By Jeanette Tan | Yahoo! Newsroom – 4 hours
ago
Singapore’s government has been identified among a list of 25
countries that were found by two researchers to be employing spy
software, in a report published
by a Canadian think-tank.
The report, published on Citizen
Lab,
the University
of Toronto’s centre
for research on digital media and global security, detailed
findings from two security researchers at the universities of
California and Toronto that named the city-state among others that
have servers running a specific spyware.
Brunei, Indonesia, Malaysia and Vietnam, as well as Middle Eastern
countries like Bahrain, Qatar and the United Arab Emirates, and
developed countries such as Australia, Britain, Canada and the U.S.
were also identified.
“FinSpy”, the term used for the spyware the researchers found, is
sold by a British company calledGamma
Group.
Embedded in emails, the software has the capability to “grab images
off computer screens, record Skype chats, turn on cameras and
microphones and log keystrokes”, according to aNew York Times report on
the findings. Once downloaded unknowingly, FinSpy links a user’s
computer to a local server — in some of these cases, servers that
belonged to their governments.
An official of Gamma Group reportedly said it sells its technology
to governments for the sole purpose of monitoring criminal
activity, and that it was most often employed against “paedophiles,
terrorists, organised crime, kidnapping and human
trafficking”.
According to the two researchers — Morgan Marquis-Boire and Bill
Marczak — however, FinSpy is not only likely to be used for
“politically motivated surveillance”, but is also applied
differently in different countries.
In Ethiopia, for instance, download links for FinSpy were embedded
in pictures in emails that were specifically directed at political
dissidents, while in Turkmenistan, the server running the software
belonged to a range of I.P. addresses that were assigned to the
country’s communications ministry.
Closer to home, the spyware was found to be running on Android
phones in Vietnam, where Marquis-Boire and Marczak discovered one
phone that was sending text messages to a Vietnamese telephone
number — a troubling finding given recent clampdowns by the
country's government, the researchers reportedly
said.
“Our findings highlight the increasing dissonance between Gamma’s
public claims that FinSpy is used exclusively to track ‘bad guys’
and the growing body of evidence suggesting that the tool has and
continues to be used against opposition groups and human rights
activists,” the researchers added in their report.
The two also warned that the presence of "a global and unregulated
market for offensive digital tools potentially presents a novel
risk to both national and corporate cyber
security".
After discovering FinSpy last May, Marquis-Boire and Marczak
scanned the whole internet for its presence, turning up this latest
list of countries. The others are Bangladesh, the Czech Republic,
Estonia, Germany, India, Japan, Latvia, Mexico, Mongolia, the
Netherlands and Serbia.
Meanwhile, the Ministry of Home Affairs has not yet responded to
queries on the matter.
======
A map of the
countries that were identified by security researchers to be
running FinSpy, an invasive spyware, on its servers. …more
[Updated: on 16
March, adding more details, comments from MHA
spokesperson]
Singapore's government has denied using spy software after being
identified among a list of 25 countries that were found by two
researchers to be employing it, in a report published by a Canadian
think-tank.
A Ministry of Home Affairs spokesperson told Yahoo!
Singapore on Saturday that it does not use it or any such
spyware, after the report, published on Citizen Lab, the University of
Toronto’s centre for research on digital media and global
security, detailed findings from two security researchers at the
universities of California and Toronto that named the city-state
among others that have servers running a specific
spyware.
Brunei, Indonesia, Malaysia and Vietnam, as well as Middle Eastern
countries like Bahrain, Qatar and the United Arab Emirates, and
developed countries such as Australia, Britain, Canada and the U.S.
were also identified.
“FinSpy”, the term used for the spyware the researchers found, is
sold by a British company calledGamma
Group. Embedded in emails, the software has the capability to
“grab images off computer screens, record Skype chats, turn on
cameras and microphones and log keystrokes”, according to
aNew York Times report on the
findings. Once downloaded unknowingly, FinSpy links a user’s
computer to a local server — in some of these cases, servers that
belonged to their governments.
An official of Gamma Group reportedly said it sells its technology
to governments for the sole purpose of monitoring criminal
activity, and that it was most often employed against “paedophiles,
terrorists, organised crime, kidnapping and human
trafficking”.
According to the two researchers — Morgan Marquis-Boire and Bill
Marczak — however, FinSpy is not only likely to be used for
“politically motivated surveillance”, but is also applied
differently in different countries.
In Ethiopia, for instance, download links for FinSpy were embedded
in pictures in emails that were specifically directed at political
dissidents, while in Turkmenistan, the server running the software
belonged to a range of I.P. addresses that were assigned to the
country’s communications ministry.
Closer to home, the spyware was found to be running on Android
phones in Vietnam, where Marquis-Boire and Marczak discovered one
phone that was sending text messages to a Vietnamese telephone
number — a troubling finding given recent clampdowns by the
country's government, the researchers reportedly said.
“Our findings highlight the increasing dissonance between Gamma’s
public claims that FinSpy is used exclusively to track ‘bad guys’
and the growing body of evidence suggesting that the tool has and
continues to be used against opposition groups and human rights
activists,” the researchers added in their report.
The two also warned that the presence of "a global and unregulated
market for offensive digital tools potentially presents a novel
risk to both national and corporate cyber security".
However, the researchers also qualified that their findings do not
necessitate that in all the countries listed, it is a government
agency that is using FinSpy.
A key part of their report notes that the "discovery of a FinSpy
command-and-control centre in a given country is not a sufficient
indicator to conclude the use of (the software) by that country's
law enforcement or intelligence agencies".
"In some cases, servers were found running on facilities provided
by commercial hosting providers that could have been purchased by
actors from any country," the report added.
After discovering FinSpy last May, Marquis-Boire and Marczak
scanned the whole internet for its presence, turning up this latest
list of countries. The others are Bangladesh, the Czech Republic,
Estonia, Germany, India, Japan, Latvia, Mexico, Mongolia, the
Netherlands and Serbia.
