance and stole data from governmental organisations, some private companies and human rights activists throughout the Commonwealth of Independent States (CIS) and Eastern European nations. Some parts of this operation extended into Western nations and the Middle East as well, with victims in sectors such as energy and heavy industry manufacturing. The attackers performed their intelligence gathering and surveillance partly using TeamViewer (http://www.teamviewer.com/en/index.aspx), a legitimate support software package commonly used for remote administration. In addition, they deployed custom written intelligence gathering components and lateral movement utilities.”

Colleagues at CrySyS Lab confirmed that the campaign could be started a decade ago:

“Most likely the same attackers are behind the attacks that span for the last 10 years, as there are clear connections between samples used in different years and campaigns,” “Interestingly, the attacks began to gain new momentum in the second half of 2012.” “The attackers surely aim for important targets. This conclusion comes from a number of different facts, including victim IPs, known activities on some targets, traceroute for probably high-profile targets, file names used in information stealing activities, strange paramilitary language of some structures, etc.”

The TeamSpy operation also relies on more traditional malware tools that were custom-built for the purpose of espionage or bank fraud.

Kaspersky team confirmed that attackers used various malware and exploit kitsinfecting victims using “watering hole” attacks, in this way the TeamSpy compromised websites frequented by the intended victims, in many cases the malicious code used to infect victims was spread by Eleonore exploit kit.

This discovery is just the last in order of time, in the last couple of years several cyber espionage campaigns have been discovered, from Duqu to Flame, arriving to recentMahdi and Red October, the complexity of the operations, the target chosen, the nature of information stolen and the capability of attacker to maintains low profile for a so long time led security expert to believe that behind the campaigns there are groups of state sponsored hackers that conduct intelligence for their governmets.

I wonder how many political decisions have already been influenced by knowledge of the information stolen during these campaigns …

 

source

Richard Stallman says Ubuntu Linux is 'spyware'

 

FREE SOFTWARE PIONEER Richard Stallman has asked a South American free software association not to promote Ubuntu Linux at its events because it "spies on its users" by collecting its users' desktop search activity and selling the data to Amazon.

Canonical released Ubuntu 12.10 last October with Amazon search integrated into its Dash desktop search function.

Although Ubuntu users can opt out and Canonical claims it anonymises users' search information before sending it to Amazon, the change resulted in Ubuntu users being shown Amazon ads in response to desktop search queries.

The 'feature' has attracted a lot of criticism and might have led some users to defect to other Linux distributions.

When Stallman's request was denied by the FLISOL event organiser with the excuse that it would limit user freedom of choice, Stallman fired off a response to the organisation's entire mailing list on Sunday. Parts of his email are quoted below, as translated by Groklaw.

"The issue I raise is about what should happen at FLISOL events. Give away copies of Ubuntu or not? Promote Ubuntu or no? I asked the organisers of the event that they, as a policy, not distribute or promote Ubuntu.

"Freedom of users is something else, and there isn't a conflict between a user's freedom and my request. If someone decides to install Ubuntu, I would consider it a mistake, but it's his own choice to do it. What I ask is that you don't participate, help or suggest that he do it. I didn't request that you block him from doing so.

"As a matter of principle, I don't believe anyone has a right, morally, to distribute proprietary software, that is, software that deprives the users of freedom. When the user controls his own software, he can install what he wants and no one can stop him. But today's issue isn't about him, what he does, but rather what you do with him."

As Stallman sent his email only yesterday, it's not yet known whether FLISOL has reconsidered promoting Ubuntu at its free software events.

These points might seem like splitting hairs, but apparently Richard Stallman - the author of the GNU General Public Licence (GPL), as well as the founder and president of the Free Software Foundation - is serious about them.

Browser Security: Settings for Chrome, Firefox and Internet Explorer

Optimizing your browser’s settings is a critical step in using the Internet securely and privately. Today’s popular browsers include built-in security features, but users often fail to optimize their browser’s security settings on installation. Failing to correctly set up your browser’s security features can put you at a higher risk for malwareinfections and malicious attacks. This installation of our “Cybersecurity 101” series provides our tips for securing several of today’s most popular browsers, including Google Chrome, Mozilla Firefox, and Microsoft Internet Explorer. While it is impossible to guarantee complete protection from cyber threats, following these tips will greatly increase the security of your web browser.

Tips for Secure Browsing with Google Chrome

These settings can be accessed through Chrome’s “Advanced Settings” menu or by navigating to “chrome://settings/.”

• Enable phishing and malware protection: Make sure that Chrome’s phishing and malware protection feature is enabled under the “Privacy” section. This feature will warn you if a site you’re trying to visit may be phishing or contain malware.
• Turn off instant search: The Instant search feature should be turned off for optimal security. While it offers some convenience in searching, having this feature enabled means that anything you type in the address bar is instantly sent to Google.
• Don’t sync: Disconnect your email account from your browser under the “Personal Stuff” tab. Syncing your email account with your Chrome browser means that personal information such as passwords, autofill data, preferences, and more is stored on Google’s servers. If you must use sync, select the “Encrypt all synced data” option and create a unique passphrase for encryption.
• Configure content settings: Click “Content settings” under the “Privacy” section and do the following:
  • Cookies: Select “Keep local data only until I quit my browser” and “Block third-party cookies and site data.” These options ensure that your cookies will be deleted upon quitting Chrome and that advertisers will not be able to track you using third-party cookies.
  • JavaScript: Select “Do not allow any site to run JavaScript.” It is widely recommended that JavaScript be disabled whenever possible to protect users from its security vulnerabilities.
  • Pop-ups: Select “Do not allow any site to show pop-ups.
  • Location: Select “Do not allow any site to track my physical location.”
• Configure passwords and forms settings: Disable Autofill and deselect “Offer to save passwords I enter on the web” under the “Passwords and forms” section. Doing so will prevent Chrome from saving your logins, passwords, and other sensitive information that you enter into forms.

