NewsSeptember 25, 2017 @ 3:00 PM

ISPs May Be Colluding With FinFisher Surveillance, According to Researchers

New campaigns featuring FinFisher are underway with new infection enablers: internet service providers (ISPs), researchers at ESET warned. FinFisher, sometimes called FinSpy, is a well-known spyware program that has been used by nation-states to spy on citizens.

Spying Automatically via ISPs

FinFisher is a tool specifically designed to have the stealthy spy capabilities that George Orwell might understand. According to ESET’s blog, We Live Security, the spyware can perform live subject surveillance through the use of a computer’s webcam and microphone, keylogging of typed input and exfiltration of files. While FinFisher has been marketed as a way for authorities to monitor the bad guys, certain regimes have used it to gather information about people of interest to them.

ESET said that its security experts found FinFisher variants present in seven countries. It did not say in which countries they were found, however.

Along with this, the researchers were alarmed to see that a previously undetected method was used for infection in two of these countries: a man-in-the-middle (MitM) attack that involved ISPs. If a specific user requests certain apps — typically WhatsApp, Skype, Avast, WinRAR and VLC Player — the link request is replaced with an HTTP 307 Temporary Redirect status response code.

Replacing the normal link with a malicious one is something that would be relatively simple for an ISP to do if it was given a list of targets by authorities. The use of an HTTP 307 call is also invisible to the user, making it difficult to detect.

Suspicious Similarities

SecurityWeek recalled that leaked documents regarding Finfisher’s initial purveyor, Gamma Group, showed the existence of a tool called FinFly ISP that was designed for deployment on ISP networks. This tool had the ability to perform these kinds of MitM attacks.

ESET further noted that all of the affected targets in this campaign that were within a particular country were found to use the same ISP. Not only that, but the same redirection method and format had been previously used by other ISPs to modify internet content in at least one of the countries involved in this attack.

Using ISPs to infect and spy on users has never been revealed until now. These kinds of campaigns would represent what ESET called a “sophisticated and stealthy surveillance project unprecedented in its combination of methods and reach.”

Share this Article:
Larry Loeb

Principal, PBC Enterprises

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He wrote for IBM's DeveloperWorks site for seven years and has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange.