Of course we would. …
Phone spies in a government near you?
Perish the idea.
Oh wait… The NSA has a warehouse for this stuff….
FinSpy turning up in dictatorships across the world
Originally posted by Iain Thomson in San Francisco:
Two security researchers have found new evidence that legitimate spyware sold by British firm Gamma International appears to be being used by some of the most repressive regimes in the world.
Google security engineers investigating spyware found in email attachments to Bahraini activists identified spyware infecting not only PCs but a broad range of smartphones, including iOS, Android, RIM, Symbian, and Windows Phone 7 handsets.
The spyware can monitor and report calls and GPS positions and record Skype sessions on a PC, logging keystrokes, and controlling any cameras and microphones that are installed.
The code appears to be FinSpy, a commercial spyware sold to countries for police criminal investigations.
Now just hold on tight there.
How do the police get to hand out these phones to the usual suspects?
Thought it through yet?
Let us continue:
FinSpy, developed by Gamma Group denied the company was involved.
"As you know we don't normally discuss our clients but given this unique situation it's only fair to say that Gamma has never sold their products to Bahrain," he said. "It is unlikely that it was an installed system used by one of our clients but rather that a copy of an old FinSpy demo version was made during a presentation and that this copy was modified and then used elsewhere."
Investigators at Rapid7 found command and control software servers for the FinSpy code running in:
United Arab Emirates
with another server in the US running on Amazon's EC2 cloud systems.
If you have ever been culled by an Amazon job interview scam you will appreciate the amount of material that is on file about you including your mother's maiden name.
So now you know what they are doing with it.
Less than 24 hours after the research was published, the team noted that several of these servers were shut down.
All it took was one phone call, obviously. 😀
Gamma and FinSpy documents were found in the Egyptian security service headquarters ransacked by protestors after the fall of Hosni Mubarak. These appear to be a proposal that the Egyptian government buy a five-month license for the software for €287,000.
>>>Gamma denied involvement.<<<
Marquis-Boire and Marczak found a link to Gamma in these latest code samples; a code certificate issued to Cyan Engineering, whose website is registered to one Johnny Geds.
The same name is listed as Gamma Group's sales contact on the FinSpy proposal uncovered in the raid on Egypt's security headquarters. Muench has confirmed they do employ someone of that name in sales but declined to comment further.
There's growing evidence that Britain is one of the leading players in the market. Privacy International has formally warned the British government that it will be taking legal action on the issue and this latest research only adds weight to the issue.
Wouldn't it be nice if people were nice.