Tips for Secure Browsing with Mozilla Firefox

These settings can be accessed through the “Options” menu.

• Configure privacy settings: Under the “Privacy” tab, complete the following steps. These measures ensure that Firefox is storing only as much of your information as it needs to function normally.
  • Select “Use custom settings for history.”
  • Deselect “Remember my browsing and download history.”
  • Deselect “Remember search and form history.”
  • Deselect “Accept third-party cookies.”
  • Set cookie storage to “Keep until I close Firefox.”
  • Select “Clear history when Firefox closes.”
• Configure security settings: Under the “Security” tab, choose the following settings. These steps prevent Firefox from saving your passwords and keep you from visiting potentially harmful sites.
  • Verify that “Warn me when sites try to install add-ons,” “Block reported attack sites,” and “Block reported web forgeries” are all selected.
  • Deselect “Remember passwords for sites.”
• Disable javaScript: Deselect “Enable JavaScript” under the “Content” tab. JavaScript is notorious for containing security vulnerabilities and it is recommended that users only enable it for trusted sites.
• Enable pop-up blocking: Verify that “Block pop-up windows” is selected under the “Content” tab. This feature should be turned on by default as it protects users from unwarranted advertisements and windows.
• Don’t sync: Avoid using Firefox Sync. By doing so you prevent Firefox from storing your logins, passwords, and other sensitive information.
• Turn on automatic updates: Verify that “Automatically install updates” is selected in the “Update” tab under “Advanced.” Doing so will ensure that your browser receives critical security updates. Verify that “Automatically update Search Engines” is selected as well.
• Use secure protocols: Verify that “Use SSL 3.0” and “Use TLS 1.0” are selected in the “Encryption” tab under “Advanced.”

Tips for Secure Browsing with Microsoft Internet Explorer 10

These settings can be accessed through the “Internet Options” menu.

• Configure security settings: Under the “Security” tab, do the following:
  • Set security zones: IE offers the option to configure different security settings for different “zones,” including the Internet, local intranet, trusted sites, and restricted sites. Set up the zones for Intranet, Trusted Sites, and Restricted sites to your desired security level.
  • Set Internet zone security to “Medium High” or higher. This blocks certain cookie types, enables ActiveX filtering, and implements several other default settings for increased security.
  • Disable javaScript: Click “Custom Level,” locate the “Active Scripting” setting, and select “Disable.” It is recommended that users disable JavaScript because of the high amount of vulnerabilities it contains.
• Automatically clear history: Select “Delete browsing history on exit” under the “General” tab. Clearing your history at the end of each session helps to limit the amount of information IE saves when you browse.
• Configure privacy settings: Under the “Privacy” tab, complete the following steps:
  • Privacy setting: Set the Internet zone privacy to “Medium High” or higher. This blocks certain cookie types to prevent sites from tracking or contacting you without your consent.
  • Location: Select “Never allow websites to request your physical location.”
  • Pop-up Blocker: Double check that Pop-up Blocker is enabled.
• Configure Advanced Security settings: Scroll down to the “Security” section under the “Advanced” tab and do the following:
  • Ensure that all default settings are in place. If you aren’t sure, click “Restore advanced settings” before making any other changes.
  • Select “Do not save encrypted pages to disk.” This will delete files cached from HTTPS pages when the browser is closed.
  • Select “Empty Temporary Internet Files folder when browser is closed.” This prevents IE from storing your personal info (logins, passwords, activity, etc) beyond your browsing session.
  • Turn off autoComplete: The AutoComplete feature should be turned off for forms and usernames/passwords. Keeping AutoComplete turned off ensures that your sensitive information isn’t being stored unnecessarily.
• Tracking protection: IE’s Tracking Protection feature keeps your browsing private from specified third-party websites. This feature can be accessed through IE’s “Safety” menu. In order to use Tracking Protection you will need to provide a Tracking Protection List that names all of the sites you don’t want your information being sent to. You can create a list yourself or download lists online.

Which is the Most Secure Browser?

Nominating one browser as the most secure is difficult. Since each browser is regularly updated with security patches, the rankings for most secure browser could change at any time. As of today, Veracode recommends Google Chrome as the most secure browser.

Source: http://www.veracode.com/blog/2013/03/browser-security-settings-for-chrome-fire

BlackBerry software ruled not safe enough for essential government work

this article was published Tuesday 19 March 2013 18.13 GMT but removed from original source as well as Google cache, but keeps translated and here and in exported to pdf from evernote

CESG rejects BB10 software in new Z10 handset, dealing blow to Canadian firm in key market

The BB10 software in the new BlackBerry Z10 handset has been rejected as not secure enough for essential government work. Photograph: Mast Irham/EPA

