6 ms·

Hooking Candiru: Another mercenary spyware vendor comes into focus

192 points by colinprince 5y ago

afrcnc 5y ago
Can we submit non-paywalled links. Like the actual source: https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ https://citizenlab.ca/2021/07/hooking-candiru-another-mercen...
- floatingatoll 5y ago
  The mods have since responded that they've fixed it, but in the future, if you'd like them to respond sooner, you can email them about stuff like this using the footer contact link and they can usually fix it rapidly.
dogma1138 5y ago
Microsoft didn’t attributed it to an Israeli firm, Citizen Lab did. Another article on this also showed pricing reported by Citizen Lab, $1.8 per 10 devices if this is true this market will be exploding unless it will be heavily regulated..
- deleted 5y ago
  [deleted]
- dogleash 5y ago
  >Microsoft doesn’t name Candiru but instead refers to an “Israel-based private sector offensive actor” it calls Sourgum. https://blogs.microsoft.com/on-the-issues/2021/07/15/cyberweapons-cybersecurity-sourgum-malware/ https://blogs.microsoft.com/on-the-issues/2021/07/15/cyberwe... >We believe Sourgum is an Israel-based private sector offensive actor or PSOA.
  - dogma1138 5y ago
    > We believe Sourgum is an Israel-based private sector offensive actor or PSOA. Citizen Lab has identified the group as a company called Candiru. Sourgum generally sells cyberweapons that enable its customers, often government agencies around the world, to hack into their targets’ computers, phones, network infrastructure and internet-connected devices.
  - ManBlanket 5y ago
    I just want to point out Candiru is a fish that supposedly wriggles up someone's ding-dong when they pee in Amazonian rivers while swimming? I'm... gravely... skeptical that it ever actually happens, if I were to guess it's one of those, "I fell on it while getting dressed" situations that are occasionally explained to amused ER doctors. Maybe even one of those, "they put a chemical in the pool that makes the water turn purple when you pee." Whatever the deal with Candiru is, at some point someone suggested naming their spyware after the urethra fish. They might be making the world a worse place, but you can't say they don't have a sense of humor about it.
    - randomhodler84 5y ago
      Oh I don’t see humor in it at all. These guys picked the name of something that crawls up your urethra because that is how they saw themselves. These are Monsters, not people.
      - deleted 5y ago
        [deleted]
      - voakbasda 5y ago
        I agree. Sociopaths that know they are sociopaths, and flagrantly proud of it.
    - ackbar03 5y ago
      So how do you get them out of your system exactly? Amputation?
- dang 5y ago
  We've changed the title from "Israeli Firm’s Spyware Used Against Dissidents, Microsoft Says" as part of changing the URL from https://www.bloomberg.com/news/articles/2021-07-15/israeli-firm-s-spyware-used-against-dissidents-microsoft-says https://www.bloomberg.com/news/articles/2021-07-15/israeli-f... to the report it points to.
1cvmask 5y ago
The other Israeli hacking company was NSO Group which was allegedly used in the killing of Khashoggi: https://www.business-humanrights.org/en/latest-news/nso-group-allegedly-provided-software-to-saudi-govt-to-spy-on-khashoggi-citizen-lab-who-reported-it-in-turn-targeted-by-undercover-agents/ https://www.business-humanrights.org/en/latest-news/nso-grou...
- srean 5y ago
  Also for targeting activists in India to arrest them on trumped charges and planted evidence on the Bhima Koregaon case. All of them are being held without trial -- a norm of sorts for the current Indian government The held include activists, reputed professors from IIT. https://citizenlab.ca/?s=koregaon https://citizenlab.ca/?s=koregaon https://www.washingtonpost.com/world/2021/04/20/india-bhima-koregaon-activists-report https://www.washingtonpost.com/world/2021/04/20/india-bhima-... (paywalled) https://www.washingtonpost.com/world/2021/07/06/bhima-koregaon-case-India https://www.washingtonpost.com/world/2021/07/06/bhima-korega... (paywalled) https://www.washingtonpost.com/context/new-forensics-report-concludes-evidence-was-planted-in-case-against-indian-activists/1fb9874f-0f32-44fc-b9e9-0e59b69e9200 https://www.washingtonpost.com/context/new-forensics-report-... (downloadable report)
