6 ms·

German Made State Malware Company FinFisher Raided

135 points by looperhacks 6y ago

k__ 6y ago
lol, so we paid a company to create maleware with tax Euros and they outsourced it to Romania? Classic Bavaria.
- gostsamo 6y ago
  Or maybe they developed it before selling it to the state?
- akerro 6y ago
  Or maybe regulations for development and trade of computer viruses are lower in Romania and there's less paperwork to make one without risk of another government wanting to claim the works, like it would happen in other cheaper countries, China or India.
  - FeepingCreature 6y ago
    Ah yes, the three options for software development in Germany. Romania, China and India.
    - ETHisso2017 6y ago
      Don't forget Hungary and Ukraine!
      - sam_lowry_ 6y ago
        Ukraine is not in EU.
        akerro 6y ago
        Neither is China and India. No one mentioned EU.
- PeterisP 6y ago
  Well, EU does have a lot of initiatives pushing for a 'single digital market' without borders/barriers; Romania is (has to be) treated as a domestic supplier.
  - k__ 6y ago
    Yes, you're right. I talked with people from the east of EU and while they like the money, they aren't always treated well by the western companies. Guess, that's why I always overreact when I see outsourcing to the east.
FerretFred 6y ago
suspected of having exported state malware without the required authorization Wow.
- blackbear_ 6y ago
  It's a thing. To use the University cluster, I have to sign an agreement every year promising to adhere to said regulations [1,2] [1]: https://www.gesetze-im-internet.de/englisch_awg/index.html https://www.gesetze-im-internet.de/englisch_awg/index.html [2]: https://www.gesetze-im-internet.de/englisch_awv/index.html https://www.gesetze-im-internet.de/englisch_awv/index.html
  - sneeze-slayer 6y ago
    You have to agree to not export state malware for your university? Seems a bit intense to me; I don't remember doing anything like that for my university. It's nice that they have English translations of the laws, though.
- BLKNSLVR 6y ago
  Such a fine line isn't it. State malware wasn't the problem. It was the authorisation defining which customers are OK and which aren't. They would have only been mostly morally bankrupt if they'd stuck to the list.
- PeterisP 6y ago
  It's like with weapons export - in general, in most countries you can manufacture and sell military-grade weapons abroad, however, you must obtain a permit from your government which will vet which of your foreign customers are acceptable and which would go against the government political interests and thus are taboo.
- sangnoir 6y ago
  It's not a surprising sentence if you consider how states perceive cyberspace: malware-as-munition. Just as German companies cant export guns, bombs or other military hardware without authorization, same goes for state-developed malware.
electro_blah 6y ago
If you are shocked by this then please contact me. I have a fairly new bridge to sell.
lkuty 6y ago
"state malware" is quite a weird grouping of terms. I understand people find "exported" to be the most disturbing word in "exported state malware" but not for me.
- 3np 6y ago
  First time I come across the term . What’s the intended meaning?
  - andi999 6y ago
    It is malware developed for the state (government) to use by the state on cititizin hardware.
  - netcan 6y ago
    malware used by states.
hyper_reality 6y ago
It's been known since at least 2014 that this company has been selling software to regimes that violate human rights, squash freedom of information, and monitor pro-democracy activists. They were hacked and their client list was leaked, to which they responded "we have some integrity. We don't sell to Israel". (https://www.zdnet.com/article/top-govt-spyware-company-hacked-gammas-finfisher-leaked/ https://www.zdnet.com/article/top-govt-spyware-company-hacke...) It's taken a long time but it's good to see that the wheels of justice have finally caught up with this scummy mercenary company. It is dirtying the name of the information security field, and engineers who have worked for them or similar surveillance software should be ashamed.
- mschuster91 6y ago
  > They were hacked and their client list was leaked, to which they responded "we have some integrity. We don't sell to Israel". (https://www.zdnet.com/article/top-govt-spyware-company-hacke https://www.zdnet.com/article/top-govt-spyware-company-hacke...) The quote is from a fake account run by the hackers. There is (at least to my knowledge) no indication that they're antisemites. Doesn't make the situation better, though.
  - hyper_reality 6y ago
    Thanks for the fact check, I didn't read that article closely enough.
  - gotstad 6y ago
    Bring critical of Israel (a nation) does NOT equate antisemitism (a religion).
    - tobessebot 6y ago
      It does if that's the only standard you apply in choosing to whom you deliver a product. If you sell to despotic regimes and not to Israel, you're criticism of Israel is anti-semitic.