BlackBerry's new BB10 software has been rejected by the British government as not secure enough for essential work, the Guardian can reveal.
The news is a blow to hopes that the new operating system, released on the Z10 handset in January, would spark a rapid revival in the company's fortunes after a torrid year of losses.
The previous BlackBerry version, 7.1, was cleared by the UK's Communications-Electronics Security Group (CESG) in December 2012 for classifications up to "Restricted" – two levels below "Secret".
But the Guardian understands that tests on BB10 and the BlackBerry Balance software, intended to separate work and personal accounts and prevent any copying of data between them, have shown that it fails the same security requirements. BlackBerry has confirmed that BB10 has not been passed yet by CESG, but could not offer a date when revised software would be submitted.
That is a blow because the Z10 and its upcoming keyboard-based version, the Q10, are high-priced devices intended to win back corporate customers who have begun to migrate to Apple's iPhone or to Android devices, or to replace older BlackBerry 7 phones. Nor has the company offered a clear date when it will fix the weakness.
Missing out on government business could cost BlackBerry millions in lost revenues, even if rivals are unable to fill the same security space: the government and NHS are two of its biggest clients in the UK, with tens of thousands of users.
Analyst reports also suggest that sales in the UK of the touchscreen Z10 handset, the first to run BB10, are slowing after an initial spurt among consumers when they went on sale in January, leaving sellers with surplus stock.
The Z10 goes on sale in the US on Friday, with the company seeking to rebuild its share of the smartphone market there, which has plummeted from a high of 22% in September 2010 with 21m users to just 5.9% and 7.6m users in January according to ComScore.
But James Faucette at the stockbrokers Pacific Crest, who has a "sell" rating on BlackBerry, said in a research note looking at sales in the UK and Canada that "sell-through run-rates for the Z10 have declined meaningfully in the weeks following launch. We believe carriers and third-party retailers in the UK are well above typically targeted inventory levels" and that retailers Carphone Warhouse and Phones4U have begun discounting the handsets. "We are concerned that … may ultimately push the Z10 downmarket" and hit profit margins, he told clients.
He added that he thinks Canadian stores and carriers are also approaching the same point
BlackBerry said in a statement: "We have a long-established relationship with CESG and we remain the only mobile solution approved for use at 'Restricted' when configured in accordance with CESG guidelines. This level of approval only comes following a process which is rigorous and absolutely necessary given the highly confidential nature of the communications being transmitted.
"The current restructuring of this approval process, due to the Government Protective Marking Scheme review and the new CESG Commercial Product Assurance scheme has an impact on the timeline for BlackBerry 10 to receive a similar level of approval. The US government's FIPS 140-2 certification of BlackBerry 10 and the selection of BlackBerry 10 by the German Procurement Office and Federal Office for Information Security underline how our new platform continues to set the standard for government communications.
"We are continuing to work closely with CESG on the approval of BlackBerry 10 and we're confident that BlackBerry 10 will only strengthen our position as the mobile solution of choice for the UK government."
• Canada's industry minister has declined to say whether he would block any attempted takeover of BlackBerry by the Chinese PC and smartphone maker Lenovo. Christian Paradis told Reuters "I hope BlackBerry will continue to be a Canadian champion in the world, that it grows organically." But, he added, "we don't know what might happen. The market is very aggressive. When you talk about the telecoms sector … this is a very, very aggressive sector."
Asked whether he would block a bid from Lenovo, mooted last week in an interview with that company, Paradis said "As the industry minister, I don't want to send a signal and I don't want it to look like I prejudged a deal or not."
The Canadian government could block the deal on national security grounds. Last year, the Chinese state-owned oil company CNOOC bought Canadian energy firm Nexen, but it provoked a storm. Analysts believe the US and UK governments might block a similar Chinese bid for BlackBerry because of its importance to secure email.
Updated: corrected expansion of CESG.

1-15 March 2013 Cyber Attacks Timeline

Other troubles for system administrators: March is confirming the 2013 dangerous trend with several high profile breaches against industrial, financial and governmental targets.

The first two weeks of March have begun with the breach to Evernote, and continued with (among the others) the third phase of the infamous Operation Ababil, targeting U.S. Banks and an alleged Chinese attack against the Reserve Bank of Australia.

Additional noticeable events include a wave of DDoS attacks against several Czech Republic’s targets (belonging to media, news and financial sector), a breach suffered by the NIST Vulnerability Database (unfortunately not an isolated example of the attacks against US governmental targets happened in these two weeks) and also the leak of 20,000 records from an Avast! German distributor.

Last but not least, the examined period has also confirmed the role of Twitter as the new mean to make resounding attacks against single individuals or organizations. Qatar Foundation, Saudi Aramco, and France 24 are only several of the organizations fallen victims of accounts hijacking.

Of course, these are only the main events, feel free to scroll down the list to analyze in detail what happened in these two weeks.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

Once again, a special thanks to Kim Guldberg AKA @bufferzone for continuously advising me about significant cyber events through the Submit Form! Much Appreciated!

 

