ESET’s guide makes it possible to peek into FinFisher 0 819

FinFisher, also known as FinSpy, has a history of being used in surveillance campaigns, both against legitimate targets and against political opposition in countries with oppressive regimes. Despite that, the latest thorough analyses dealt with samples from as long ago as 2010. Since then, the FinFisher spyware received strong anti-analysis measures; apparently, this is also the reason why the more recent reports about FinFisher don’t go into much technical detail. In one of the reports, a reputable security company even admitted that due to strong obfuscation, it was not possible to extract the C&C servers.

Having discovered a wave of surveillance campaigns in several countries in summer 2017, ESET researchers dug deep into the samples of FinFisher. To be able to start a thorough analysis of how these recent samples work, they first had to break through all FinFisher’s protective layers.

To help malware analysts and security researchers overcome FinFisher’s advanced anti-disassembly obfuscation and virtualization features, ESET researchers have framed some clever tricks into a whitepaper, “ESET’s guide to deobfuscating and devirtualizing FinFisher”.

“The company behind FinFisher has built a multimillion-dollar business around this spyware – so it comes as no surprise that they put a much bigger effort into hiding and obfuscation than most common cybercriminals. Our aim is to help our peers analyze FinFisher and thus protect internet users from this threat,” comments Filip Kafka, ESET malware analyst who leads the analysis of FinFisher.

Filip Kafka expects the FinFisher creators to improve their protections to make FinFisher hard to analyze again. “With their huge resources, there is no doubt FinFisher will receive even better anti-analysis features. However, I expect their additional measures to cost more to implement while being easier to crack for us the next time around,” comments Filip Kafka.

ESET’s analysis into FinFisher is ongoing. In the first stage, ESET researchers focused on the infection vector used in the mentioned campaigns. They strongly believe internet service providers have played the key role in infecting the victims with FinFisher. Filip Kafka’s presentations of these findings along with a brief overview of FinFisher’s anti-analysis capabilities raised a lot of interest at the Virus Bulletin Conference as well as the AVAR conference.

Previous ArticleNext Article

Flaws in email encryption revealed 0 478

email encryption

A team of 8 academics have discovered weaknesses in OpenPGP and S/MIME encryption protocols which could lead to the plain text of encrypted emails being exposed to attackers. The academics have named these flaws “EFAIL”.

Insights from cryptography expert Bruce Schneier explained that “[t]he vulnerability isn’t with PGP or S/MIME itself, but in the way they interact with modern e-mail programs.”

To be able exploit the weaknesses, you would first need to access the end-to-end-encrypted email message. This could be by way of stealing it from a compromised account or by intercepting its path. Following this, the attacker would need to alter the email, adding a custom HTML code and then sending this new version onto the victim. The victim’s email client decrypts the email and is tricked by the malicious code into sending the full plaintext of the emails to the attackers. Even messages sent years ago are vulnerable.

The team said that their proof-of-concept exploit has been shown to be successful against 25 out of 35 tested S/MIME email clients and 10 out of 28 OpenPGP clients. The flaws affect email applications such as Apple Mail with the GPGTools encryption plug-in, Mozilla Thunderbird with the Enigmail plug-in, and Outlook with the Gpg4win encryption package. The academics said that, in keeping with the principles of responsible disclosure, they have reported their findings to all email providers concerned.

Time to change your Twitter password 0 623

Twitter Password

An internal bug exposed the passwords of an undisclosed number of the more than 330 million Twitter users.

Twitter CTO Parag Agrawal announced that it was a “bug that stored passwords unmasked in an internal log”. He went on to state “we have fixed the bug and our investigation shows no indication of breach or misuse”.

The Social Media platform are insisting that there is no sign of danger and that there is no reason to believe that the passwords were exposed outside of the organisation. However, they are still advising users to change their Twitter passwords and those of any other online service using the same password.

Some additional password tips from Twitter include enabling two-factor authentication and also using a password manager to create a strong and unique password for every individual online service.