netcan 6y ago
I'm also worried by these stories. However, I don't see any hope that malware exports will be curbed ahead of conventional weapons exports. Ultimately, weapons can be exported under pretty liberal rules. Even if there are controls (like there are on weapons), the existence of a robust weapons market means that weapons are usually available to any regime (or less) that can pay for it. Certain weapons (ICBMs, tanks, jets) are actually controlled, but these tend to be weapons (1) without a robust market (2) that potentially challenge an exporters military power (3) really expensive. The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. We're losing at this.
- luckylion 6y ago
  > The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. That's hard to do though. Germany has their attempt with the infamous laws around "hacker tools", which place a lot of legal insecurity on any serious security work. "Rouge malware vendors" would already be operating illegally, and a state sanctioned developer that provides the state with malware can't be considered a mercenary, I think. I'm not convinced regular law enforcement badly needs malware to investigate, but I also don't see why they'd not get that tool (with court orders and solid procedures) if we allow them to do other kinds of surveillance. From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.
  - netcan 6y ago
    >>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.* There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics. It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic. What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly. Unlimited power is a bad thing, a dangerous thing.
FandangoRanger 6y ago
Hahaha, Windows-only malware.
FreshFries 6y ago
To clear some details, this is the source: https://freiheitsrechte.org/home/wp-content/uploads/2019/11/2019-07-04-FinFisher-Strafanzeige-EN.pdf https://freiheitsrechte.org/home/wp-content/uploads/2019/11/... Some quotes: "Factual evidence exists for the fact that the suspects, who at the point in time relevant for the criminal complaint were CEOs or staff members of Elaman GmbH, FinFisher GmbH, or FinFisher Labs GmbH, have made themselves liable to prosecution because of deliberate violations against the obligation to obtain licences for dual-use software in accordance with section 18 para. 2 no. 1 and section 18 para. 5 no. 1 Foreign Trade and Payments Act (Außenwirtschafts- gesetz, AWG) by exporting the surveillance software FinSpy to Turkey during the period between October 2016 and July 2017 without having previously obtained the required licence from the [German] federal government." State malware: "FinSpy is highly developed spyware which, according to the company’s own description on its website, is sold exclusively to governments for the purposes of strategic intelligence and criminal prosecution," This is not an old case, it has been submitted only recently, as is clear from the date mentioned here: "The companies are neither so large nor is the number of potential FinSpy customers so high that it would suggest itself to decide about and carry out exports without the knowledge of the CEOs. The fact that the federal government, according to the information it gave on 19 June 2019, has not issued an export licence for intrusion software requiring a licence since January 2015 additionally either suggests that the export of such software is not routine business, which would support all the more that the CEOs knew about it, or that numerous additional exports violating the export provisions have taken place in recent years, above and beyond the business deals with Turkey." Interesting read.
nsajko 6y ago
There are many companies that deal in (and sometimes operate) cyberweapons and spyware, usually with governments as (often malicious) clients. Some examples besides FinFisher/FinSpy are NortonLifeLock (Symantec, Blue Coat Systems), Groupe Bull (Amesys), DarkMatter Group, Endgame, Gamma Group, NSO Group, Zerodium. There has previously already been some discussion on NSO Group's "Pegasus" Spyware and how it's being used in terrifying ways. This is a frightening 8-part series by Citizen Labs about the abuse of "Pegasus" in Mexico 2017-2019: https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware/ https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware... Here's a category of articles on the citizenlab.ca web site described as "Investigations into the prevalence and impact of digital espionage operations against civil society groups": https://citizenlab.ca/category/research/targeted-threats/ https://citizenlab.ca/category/research/targeted-threats/
ManuelKiessling 6y ago
As a German, I have to say: now that’s a hard to parse HN headline!
- kazinator 6y ago
  It contains an appositive, which normally requires commas in writing, and is likewise clearly delimited in spoken language: German Made State Malware Company, FinFisher, Raided