1. http://hackread.com/qatar-foundations-twitter-and-facebook-accounts-hacked-by-syrian-electronic-army
2. https://twitter.com/th3inf1d3l/status/307658779904856064
3. http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
4. http://www.dailymail.co.uk/news/article-2287138/Public-schoolboy-hacker-masterminded-15m-fraud-jails-IT-class–hacks-prisons-system.html
5. http://news.softpedia.com/news/South-African-Ministry-of-State-Security-s-Twitter-Account-Hacked-334896.shtml
6. http://uk.reuters.com/article/2013/03/04/us-czech-hackers-idUKBRE92309D20130304
7. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
8. http://techcrunch.com/2013/03/08/hacker-steals-12000-worth-of-bitcoins-in-brazen-dns-based-attack/
9. http://hackread.com/bangladeshi-supreme-court-ministry-of-agriculture-websites-breached-against-violence-user-accounts-leaked-by-phr0zenmyst/
10. http://news.softpedia.com/news/Website-of-AngloAmerican-Mining-Company-Hacked-By-Anonymous-for-OpGreenRights-335092.shtml
11. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
12. http://thehackernews.com/2013/03/pakistan-intelligence-agency-hacked-by.html
13. http://hackread.com/france-24-arabia-and-france-24-observers-twitter-accounts-hacked-by-syrian-electronic-army/
14. http://www.zdnet.com/raspberry-pi-site-suffers-ddos-attack-7000012251/
15. http://hilf-ol-fozoul.blogspot.com/2013/03/the-bank-of-america-has-been-out-of.html
16. http://hilf-ol-fozoul.blogspot.com/2013/03/the-fifth-third-bank-also-have-gotten.html
17. http://uk.reuters.com/article/2013/03/06/czech-hackers-banks-idUKL6N0BY52420130306
18. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
19. http://nakedsecurity.sophos.com/2013/03/06/saudi-aramco-saudi-arabias-national-oil-company-has-had-its-twitter-hacked/
20. http://www.cyberwarnews.info/2013/03/06/time-warner-cable-support-service-hacked-and-defaced-by-nullcrew/
21. http://hackread.com/soneri-banks-online-banking-system-website-hacked-by-pakbugs/
22. http://hilf-ol-fozoul.blogspot.com/2013/03/the-hsbc-and-us-bank-have-defeated.html
23. http://hilf-ol-fozoul.blogspot.com/2013/03/the-hsbc-and-us-bank-have-defeated.html
24. http://hilf-ol-fozoul.blogspot.com/2013/03/the-fifth-third-bank-and-pnc-are-next.html
25. http://hilf-ol-fozoul.blogspot.com/2013/03/the-fifth-third-bank-and-pnc-are-next.html
26. http://sg.news.yahoo.com/hackers-assault-czech-mobile-operators-005419745.html
27. http://www.lupa.cz/clanky/ddos-pokracuje-cilem-jsou-dnes-weby-mobilnich-operatoru/
28. http://news.softpedia.com/news/German-Studio-Constantin-Film-Hacked-in-Protest-Against-Anti-Piracy-Group-335462.shtml
29. http://hackread.com/avast-germany-website-hacked-defaced-20000-user-accounts-leaked-by-maxney/
30. http://www.illsecure.com/2013/03/us-government-state-websites-hacked-in.html
31. http://www.ehackingnews.com/2013/03/hackers-infect-pentagon-admin-by.html
32. http://www.afr.com/p/national/cyber_attackers_penetrate_reserve_FEdCLOI50owRMgI0urEYnK
33. http://arstechnica.com/security/2013/03/dating-site-zoosk-resets-some-user-accounts-following-password-dump/
34. http://gawker.com/5989904/either-colin-powells-facebook-was-hacked-or-he-has-had-a-sudden-change-of-heart-about-george-w-bush
35. http://thehackernews.com/2013/03/pakistan-government-servers-messed-up.html
36. http://news.softpedia.com/news/Indian-Hacker-Leaks-Admin-Passwords-for-35-Pakistani-Government-Sites-336734.shtml
37. http://hackread.com/serbian-students-hack-billboard-display-advert-in-piratebays-support-video-included
38. http://anon-news.blogspot.in/2013/03/firma-la-petizione-per-chiudere.html
39. http://hilf-ol-fozoul.blogspot.com/2013/03/bbt-and-chase-bank-are-first-targets-of.html
40. http://nakedsecurity.sophos.com/2013/03/14/bill-gates-personal-info/
41. http://nakedsecurity.sophos.com/2013/03/12/celebrity-hack-social-security/
42. http://www.bloomberg.com/news/2013-03-12/equifax-transunion-say-hackers-stole-celebrity-reports.html
43. http://community.websense.com/blogs/securitylabs/archive/2013/03/12/israeli-website-for-international-institute-for-counter-terrorism-waterhole-serving-cve-2012-4969.aspx
44. https://plus.google.com/u/0/106350285372295328202/posts/HNayDzUoYEz
45. http://hilf-ol-fozoul.blogspot.com/2013/03/today-attacks-of-qassam-group-shocked.html
46. http://hilf-ol-fozoul.blogspot.com/2013/03/the-us-bank-has-gotten-out-of-reach.html
47. http://hilf-ol-fozoul.blogspot.com/2013/03/the-chase-bank-has-targeted-against.html
48. http://www.ehackingnews.com/2013/03/al-qaeda-electronic-army-hack-us-government.html
49. http://www.mediabistro.com/fishbowldc/national-journal-gets-hacked_b98192
50. http://thehackernews.com/2013/03/philippines-presidents-website-defaced.html
51. http://hackread.com/indian-defence-organisation-drdo-servers-hacked-china-among-the-suspects/
52. http://hilf-ol-fozoul.blogspot.com/2013/03/chase-pnc-bbt-qassam-groups-today-goals.html
53. http://news.yahoo.com/nkorea-accuses-us-skorea-cyberattacks-074913828–finance.html
54. http://news.yahoo.com/polish-presidents-computer-network-attacked-hackers-181856391.html
55. http://www.wbj.pl/article-62178-top-polish-government-systems-hacked-again.html
56. http://www.ehackingnews.com/2013/03/opblacksummer-two-us-petroleum-websites.html
57. http://www.cyberwarnews.info/2013/03/14/14000-student-credentials-leaked-from-ktu-career-center-lithuania/
58. http://www.theregister.co.uk/2013/03/15/cctv_hack_casino_poker/
59. http://news.softpedia.com/news/OpIran-Hacktivists-Launch-DDOS-Attacks-Against-Major-Iranian-Sites-337585.shtml
60. http://hackread.com/german-broadcaster-deutsche-welles-dw-twitter-account-hacked-by-syrian-electronic-army/
61. http://anon-news.blogspot.in/2013/03/forza-nuova-lealta-azione-fiamma.html

Jobs compilations

Attacking XML Security

Message Oriented Madness, XML Worms and Web Service Security Sanity

Attacking XML Security from yusufmotiwala

Security Vulnerability Notice SE-2012-01-PUBLIC [Security vulnerabilities in Java SE, Issue 54]

Security Explorations decided to release technical details of Issue 54 that was reported to Oracle on Feb 25, 2013 and that was evaluated by the company as the "allowed behavior" [1].