hkon 5y ago
I am curious as to how exactly the spyware got on the victims computers. In the Microsoft blog, they mention a chain of exploits. But it could be interesting to understand how they are able to target an individual system with such precision.
- flyinglizard 5y ago
  The attacker knows very well who the victim is and probably has all their contact info. From there you can use email or messaging to direct them towards your digital traps.
- Anunayj 5y ago
  Article does mention Chrome 0-day Vulnerabilities (CVE-2021-21166 and CVE-2021-30551) and a Office Vulnerability (CVE-2021-33742). Knowing these were targeted attacks, It could have been as easy as sending a innocent looking email with a innocent looking link (something like blacklivesmatters[.]info). That combined with the Windows privilege acceleration attacks, could get the spyware insane amount of access. Considering these individuals (politicians, journalists) probably dealt with a lot of mail everyday, this could easily have gone undetected. This really gives you a perspective on how big this company is, having the resources and incentive to do these exploits instead of reporting it.
  - hkon 5y ago
    Yes, incentive wise it increases respect for the ones that do research and report it instead of exploiting it.
qwerty456127 5y ago
As a society, we absolutely have to start actively developing software (OS in the first place) and hardware with privacy as a topmost priority. Using Windows and common Windows apps leaves bizarrely many tracks on the computer. Just take a look at one of the many resources on "computer forensics" and you'll see. And I doubt this can be addressed without decreasing complexity.
- deregulateMed 5y ago
  I wonder if those supposedly secure Linux distros are actually secure. Anything from MS, Google, and Apple cannot be trusted.
  - deleted 5y ago
    [deleted]
  - ipaddr 5y ago
    kde linux is popular.
  - Anunayj 5y ago
    Well unless you are building everything from source (after auditing software), you end up trusting someone for the executable (packaged by distro maintainers). Distros like Gentoo solve this pretty well by giving a good suite of build tools, Nevertheless it's too bothersome for most users. Arch distributes it's package signing abilities to multiple maintainers who can revoke each other's keys. which imo is better than trusting a downloaded exe signed by Microsoft. Open source has one really good benefit, Having more eyes on the code, which means less likely a bug goes undetected. It also means reduced effort for finding bugs. Though imo Linux is arguably more safer because if it's smaller surface area. I think Linux (with additions like AppArmor/SELinux) is definitely more than enough for most high profile people. That coupled with Good Security practices (not running untrusted binaries, using end-to-end encrypted mediums for communication) imo should deter 99.9% of those surveillance attacks.
    - squarefoot 5y ago
colinprince 5y ago
Let's link to a non-paywalled article: https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ https://citizenlab.ca/2021/07/hooking-candiru-another-mercen... (instead of: https://www.bloomberg.com/news/articles/2021-07-15/israeli-firm-s-spyware-used-against-dissidents-microsoft-says https://www.bloomberg.com/news/articles/2021-07-15/israeli-f... )
- dang 5y ago
  Changed.
tgragnato 5y ago
Funny thing is that they used zcombinator[.]co for one of their C2
- codetrotter 5y ago
  Probably they read HN then. Wonder if any of them ever commented something on HN.
weeweww32 5y ago
oy vey

