If they see you looking at something they don't want you to..

http://www.propublica.org/article/leaked-docs-show-spyware-used-to-snoop-on-u.s.-computers

Leaked Docs Show Spyware Used to Snoop on U.S. Computers

Software created by the controversial U.K. based Gamma Group International was used to spy on computers that appear to be located in the United States.
by Jeff Larson and Mike Tigas
ProPublica, Aug. 8, 2014, 11:43 a.m.3 Comments Print Print
This is part of an ongoing investigation:

Surveillance
ProPublica investigates the threats to privacy in an era of cellphones, data mining and cyberwar.


Gamma group customer logs found in the leaked trove that was posted online by hackers. (Gerald Rich/ProPublica)
Software created by the controversial U.K. based Gamma Group International was used to spy on computers that appear to be located in the United States, the U.K., Germany, Russia, Iran and Bahrain, according to a leaked trove of documents analyzed by ProPublica.

It's not clear whether the surveillance was conducted by governments or private entities. Customer email addresses in the collection appeared to belong to a German surveillance company, an independent consultant in Dubai, the Bosnian and Hungarian Intelligence services, a Dutch law enforcement officer and the Qatari government.

Countries With Computers Targeted by FinFisher
Bahrain
Belgium
Cyprus
Egypt
Germany
Iraq
Islamic Republic of Iran
Italy
Kuwait
Lebanon
Lithuania
Morocco
Netherlands
Qatar
Russian Federation
Saudi Arabia
Sweden
Switzerland
Thailand
Tunisia
United Arab Emirates
United Kingdom
United States
Yemen
The leaked files — which were posted online by hackers — are the latest in a series of revelations about how state actors including repressive regimes have used Gamma's software to spy on dissidents, journalists and activist groups.

The documents, leaked last Saturday, could not be readily verified, but experts told ProPublica they believed them to be genuine. "I think it's highly unlikely that it's a fake," said Morgan Marquis-Bore, a security researcher who while at The Citizen Lab at the University of Toronto had analyzed Gamma Group's software and who authored an article about the leak on Thursday.

The documents confirm many details that have already been reported about Gamma, such as that its tools were used to spy on Bahraini activists. Some documents in the trove contain metadata tied to e-mail addresses of several Gamma employees. Bill Marczak, another Gamma Group expert at the Citizen Lab, said that several dates in the documents correspond to publicly known events — such as the day that a particular Bahraini activist was hacked.

Gamma has not commented publicly on the authenticity of the documents. A phone number listed on a Gamma Group website was disconnected. Gamma Group did not respond to email requests for comment.

The leaked files contain more 40 gigabytes of confidential technical material including software code, internal memos, strategy reports and user guides on how to use Gamma Group software suite called FinFisher. FinFisher enables customers to monitor secure web traffic, Skype calls, webcams, and personal files. It is installed as malware on targets' computers and cell phones.

A price list included in the trove lists a license of the software at almost $4 million.

The documents reveal that Gamma uses technology from a French company called Vupen Security that sells so-called computer 'exploits.'

Exploits include techniques called "zero days," for "popular software like Microsoft Office, Internet Explorer, Adobe Acrobat Reader, and many more."Zero days are exploits that have not yet been detected by the software maker and therefore are not blocked.

Vupen has said publicly that it only sells its exploits to governments, but Gamma may have no such scruples. "Gamma is an independent company that is not bound to any country, governmental organisation, etc.," says one file in the Gamma Group's material. At least one Gamma customer listed in the materials is a private security company.

Vupen didn't respond to a request for comment.

Many of Gamma's product brochures have previously been published by the Wall Street Journal and Wikileaks, but the latest trove shows how the products are getting more sophisticated.

In one document, engineers at Gamma tested a product called FinSpy, which inserts malware onto a user's machine, and found that it could not be blocked by most antivirus software.

Documents also reveal that Gamma had been working to bypass encryption tools including a mobile phone encryption app, Silent Circle, and were able to bypass the protection given by hard-drive encryption products TrueCrypt and Microsoft's Bitlocker.

Mike Janke the CEO of Silent Circle said in an email "We have serious doubts about if they were going to be successful" in circumventing the phone software, and that they were working on bulletproofing their app.

Microsoft did not respond to a request for comment.

The documents also describe a "country-wide" surveillance product called FinFly ISP which promises customers the ability to intercept internet traffic and masquerade as ordinary websites in order to install malware on a target's computer.

The most recent date-stamp found in the documents is August 2nd, which coincides with the first tweet by a parody Twitter account, @GammaGroupPR, which first announced the hack, and may be run by the hacker or hackers responsible for the leak.

On Reddit, a user called PhineasFisher claimed responsibility for the leak. "Two years ago their software was found being widely used by governments in the middle east, especially Bahrain, to hack and spy on the computers and phones of journalists and dissidents," the user wrote. The name on the @GammaGroupPR Twitter account is also "Phineas Fisher."

GammaGroup, the surveillance company whose documents were released, is no stranger to the spotlight. The security firm F-Secure first reported the purchase of FinFisher software by the Egyptian State Security agency in 2011. In 2012, Bloomberg News and The Citizen Lab showed how the company's malware was used to target activists in Bahrain.

In 2013, the software company Mozilla sent a cease-and-desist letter to the company after a report by The Citizen Lab showed that a spyware-infected version of the Firefox

browser manufactured by Gamma was being used to spy on Malaysian activists.