As of Mar 18, 2013 no information was received from Oracle that would indicate that Issue 54 is treated by the company as a security vulnerability.

Security Explorations believes that 3 weeks (from Feb 25 to Mar 18) constitutes enough time for a major software vendor to deliver a final confirmation or denial of a reported issue. This especially concerns a vendor that has been a subject of a considerable criticism regarding competent and prompt handling of security vulnerabilities in its software.

Security Explorations decided to release technical details of Issue 54 that was reported to Oracle on Feb 25, 2013 and that was evaluated by the company as the "allowed behavior" [1].

As of Mar 18, 2013 no information was received from Oracle that would indicate that Issue 54 is treated by the company as a security vulnerability.

Security Explorations believes that 3 weeks (from Feb 25 to Mar 18) constitutes enough time for a major software vendor to deliver a final confirmation or denial of a reported issue. This especially concerns a vendor that has been a subject of a considerable criticism regarding competent and prompt handling of security vulnerabilities in its software.

Security Explorations is publishing the following material in a hope that a wider public could conduct an independent evaluation of Issue 54 and deliver an unbiased judgment of both companies claims:

• Short write-up presenting vulnerability details, its impact and a summary of vendor's response, PDF file, 300KB (download)
• Proof of Concept code for Issue 54, ZIP file, 15KB (download)

se-2012-01-54 by Yury Chemerkin

You Only Click Twice: FinFisher’s Global Proliferation

This post describes the results of a comprehensive global Internet scan for the command and control servers of FinFisher’s surveillance software. It also details the discovery of a campaign using FinFisher in Ethiopia used to target individuals linked to an opposition group. Additionally, it provides examination of a FinSpy Mobile sample found in the wild, which appears to have been used in Vietnam.

Summary of Key Findings

• We have found command and control servers for FinSpy backdoors, part of Gamma International’s FinFisher “remote monitoring solution,” in a total of 25 countries: Australia, Bahrain, Bangladesh, Brunei, Canada, Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, United Arab Emirates, United Kingdom, United States, Vietnam.

• A FinSpy campaign in Ethiopia uses pictures of Ginbot 7, an Ethiopian opposition group, as bait to infect users. This continues the theme of FinSpy deployments with strong indications of politically-motivated targeting.

• There is strong evidence of a Vietnamese FinSpy Mobile Campaign. We found an Android FinSpy Mobile sample in the wild with a command & control server in Vietnam that also exfiltrates text messages to a local phone number.

• These findings call into question claims by Gamma International that previously reported servers were not part of their product line, and that previously discovered copies of their software were either stolen or demo copies.

1. Background and Introduction

FinFisher is a line of remote intrusion and surveillance software developed by Munich-based Gamma International GmbH. FinFisher products are marketed and sold exclusively to law enforcement and intelligence agencies by the UK-based Gamma Group.¹ Although touted as a “lawful interception” suite for monitoring criminals, FinFisher has gained notoriety because it has been used in targeted attacks against human rights campaigners and opposition activists in countries with questionable human rights records.²
In late July 2012, we published the results of an investigation into a suspicious e-mail campaign targeting Bahraini activists.³ We analyzed the attachments and discovered that they contained the FinSpy spyware, FinFisher’s remote monitoring product. FinSpy captures information from an infected computer, such as passwords and Skype calls, and sends the information to a FinSpy command & control (C2) server. The attachments we analyzed sent data to a command & control server inside Bahrain.
This discovery motivated researchers to search for other command & control servers to understand how widely FinFisher might be used. Claudio Guarnieri at Rapid7 (one of the authors of this report) was the first to search for these servers. He fingerprinted the Bahrain server and looked at historical Internet scanning data to identify other servers around the world that responded to the same fingerprint. Rapid7 published this list of servers, and described their fingerprinting technique. Other groups, including CrowdStrike andSpiderLabs also analyzed and published reports on FinSpy.
Immediately after publication, the servers were apparently updated to evade detection by the Rapid7 fingerprint. We devised a different fingerprinting technique and scanned portions of the internet. We confirmed Rapid7’s results, and also found several new servers, including one inside Turkmenistan’s Ministry of Communications. We published our list of servers in late August 2012, in addition to an analysis of mobile phone versions of FinSpy. FinSpy servers were apparently updated again in October 2012 to disable this newer fingerprinting technique, although it was never publicly described.
Nevertheless, via analysis of existing samples and observation of command & control servers, we managed to enumerate yet more fingerprinting methods and continue our survey of the internet for this surveillance software. We describe the results in this post.
Civil society groups have found cause for concern in these findings, as they indicate the use of FinFisher products by countries like Turkmenistan and Bahrain with problematic records on human rights, transparency, and rule of law. In an August 2012 response to a letter from UK-based NGO Privacy International, the UK Government revealed that at some unspecified time in the past, it had examined a version of FinSpy, and communicated to Gamma that a license would be required to export that version outside of the EU. Gamma has repeatedly denied links to spyware and servers uncovered by our research, claiming that the servers detected by our scans are “not … from the FinFisher product line.”⁴ Gamma also claims that the spyware sent to activists in Bahrain was an “old” demonstration version of FinSpy, stolen during a product presentation.
In February 2013, Privacy International, the European Centre for Constitutional and Human Rights (ECCHR), the Bahrain Center for Human Rights, Bahrain Watch, and Reporters Without Borders filed a complaint with the Organization for Economic Cooperation and Development (OECD), requesting that this body investigate whether Gamma violated OECD Guidelines for Multinational Enterprises by exporting FinSpy to Bahrain. The complaint called previous Gamma statements into question, noting that at least two different versions (4.00 and 4.01) of FinSpy were found in Bahrain, and that Bahrain’s server was a FinFisher product and was likely receiving updates from Gamma. This complaint, as laid out by Privacy International states that Gamma:

• failed to respect the internationally recognised human rights of those affected by [its] activities
• caused and contributed to adverse human rights impacts in the course of [its] business activities
• failed to prevent and mitigate adverse human rights impacts linked to [its] activities and products, and failed to address such impacts where they have occurred
• failed to carry out adequate due diligence (including human rights due diligence); and
• failed to implement a policy commitment to respect human rights.

