Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/21/2014
04:25 PM
50%
50%

Privacy Groups Release 'Detekt' Tool to Spot Spyware

Privacy advocates have joined together to release a tool for identifying cyber espionage malware.

Privacy advocates jointly announced the release of a free malware detection tool meant to help human rights activists, journalists, and others thwart surveillance malware.

The tool, known as Detekt, was developed by Claudio Guarnieri. It was released Thursday in partnership with Amnesty International, Digitale Gesellschaft, Privacy International, and the Electronic Frontier Foundation. Detekt works by scanning computers for predefined patterns that have been linked to remote access Trojans such as DarkComet, FinFisher (FinSpy), njRAT, and Gh0st RAT.

Though some of those tools have been used by cybercriminals, others, such as FinFisher and Hacking Team's Remote Control System (RCS) tool, have been linked to various cyber espionage campaigns by governments.

"Recent years have seen a boom in the adoption of surveillance technology by governments around the world, including spyware that provides its purchasers the unchecked ability to target remote Internet users' computers, to read their personal emails, listen in on private audio calls, record keystrokes and passwords, and remotely activate their computer's camera or microphone," blogs Eva Galperin, global policy analyst at the Electronic Frontier Foundation (EFF). "EFF, together with Amnesty International, Digitale Gesellschaft, and Privacy International have all had experience assisting journalists and activists who have faced the illegitimate use of such software in defiance of accepted international human rights law."

That, she writes, is why the EFF got behind Detekt.

"Some of the software used by states against innocent citizens is widely available on the Internet, while more sophisticated alternatives are made and sold by private companies and sold to governments everywhere from the United States and Europe to Ethiopia and Vietnam," she writes. "Detekt makes it easy for at-risk users to check their PCs for possible infection by this spyware, which often goes undetected by existing commercial anti-virus products."

Detekt is a Python tool that relies on Yara, Volatility, and Winpmem to scan the memory of a running Windows system. It currently supports Windows XP to Windows 8, both 32- and 64-bit, and Windows 8.1 32-bit.

"Because Detekt is a best-effort tool and spyware companies make frequent changes to their software to avoid detection, users should keep in mind that Detekt cannot conclusively guarantee that your computer is not compromised by the spyware it aims to detect," writes Galperin. "However, we hope that the availability of this tool will help us to detect some ongoing infections, provide advice to infected users, and contribute to the debate around curbing the use of government spyware in countries where it is linked to human rights abuses."

Before launching the tool, users should close all applications and make sure the computer is disconnected from the Internet. If spyware is detected, users are advised not to reconnect the computer to the Internet until the machine has been cleaned.

Michael Sutton, vice president of security research for Zscaler, says that in today's world, spyware is not only used by cyber criminals.

"For those concerned that they may be the target of such surveillance, it offers another tool to assist in determining if their PC has been infected," says Sutton. "It will, however, suffer from the same limitations as antivirus products in that it is signature-based and must therefore try and identify known patterns in previously observed binaries. Given that the goal of those leveraging the spyware in the first place is to remain undetected, there's little doubt that they will adapt and start to develop spyware variants specifically not identified by Detekt. For those seeking absolute assurance that they are not under surveillance, Detekt will fall short, but it does offer a free option for those seeking at least basic assurances that they aren't being targeted."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17274
PUBLISHED: 2020-02-26
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
CVE-2019-17275
PUBLISHED: 2020-02-26
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVE-2020-3169
PUBLISHED: 2020-02-26
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a spe...
CVE-2020-3170
PUBLISHED: 2020-02-26
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could expl...
CVE-2020-3171
PUBLISHED: 2020-02-26
A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input vali...