Senior reporter Julia Angwin and Jonathan Stray, special to ProPublica, contributed to this report.

======================

https://firstlook.org/theintercept/2014/08/07/leaked-files-german-spy-company-helped-bahrain-track-arab-spring-protesters/


Leaked Files: German Spy Company Helped Bahrain Hack Arab Spring Protesters
By [size=13]Cora Currier and Morgan Marquis-Boire7 Aug 2014, 5:40 PM EDT141[/size]

Photo credit: AP
A notorious surveillance technology company that helps governments around the world spy on their citizens sold software to Bahrain during that country’s brutal response to the Arab Spring movement, according to leaked internal documents posted this week on the internet.
The documents show that FinFisher, a German surveillance company, helped Bahrain install spyware on 77 computers, including those belonging to human rights lawyers and a now-jailed opposition leader, between 2010 and 2012—a period that includes Bahrain’s crackdown on pro-democracy protesters. FinFisher’s software gives remote spies total access to compromised computers. Some of the computers that were spied on appear to have been located in the United States and United Kingdom, according to a report from Bahrain Watch.

A screengrab from leaked FinFisher data appears to show surveillance targets of the Bahraini government
Earlier this week, an anonymous hacker released 40 gigabytes of what appears to be internal data from FinFisher on Twitter and Reddit, including messages between people who appear to be Bahraini government officials and FinFisher customer service representatives.
In those messages, Bahraini software administrators complained to FinFisher that they were “losing targets daily” due to faults in its software. In one message employing the language of a frustrated consumer, a spy appeared to complain that he or she had to keep re-infecting a targeted computer, risking detection: “[W]e cant stay bugging and infecting the target every time since it is very sensitive. and we don’t want the target to reach to know that someone is infecting his PC or spying on him” one message reads.
On its website, FinFisher says it sells surveillance technology “exclusively to government law enforcement and intelligence agencies.” The company has previously denied reports that it sold spyware to Bahrain, claiming that examples researchers identified could have come from stolen or demonstration copies. The new documents, showing sustained correspondence between individuals in Bahrain and customer service, undercut that claim. FinFisher did not respond to requests for comment.
“[W]e have 30 target licenses, we are now using them all in which we have already 30 targets,” says one message, dated November 2, 2011. On December 8th, the Bahrainis asked for an update on a previous issue: “Please investigate urgently and let us know the solution. As we are in a big lose of data now.”
FinFisher belonged to the U.K.-based Gamma Group during the time period the leaked documents cover (it was spun off last year.)  Researchers from Citizen Lab at the University of Toronto’s Munk School of Global Affairs–including a co-author of this post— first publicly identified the the FinFisher software in July 2012. At the time, members of the advocacy group Bahrain Watch in Washington, D.C., and London had been targeted via email by what appeared to be malware. The researchers analyzed the suspicious software and discovered that it was the FinSpy “lawful intercept” software developed by FinFisher. Additional research linked the use of this product to 36 countries worldwide.
The most recent leak includes logs from Bahraini software administrators of the installations they’d performed, which contained usernames and IP addresses, allowing Bahrain Watch researchers to identify some of the computers that had been targeted. Among them were Bahraini lawyers, U.K.-based activists and writers, and Hassan Mushaima, an opposition leader who is currently serving life in prison. He was sentenced in June 2011, months after the logs show spyware installed in his computer.
Another targeted computer belonged to Mohamed Altajer, a prominent human rights lawyer who was blackmailed in 2011 with a video of him and his wife having sex. The video arrived via CD at his office on January 24, 2011, bearing instructions that he stop defending activists or the tape would be made public. On that same day, the leaked logs show, spyware was installed on his computer, suggesting that government officials used the blackmail gambit to install FinSpy.
The video eventually became public in 2012, after Altajer participated in a UN human rights conference. “The 24th of January, 2011, was the most devastating day of my life,” said Altajer, reached in Bahrain.
“I’m happy that this is exposed,” he said. “The regime should understand that it is not so wise and clever to keep penetrating into people’s lives. These dirty people who videotaped me while I am naked, now they are naked, now they are exposed before the world.”
There’s little regulation preventing companies like FinFisher from selling surveillance software to countries like Bahrain. And the secretive nature of the industry means that companies “have been allowed to operate with impunity, selling intrusive surveillance equipment to states where there is no public scrutiny of surveillance or clear laws regulating its use,” said Eric King, deputy director of Privacy International. The U.K.-based group has asked the British government to investigate the Ethiopian government’s use of FinFisher’s tools to surveil a political refugee. And an Ethiopian-American is attempting to sue the Ethiopian government in U.S. federal court for using FinSpy against him.
“We should be putting international attention on these companies,” said Ali Abdulemam, a human rights activist and member of Bahrain Watch. “Gamma is always claiming that their product is for human trafficking or drug trafficking, but its being used against human rights by countries like Bahrain.”
In 2011, Bloomberg reported that Nokia Siemens was selling spy gear to Bahrain, and Bahraini interrogators were known at the time to show activists transcripts of their private text messages and phone conversations during torture sessions. The U.S. also continued arms sales to Bahrain during that period.
“As far as I am aware,” said  Salman Aljalahma, the Bahraini government’s media attaché in Washington, “the Government of Bahrain does not use FinFisher.” He added “this is a matter of national security and confidential intelligence that the public, nor I, is privy to.”
When shown the customer service correspondence and surveillance logs, Aljalahma said that “all evidence collated by the accusers still shows no link to the Bahraini Government.”