135 points by looperhacks 6y ago

k__ 6y ago

lol, so we paid a company to create maleware with tax Euros and they outsourced it to Romania? Classic Bavaria.

gostsamo 6y ago
Or maybe they developed it before selling it to the state?
akerro 6y ago
Or maybe regulations for development and trade of computer viruses are lower in Romania and there's less paperwork to make one without risk of another government wanting to claim the works, like it would happen in other cheaper countries, China or India.
- FeepingCreature 6y ago
  Ah yes, the three options for software development in Germany. Romania, China and India.
  - ETHisso2017 6y ago
    Don't forget Hungary and Ukraine!
    - sam_lowry_ 6y ago
      Ukraine is not in EU.
      - akerro 6y ago
        Neither is China and India. No one mentioned EU.
PeterisP 6y ago
Well, EU does have a lot of initiatives pushing for a 'single digital market' without borders/barriers; Romania is (has to be) treated as a domestic supplier.
- k__ 6y ago
  Yes, you're right. I talked with people from the east of EU and while they like the money, they aren't always treated well by the western companies. Guess, that's why I always overreact when I see outsourcing to the east.

FerretFred 6y ago

suspected of having exported state malware without the required authorization Wow.

blackbear_ 6y ago
It's a thing. To use the University cluster, I have to sign an agreement every year promising to adhere to said regulations [1,2] [1]: https://www.gesetze-im-internet.de/englisch_awg/index.html https://www.gesetze-im-internet.de/englisch_awg/index.html [2]: https://www.gesetze-im-internet.de/englisch_awv/index.html https://www.gesetze-im-internet.de/englisch_awv/index.html
- sneeze-slayer 6y ago
  You have to agree to not export state malware for your university? Seems a bit intense to me; I don't remember doing anything like that for my university. It's nice that they have English translations of the laws, though.
BLKNSLVR 6y ago
Such a fine line isn't it. State malware wasn't the problem. It was the authorisation defining which customers are OK and which aren't. They would have only been mostly morally bankrupt if they'd stuck to the list.
PeterisP 6y ago
It's like with weapons export - in general, in most countries you can manufacture and sell military-grade weapons abroad, however, you must obtain a permit from your government which will vet which of your foreign customers are acceptable and which would go against the government political interests and thus are taboo.
sangnoir 6y ago
It's not a surprising sentence if you consider how states perceive cyberspace: malware-as-munition. Just as German companies cant export guns, bombs or other military hardware without authorization, same goes for state-developed malware.

electro_blah 6y ago

If you are shocked by this then please contact me. I have a fairly new bridge to sell.

lkuty 6y ago

"state malware" is quite a weird grouping of terms. I understand people find "exported" to be the most disturbing word in "exported state malware" but not for me.

3np 6y ago
First time I come across the term . What’s the intended meaning?
- andi999 6y ago
  It is malware developed for the state (government) to use by the state on cititizin hardware.
- netcan 6y ago
  malware used by states.

hyper_reality 6y ago

It's been known since at least 2014 that this company has been selling software to regimes that violate human rights, squash freedom of information, and monitor pro-democracy activists. They were hacked and their client list was leaked, to which they responded "we have some integrity. We don't sell to Israel". (https://www.zdnet.com/article/top-govt-spyware-company-hacked-gammas-finfisher-leaked/ https://www.zdnet.com/article/top-govt-spyware-company-hacke...) It's taken a long time but it's good to see that the wheels of justice have finally caught up with this scummy mercenary company. It is dirtying the name of the information security field, and engineers who have worked for them or similar surveillance software should be ashamed.

mschuster91 6y ago
> They were hacked and their client list was leaked, to which they responded "we have some integrity. We don't sell to Israel". (https://www.zdnet.com/article/top-govt-spyware-company-hacke https://www.zdnet.com/article/top-govt-spyware-company-hacke...) The quote is from a fake account run by the hackers. There is (at least to my knowledge) no indication that they're antisemites. Doesn't make the situation better, though.
- hyper_reality 6y ago
  Thanks for the fact check, I didn't read that article closely enough.
- gotstad 6y ago
  Bring critical of Israel (a nation) does NOT equate antisemitism (a religion).
  - tobessebot 6y ago
    It does if that's the only standard you apply in choosing to whom you deliver a product. If you sell to despotic regimes and not to Israel, you're criticism of Israel is anti-semitic.

