Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/21/2014
04:25 PM
50%
50%

Privacy Groups Release 'Detekt' Tool to Spot Spyware

Privacy advocates have joined together to release a tool for identifying cyber espionage malware.

Privacy advocates jointly announced the release of a free malware detection tool meant to help human rights activists, journalists, and others thwart surveillance malware.

The tool, known as Detekt, was developed by Claudio Guarnieri. It was released Thursday in partnership with Amnesty International, Digitale Gesellschaft, Privacy International, and the Electronic Frontier Foundation. Detekt works by scanning computers for predefined patterns that have been linked to remote access Trojans such as DarkComet, FinFisher (FinSpy), njRAT, and Gh0st RAT.

Though some of those tools have been used by cybercriminals, others, such as FinFisher and Hacking Team's Remote Control System (RCS) tool, have been linked to various cyber espionage campaigns by governments.

"Recent years have seen a boom in the adoption of surveillance technology by governments around the world, including spyware that provides its purchasers the unchecked ability to target remote Internet users' computers, to read their personal emails, listen in on private audio calls, record keystrokes and passwords, and remotely activate their computer's camera or microphone," blogs Eva Galperin, global policy analyst at the Electronic Frontier Foundation (EFF). "EFF, together with Amnesty International, Digitale Gesellschaft, and Privacy International have all had experience assisting journalists and activists who have faced the illegitimate use of such software in defiance of accepted international human rights law."

That, she writes, is why the EFF got behind Detekt.

"Some of the software used by states against innocent citizens is widely available on the Internet, while more sophisticated alternatives are made and sold by private companies and sold to governments everywhere from the United States and Europe to Ethiopia and Vietnam," she writes. "Detekt makes it easy for at-risk users to check their PCs for possible infection by this spyware, which often goes undetected by existing commercial anti-virus products."

Detekt is a Python tool that relies on Yara, Volatility, and Winpmem to scan the memory of a running Windows system. It currently supports Windows XP to Windows 8, both 32- and 64-bit, and Windows 8.1 32-bit.

"Because Detekt is a best-effort tool and spyware companies make frequent changes to their software to avoid detection, users should keep in mind that Detekt cannot conclusively guarantee that your computer is not compromised by the spyware it aims to detect," writes Galperin. "However, we hope that the availability of this tool will help us to detect some ongoing infections, provide advice to infected users, and contribute to the debate around curbing the use of government spyware in countries where it is linked to human rights abuses."

Before launching the tool, users should close all applications and make sure the computer is disconnected from the Internet. If spyware is detected, users are advised not to reconnect the computer to the Internet until the machine has been cleaned.

Michael Sutton, vice president of security research for Zscaler, says that in today's world, spyware is not only used by cyber criminals.

"For those concerned that they may be the target of such surveillance, it offers another tool to assist in determining if their PC has been infected," says Sutton. "It will, however, suffer from the same limitations as antivirus products in that it is signature-based and must therefore try and identify known patterns in previously observed binaries. Given that the goal of those leveraging the spyware in the first place is to remain undetected, there's little doubt that they will adapt and start to develop spyware variants specifically not identified by Detekt. For those seeking absolute assurance that they are not under surveillance, Detekt will fall short, but it does offer a free option for those seeking at least basic assurances that they aren't being targeted."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23134
PUBLISHED: 2021-05-12
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.2 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.
CVE-2021-23135
PUBLISHED: 2021-05-12
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.
CVE-2020-28722
PUBLISHED: 2021-05-12
Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover via custom email templates.
CVE-2020-18165
PUBLISHED: 2021-05-12
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
CVE-2020-19275
PUBLISHED: 2021-05-12
An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.