According to recent reporting, German Federal Police appear to have plans to purchase and use the FinFisher suite of tools domestically within Germany.⁵ Meanwhile, findings by our group and others continue to illustrate the global proliferation of FinFisher’s products. Research continues to uncover troubling cases of FinSpy in countries with dismal human rights track records, and politically repressive regimes. Most recently, work by Bahrain Watch has confirmed the presence of a Bahraini FinFisher campaign, and further contradicted Gamma’s public statements. This post adds to the list by providing an updated list of FinSpy Command & Control servers, and describing the FinSpy malware samples in the wild which appear to have been used to target victims in Ethiopia and Vietnam.
We present these updated findings in the hopes that we will further encourage civil society groups and competent investigative bodies to continue their scrutiny of Gamma’s activities, relevant export control issues, and the issue of the global and unregulated proliferation of surveillance malware.

2. FinFisher: Updated Global Scan

(click image to enlarge)

Figure 1. Map of global FinFisher proliferation
Around October 2012, we observed that the behavior of FinSpy servers began to change. Servers stopped responding to our fingerprint, which had exploited a quirk in the distinctive FinSpy wire protocol. We believe that this indicates that Gamma either independently changed the FinSpy protocol, or was able to determine key elements of our fingerprint, although it has never been publicly revealed.
In the wake of this apparent update to FinSpy command & control servers, we devised a new fingerprint and conducted a scan of the internet for FinSpy command & control servers. This scan took roughly two months and involved sending more than 12 billion packets. Our new scan identified a total of 36 FinSpy servers, 30 of which were new and 6 of which we had found during previous scanning. The servers operated in 19 different countries. Among the FinSpy servers we found, 7 were in countries we hadn’t seen before.

New Countries
Canada, Bangladesh, India, Malaysia, Mexico, Serbia, Vietnam

In our most recent scan, 16 servers that we had previously found did not show up. We suspect that after our earlier scans were published the operators moved them. Many of these servers were shut down or relocated after the publication of previous results, but before the apparent October 2012 update. We no longer found FinSpy servers in 4 countries where previous scanning identified them (Brunei, UAE, Latvia, and Mongolia). Taken together, FinSpy servers are currently, or have been present, in 25 countries.

Australia, Bahrain, Bangladesh, Brunei, Canada, Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, United Arab Emirates, United Kingdom, United States, Vietnam.

Importantly, we believe that our list of servers is incomplete due to the large diversity of ports used by FinSpy servers, as well as other efforts at concealment. Moreover, discovery of a FinSpy command and control server in a given country is not a sufficient indicator to conclude the use of FinFisher by that country’s law enforcement or intelligence agencies. In some cases, servers were found running on facilities provided by commercial hosting providers that could have been purchased by actors from any country.
The table below shows the FinSpy servers detected in our latest scan. We list the full IP address of servers that have been previously publicly revealed. For active servers that have not been publicly revealed, we list the first two octets only. Releasing complete IP addresses in the past has not proved useful, as the servers are quickly shut down and relocated.*

IP	Operator	Routed to Country
117.121.xxx.xxx	GPLHost	Australia
77.69.181.162	Batelco ADSL Service	Bahrain
180.211.xxx.xxx	Telegraph & Telephone Board	Bangladesh
168.144.xxx.xxx	Softcom, Inc.	Canada
168.144.xxx.xxx	Softcom, Inc.	Canada
217.16.xxx.xxx	PIPNI VPS	Czech Republic
217.146.xxx.xxx	Zone Media UVS/Nodes	Estonia
213.55.99.74	Ethio Telecom	Ethiopia
80.156.xxx.xxx	Gamma International GmbH	Germany
37.200.xxx.xxx	JiffyBox Servers	Germany
178.77.xxx.xxx	HostEurope GmbH	Germany
119.18.xxx.xxx	HostGator	India
119.18.xxx.xxx	HostGator	India
118.97.xxx.xxx	PT Telkom	Indonesia
118.97.xxx.xxx	PT Telkom	Indonesia
103.28.xxx.xxx	PT Matrixnet Global	Indonesia
112.78.143.34	Biznet ISP	Indonesia
112.78.143.26	Biznet ISP	Indonesia
117.121.xxx.xxx	GPLHost	Malaysia
187.188.xxx.xxx	Iusacell PCS	Mexico
201.122.xxx.xxx	UniNet	Mexico
164.138.xxx.xxx	Tilaa	Netherlands
164.138.28.2	Tilaa	Netherlands
78.100.57.165	Qtel – Government Relations	Qatar
195.178.xxx.xxx	Tri.d.o.o / Telekom Srbija	Serbia
117.121.xxx.xxx	GPLHost	Singapore
217.174.229.82	Ministry of Communications	Turkmenistan
72.22.xxx.xxx	iPower, Inc.	United States
166.143.xxx.xxx	Verizon Wireless	United States
117.121.xxx.xxx	GPLHost	United States
117.121.xxx.xxx	GPLHost	United States
117.121.xxx.xxx	GPLHost	United States
117.121.xxx.xxx	GPLHost	United States
183.91.xxx.xxx	CMC Telecom Infrastructure Company	Vietnam