netcan 6y ago

I'm also worried by these stories. However, I don't see any hope that malware exports will be curbed ahead of conventional weapons exports. Ultimately, weapons can be exported under pretty liberal rules. Even if there are controls (like there are on weapons), the existence of a robust weapons market means that weapons are usually available to any regime (or less) that can pay for it. Certain weapons (ICBMs, tanks, jets) are actually controlled, but these tend to be weapons (1) without a robust market (2) that potentially challenge an exporters military power (3) really expensive. The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. We're losing at this.

luckylion 6y ago
> The avenue (IMO) is to fight the legality of malware and/or malware mercenaries within our countries. That's hard to do though. Germany has their attempt with the infamous laws around "hacker tools", which place a lot of legal insecurity on any serious security work. "Rouge malware vendors" would already be operating illegally, and a state sanctioned developer that provides the state with malware can't be considered a mercenary, I think. I'm not convinced regular law enforcement badly needs malware to investigate, but I also don't see why they'd not get that tool (with court orders and solid procedures) if we allow them to do other kinds of surveillance. From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.
- netcan 6y ago
  >>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.* There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics. It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic. What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly. Unlimited power is a bad thing, a dangerous thing.

FandangoRanger 6y ago

Hahaha, Windows-only malware.

FreshFries 6y ago

To clear some details, this is the source: https://freiheitsrechte.org/home/wp-content/uploads/2019/11/2019-07-04-FinFisher-Strafanzeige-EN.pdf https://freiheitsrechte.org/home/wp-content/uploads/2019/11/... Some quotes: "Factual evidence exists for the fact that the suspects, who at the point in time relevant for the criminal complaint were CEOs or staff members of Elaman GmbH, FinFisher GmbH, or FinFisher Labs GmbH, have made themselves liable to prosecution because of deliberate violations against the obligation to obtain licences for dual-use software in accordance with section 18 para. 2 no. 1 and section 18 para. 5 no. 1 Foreign Trade and Payments Act (Außenwirtschafts- gesetz, AWG) by exporting the surveillance software FinSpy to Turkey during the period between October 2016 and July 2017 without having previously obtained the required licence from the [German] federal government." State malware: "FinSpy is highly developed spyware which, according to the company’s own description on its website, is sold exclusively to governments for the purposes of strategic intelligence and criminal prosecution," This is not an old case, it has been submitted only recently, as is clear from the date mentioned here: "The companies are neither so large nor is the number of potential FinSpy customers so high that it would suggest itself to decide about and carry out exports without the knowledge of the CEOs. The fact that the federal government, according to the information it gave on 19 June 2019, has not issued an export licence for intrusion software requiring a licence since January 2015 additionally either suggests that the export of such software is not routine business, which would support all the more that the CEOs knew about it, or that numerous additional exports violating the export provisions have taken place in recent years, above and beyond the business deals with Turkey." Interesting read.

nsajko 6y ago

There are many companies that deal in (and sometimes operate) cyberweapons and spyware, usually with governments as (often malicious) clients. Some examples besides FinFisher/FinSpy are NortonLifeLock (Symantec, Blue Coat Systems), Groupe Bull (Amesys), DarkMatter Group, Endgame, Gamma Group, NSO Group, Zerodium. There has previously already been some discussion on NSO Group's "Pegasus" Spyware and how it's being used in terrifying ways. This is a frightening 8-part series by Citizen Labs about the abuse of "Pegasus" in Mexico 2017-2019: https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware/ https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware... Here's a category of articles on the citizenlab.ca web site described as "Investigations into the prevalence and impact of digital espionage operations against civil society groups": https://citizenlab.ca/category/research/targeted-threats/ https://citizenlab.ca/category/research/targeted-threats/

ManuelKiessling 6y ago

As a German, I have to say: now that’s a hard to parse HN headline!

kazinator 6y ago
It contains an appositive, which normally requires commas in writing, and is likewise clearly delimited in spoken language: German Made State Malware Company, FinFisher, Raided