Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/21/2014
04:25 PM
50%
50%

Privacy Groups Release 'Detekt' Tool to Spot Spyware

Privacy advocates have joined together to release a tool for identifying cyber espionage malware.

Privacy advocates jointly announced the release of a free malware detection tool meant to help human rights activists, journalists, and others thwart surveillance malware.

The tool, known as Detekt, was developed by Claudio Guarnieri. It was released Thursday in partnership with Amnesty International, Digitale Gesellschaft, Privacy International, and the Electronic Frontier Foundation. Detekt works by scanning computers for predefined patterns that have been linked to remote access Trojans such as DarkComet, FinFisher (FinSpy), njRAT, and Gh0st RAT.

Though some of those tools have been used by cybercriminals, others, such as FinFisher and Hacking Team's Remote Control System (RCS) tool, have been linked to various cyber espionage campaigns by governments.

"Recent years have seen a boom in the adoption of surveillance technology by governments around the world, including spyware that provides its purchasers the unchecked ability to target remote Internet users' computers, to read their personal emails, listen in on private audio calls, record keystrokes and passwords, and remotely activate their computer's camera or microphone," blogs Eva Galperin, global policy analyst at the Electronic Frontier Foundation (EFF). "EFF, together with Amnesty International, Digitale Gesellschaft, and Privacy International have all had experience assisting journalists and activists who have faced the illegitimate use of such software in defiance of accepted international human rights law."

That, she writes, is why the EFF got behind Detekt.

"Some of the software used by states against innocent citizens is widely available on the Internet, while more sophisticated alternatives are made and sold by private companies and sold to governments everywhere from the United States and Europe to Ethiopia and Vietnam," she writes. "Detekt makes it easy for at-risk users to check their PCs for possible infection by this spyware, which often goes undetected by existing commercial anti-virus products."

Detekt is a Python tool that relies on Yara, Volatility, and Winpmem to scan the memory of a running Windows system. It currently supports Windows XP to Windows 8, both 32- and 64-bit, and Windows 8.1 32-bit.

"Because Detekt is a best-effort tool and spyware companies make frequent changes to their software to avoid detection, users should keep in mind that Detekt cannot conclusively guarantee that your computer is not compromised by the spyware it aims to detect," writes Galperin. "However, we hope that the availability of this tool will help us to detect some ongoing infections, provide advice to infected users, and contribute to the debate around curbing the use of government spyware in countries where it is linked to human rights abuses."

Before launching the tool, users should close all applications and make sure the computer is disconnected from the Internet. If spyware is detected, users are advised not to reconnect the computer to the Internet until the machine has been cleaned.

Michael Sutton, vice president of security research for Zscaler, says that in today's world, spyware is not only used by cyber criminals.

"For those concerned that they may be the target of such surveillance, it offers another tool to assist in determining if their PC has been infected," says Sutton. "It will, however, suffer from the same limitations as antivirus products in that it is signature-based and must therefore try and identify known patterns in previously observed binaries. Given that the goal of those leveraging the spyware in the first place is to remain undetected, there's little doubt that they will adapt and start to develop spyware variants specifically not identified by Detekt. For those seeking absolute assurance that they are not under surveillance, Detekt will fall short, but it does offer a free option for those seeking at least basic assurances that they aren't being targeted."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9024
PUBLISHED: 2020-02-17
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
CVE-2020-9025
PUBLISHED: 2020-02-17
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
CVE-2020-9026
PUBLISHED: 2020-02-17
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.
CVE-2020-9027
PUBLISHED: 2020-02-17
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.
CVE-2020-9028
PUBLISHED: 2020-02-17
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user).