Several of these findings are especially noteworthy:

• Eight servers are hosted by provider GPLHost in various countries (Singapore, Malaysia, Australia, US). However, we observed only six of these servers active at any given time, suggesting that some IP addresses may have changed during our scans.
• A server identified in Germany has the registrant “Gamma International GmbH,” and the contact person is listed as “Martin Muench.”
• There is a FinSpy server in an IP range registered to “Verizon Wireless.” Verizon Wireless sells ranges of IP addresses to corporate customers, so this is not necessarily an indication that Verizon Wireless itself is operating the server, or that Verizon Wireless customers are being spied on.
• A server in Qatar that was previously detected by Rapid7 seems to be back online after being unresponsive during the last round of our scanning. The server is located in a range of 16 addresses registered to “Qtel – Corporate accounts – Government Relations.” The same block of 16 addresses also contains the websitehttp://qhotels.gov.qa/.

3. Ethiopia and Vietnam: In-depth Discussion of New Samples

3.1 FinSpy in Ethiopia

We analyzed a recently acquired malware sample and identified it as FinSpy. The malware uses images of members of the Ethiopian opposition group,  Ginbot 7, as bait. The malware communicates with a FinSpy Command & Control server in Ethiopia, which was first identified by Rapid7 in August 2012. The server has been detected in every round of scanning, and remains operational at the time of this writing. It can be found in the following address block run by Ethio Telecom, Ethiopia’s state-owned telecommunications provider:

IP: 213.55.99.74
route: 213.55.99.0/24
descr: Ethio Telecom
origin: AS24757
mnt-by: ETC-MNT
member-of: rs-ethiotelecom
source: RIPE # Filtered

The server appears to be updated in a manner consistent with other servers, including servers in Bahrain and Turkmenistan.

MD5	8ae2febe04102450fdbc26a38037c82b
SHA-1	1fd0a268086f8d13c6a3262d41cce13470886b09
SHA-256	ff6f0bcdb02a9a1c10da14a0844ed6ec6a68c13c04b4c122afc559d606762fa

The sample is similar to a previously analyzed sample of FinSpy malware sent to activists in Bahrain in 2012. Just like Bahraini samples, the malware relocates itself and drops a JPG image with the same filename as the sample when executed by an unsuspecting user. This appears to be an attempt to trick the victim into believing the opened file is not malicious. Here are a few key similarities between the samples:

• The PE timestamp “2011-07-05 08:25:31” of the packer is exactly the same as the Bahraini sample.
• The following string (found in a process infected with the malware), self-identifies the malware and is similar to strings found in the Bahraini samples:
  
• The samples share the same Bootkit, SHA-256: ba21e452ee5ff3478f21b293a134b30ebf6b7f4ec03f8c8153202a740d7978b2.
• The samples share the same driverw.sys file, SHA-256: 62bde3bac3782d36f9f2e56db097a4672e70463e11971fad5de060b191efb196.

Figure 2. The image shown to the victim contains pictures of members of the Ginbot 7 Ethiopian opposition group
In this case the picture contains photos of members of the Ethiopian opposition group,  Ginbot 7. Controversially, Ginbot 7 was designated a terrorist group by the Ethiopian Government in 2011. The Committee to Protect Journalists (CPJ) and Human Rights Watch have both criticized this action, CPJ has pointed out that it is having a chilling effect on legitimate political reporting about the group and its leadership.
The existence of a FinSpy sample that contains Ethiopia-specific imagery, and that communicates with a still-active command & control server in Ethiopia strongly suggests that the Ethiopian Government is using FinSpy.

3.2 FinSpy Mobile in Vietnam

We recently obtained and analyzed a malware sample⁶ and identified it as FinSpy Mobile for Android. The sample communicates with a command & control server in Vietnam, and exfiltrates text messages to a Vietnamese telephone number.
The FinFisher suite includes mobile phone versions of FinSpy for all major platforms including iOS, Android, Windows Mobile, Symbian and Blackberry. Its features are broadly similar to the PC version of FinSpy identified in Bahrain, but it also contains mobile-specific features such as GPS tracking and functionality for silent ‘spy’ calls to snoop on conversations near the phone. An in-depth analysis of the FinSpy Mobile suite of backdoors was provided in an earlier blog post: The Smartphone Who Loved Me: FinFisher Goes Mobile?

MD5	573ef0b7ff1dab2c3f785ee46c51a54f
SHA-1	d58d4f6ad3235610bafba677b762f3872b0f67cb
SHA-256	363172a2f2b228c7b00b614178e4ffa00a3a124200ceef4e6d7edb25a4696345

The sample included a configuration file⁷ that indicates available functionality, and the options that have been enabled by those deploying it:

Figure 3. Image of a section of a configuration file for the FinSpy Mobile sample
Interestingly, the configuration file also specifies a Vietnamese phone number used for SMS based command and control:

Section Type: TlvTypeConfigSMSPhoneNumber
Section Data: “+841257725403″

The command and control server is in a range provided by the CMC Telecom Infrastructure Company in Hanoi:

IP Address: 183.91.2.199
inetnum: 183.91.0.0 – 183.91.9.255
netname: FTTX-NET
country: Vietnam
address: CMC Telecom Infrastructure Company
address: Tang 3, 16 Lieu Giai str, Ba Dinh, Ha Noi

This server was active until very recently and matched our signatures for a FinSpy command and control server. Both the command & control server IP and the phone number used for text-message exfiltration are in Vietnam which indicates a domestic campaign.
This apparent FinSpy deployment in Vietnam is troubling in the context of recent threats against online free expression and activism. In 2012, Vietnam introduced new censorship laws amidst an ongoing harassment, intimidation, and detention campaign against of bloggers who spoke out against the regime. This culminated in the trial of 17 bloggers, 14 of whom were recently convicted and sentenced to terms ranging from 3 to 13 years.⁸

4. Brief Discussion of Findings

Companies selling surveillance and intrusion software commonly claim that their tools are only used to track criminals and terrorists. FinFisher, VUPEN and Hacking Team have all used similar language.⁹ Yet a growing body of evidence suggests that these tools are regularly obtained by countries where dissenting political activity and speech is criminalized. Our findings highlight the increasing dissonance between Gamma’s public claims that FinSpy is used exclusively to track “bad guys” and the growing body of evidence suggesting that the tool has and continues to be used against opposition groups and human rights activists.

