ESET’s guide makes it possible to peek into FinFisher

Minimalist · Jan 23, 2018

FinFisher, also known as FinSpy, has a history of being used in surveillance campaigns, both against legitimate targets and against political opposition in countries with oppressive regimes. Despite that, the latest thorough analyses dealt with samples from as long ago as 2010. Since then, the FinFisher spyware received strong anti-analysis measures; apparently, this is also the reason why the most recent reports about FinFisher don’t go into much technical detail. In one of the reports, a reputable security company even admitted that due to strong obfuscation, it was not possible to extract the C&C servers.

Having discovered a wave of surveillance campaigns in several countries in summer 2017, ESET researchers dug deep into the samples of FinFisher. To be able to start a thorough analysis of how these recent samples work, they first had to break through all of FinFisher’s protective layers.

To help malware analysts and security researchers overcome FinFisher’s advanced anti-disassembly obfuscation and virtualization features, ESET researchers have framed some clever tricks into a whitepaper, “ESET’s guide to deobfuscating and devirtualizing FinFisher”.
Click to expand...

https://www.welivesecurity.com/2018/01/23/guide-makes-possible-peek-finfisher/

deBoetie · Jan 23, 2018

Another reminder to verify checksum or repository integrity before installing or running any executable. The report is saying that they substituted - likely with the ISP collusion to achieve MitM - trojan-ized versions of popular apps from download sites.

Chillingly, they target privacy oriented apps including Threema and Truecrypt.

Rasheed187 · Jan 28, 2018

This is related, and also a reminder that you can never blindly trust apps, even when downloaded from a trusted source. Scary stuff:

https://www.welivesecurity.com/2018/01/09/turlas-backdoor-laced-flash-player-installer/

Log in or Sign up

ESET’s guide makes it possible to peek into FinFisher

Minimalist Registered Member

deBoetie Registered Member

Rasheed187 Registered Member

Log in or Sign up

ESET’s guide makes it possible to peek into FinFisher

Minimalist Registered Member

deBoetie Registered Member

Rasheed187 Registered Member

Useful Searches