While our work highlights the human rights ramifications of the mis-use of this technology, it is clear that there are broader concerns.  A global and unregulated market for offensive digital tools potentially presents a novel risk to both national and corporate cyber-security. On March 12th, US Director of National Intelligence James Clapper stated in his yearly congressional report on security threats:

“…companies develop and sell professional-quality technologies to support cyberoperations–often branding these tools as lawful-intercept or defensive security research products. Foreign governments already use some of these tools to target U.S. systems.”

The unchecked global proliferation of products like FinFisher makes a strong case for policy debate about surveillance software and the commercialization of offensive cyber-capabilities.
Our latest findings give an updated look at the global proliferation of FinSpy. We identified 36 active FinSpy command & control servers, including 30 previously-unknown servers. Our list of servers is likely incomplete, as some FinSpy servers employ countermeasures to prevent detection. Including servers discovered last year, we now count FinSpy servers in 25 countries, including countries with troubling human rights records. This is indicative of a global trend towards the acquisition of offensive cyber-capabilities by non-democratic regimes from commercial Western companies.
The Vietnamese and Ethiopian FinSpy samples we identified warrant further investigation, especially given the poor human rights records of these countries. The fact that the Ethiopian version of FinSpy uses images of opposition members as bait suggests it may be used for politically influenced surveillance activities, rather than strictly law enforcement purposes.
The Ethiopian sample is the second FinSpy sample we have discovered that communicates with a server we identified by scanning as a FinSpy command & control server. This further validates our scanning results, and calls into question Gamma’s claim that such servers are “not … from the FinFisher product line.”¹⁰ Similarities between the Ethiopian sample and those used to target Bahraini activists also bring into question Gamma International’s earlier claims that the Bahrain samples were stolen demonstration copies.
While the sale of such intrusion and surveillance software is largely unregulated, the issue has drawn increased high-level scrutiny. In September of last year, the German foreign minister, Guido Westerwelle, called for an EU-wide ban on the export of such surveillance software to totalitarian states.¹¹ In a December 2012 interview, Marietje Schaake (MEP), currently the rapporteur for the first EU strategy on digital freedom in foreign policy, stated that it was “quite shocking” that Europe companies continue to export repressive technologies to countries where the rule of law is in question.¹²
We urge civil society groups and journalists to follow up on our findings within affected countries. We also hope that our findings will provide valuable information to the ongoing technology and policy debate about surveillance software and the commercialisation of offensive cyber-capabilities.
Corrections (15 March 2013):
* The table of FinFisher server IP addresses has been revised since the original publication. Due to an issue during formatting, Ethio Telecom was incorrectly identified as being in Estonia rather than in Ethiopia and Iusacell PCS was incorrectly identified as being in Malaysia rather than in Mexico. The IP range 117.121.xxx.xxx corresponds with GPLHost, which is located in Malaysia.  Iusacell PCS corresponds with 187.188.xxx.xxx and is located in Mexico.

Acknowledgements

We’d like to thank Eva Galperin and the Electronic Frontier Foundation (EFF), Privacy International, Bahrain Watch, and Drew Hintz.

Media Coverage

Media coverage of the report includes HuffingtonPost Canada, Salon, The Verge,Bloomberg Business Week, TheYoungTurks.

Footnotes

¹https://www.gammagroup.com/
²Software Meant to Fight Crime Is Used to Spy on Dissidents, http://goo.gl/GDRMe, New York Times, August 31, 2012, Page A1 Print edition.
³Cyber Attacks on Activists Traced to FinFisher Spyware of Gamma, http://goo.gl/nJH7o, Bloomberg, July 25, 2012
⁴http://bits.blogs.nytimes.com/2012/08/16/company-denies-role-in-recently-uncovered-spyware/
⁵http://www.sueddeutsche.de/digital/finfisher-entwickler-gamma-spam-vom-staat-1.1595253
⁶This sample has also been discussed by Denis Maslennikov from Kasperksy in his analyses of FinSpy Mobile –https://www.securelist.com/en/analysis/204792283/Mobile_Malware_Evolution_Part_6
⁷Configuration parsed with a tool written by Josh Grunzweig of Spider Labs –http://blog.spiderlabs.com/2012/09/finspy-mobile-configuration-and-insight.html
⁸https://www.eff.org/deeplinks/2013/01/bloggers-trial-vietnam-are-part-ongoing-crackdown-free-expression
⁹https://www.securityweek.com/podcast-vupen-ceo-chaouki-bekrar-addresses-zero-day-marketplace-controversy-cansecwest
¹⁰http://bits.blogs.nytimes.com/2012/08/16/company-denies-role-in-recently-uncovered-spyware/
¹¹http://www.guardian.co.uk/uk/2012/nov/28/offshore-company-directors-military-intelligence
¹²http://www.vieuws.eu/foreign-affairs/digital-freedoms-marietje-schaake-mep-alde/