192 points by colinprince 5y ago

Can we submit non-paywalled links. Like the actual source: https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ https://citizenlab.ca/2021/07/hooking-candiru-another-mercen...

floatingatoll 5y ago
The mods have since responded that they've fixed it, but in the future, if you'd like them to respond sooner, you can email them about stuff like this using the footer contact link and they can usually fix it rapidly.

dogma1138 5y ago

Microsoft didn’t attributed it to an Israeli firm, Citizen Lab did. Another article on this also showed pricing reported by Citizen Lab, $1.8 per 10 devices if this is true this market will be exploding unless it will be heavily regulated..

deleted 5y ago
[deleted]
dogleash 5y ago
>Microsoft doesn’t name Candiru but instead refers to an “Israel-based private sector offensive actor” it calls Sourgum. https://blogs.microsoft.com/on-the-issues/2021/07/15/cyberweapons-cybersecurity-sourgum-malware/ https://blogs.microsoft.com/on-the-issues/2021/07/15/cyberwe... >We believe Sourgum is an Israel-based private sector offensive actor or PSOA.
- dogma1138 5y ago
  > We believe Sourgum is an Israel-based private sector offensive actor or PSOA. Citizen Lab has identified the group as a company called Candiru. Sourgum generally sells cyberweapons that enable its customers, often government agencies around the world, to hack into their targets’ computers, phones, network infrastructure and internet-connected devices.
- ManBlanket 5y ago
  I just want to point out Candiru is a fish that supposedly wriggles up someone's ding-dong when they pee in Amazonian rivers while swimming? I'm... gravely... skeptical that it ever actually happens, if I were to guess it's one of those, "I fell on it while getting dressed" situations that are occasionally explained to amused ER doctors. Maybe even one of those, "they put a chemical in the pool that makes the water turn purple when you pee." Whatever the deal with Candiru is, at some point someone suggested naming their spyware after the urethra fish. They might be making the world a worse place, but you can't say they don't have a sense of humor about it.
  - randomhodler84 5y ago
    Oh I don’t see humor in it at all. These guys picked the name of something that crawls up your urethra because that is how they saw themselves. These are Monsters, not people.
    - deleted 5y ago
      [deleted]
    - voakbasda 5y ago
      I agree. Sociopaths that know they are sociopaths, and flagrantly proud of it.
  - ackbar03 5y ago
    So how do you get them out of your system exactly? Amputation?
dang 5y ago
We've changed the title from "Israeli Firm’s Spyware Used Against Dissidents, Microsoft Says" as part of changing the URL from https://www.bloomberg.com/news/articles/2021-07-15/israeli-firm-s-spyware-used-against-dissidents-microsoft-says https://www.bloomberg.com/news/articles/2021-07-15/israeli-f... to the report it points to.

1cvmask 5y ago

The other Israeli hacking company was NSO Group which was allegedly used in the killing of Khashoggi: https://www.business-humanrights.org/en/latest-news/nso-group-allegedly-provided-software-to-saudi-govt-to-spy-on-khashoggi-citizen-lab-who-reported-it-in-turn-targeted-by-undercover-agents/ https://www.business-humanrights.org/en/latest-news/nso-grou...

srean 5y ago
Also for targeting activists in India to arrest them on trumped charges and planted evidence on the Bhima Koregaon case. All of them are being held without trial -- a norm of sorts for the current Indian government The held include activists, reputed professors from IIT. https://citizenlab.ca/?s=koregaon https://citizenlab.ca/?s=koregaon https://www.washingtonpost.com/world/2021/04/20/india-bhima-koregaon-activists-report https://www.washingtonpost.com/world/2021/04/20/india-bhima-... (paywalled) https://www.washingtonpost.com/world/2021/07/06/bhima-koregaon-case-India https://www.washingtonpost.com/world/2021/07/06/bhima-korega... (paywalled) https://www.washingtonpost.com/context/new-forensics-report-concludes-evidence-was-planted-in-case-against-indian-activists/1fb9874f-0f32-44fc-b9e9-0e59b69e9200 https://www.washingtonpost.com/context/new-forensics-report-... (downloadable report)

hkon 5y ago

I am curious as to how exactly the spyware got on the victims computers. In the Microsoft blog, they mention a chain of exploits. But it could be interesting to understand how they are able to target an individual system with such precision.

flyinglizard 5y ago
The attacker knows very well who the victim is and probably has all their contact info. From there you can use email or messaging to direct them towards your digital traps.
Anunayj 5y ago
Article does mention Chrome 0-day Vulnerabilities (CVE-2021-21166 and CVE-2021-30551) and a Office Vulnerability (CVE-2021-33742). Knowing these were targeted attacks, It could have been as easy as sending a innocent looking email with a innocent looking link (something like blacklivesmatters[.]info). That combined with the Windows privilege acceleration attacks, could get the spyware insane amount of access. Considering these individuals (politicians, journalists) probably dealt with a lot of mail everyday, this could easily have gone undetected. This really gives you a perspective on how big this company is, having the resources and incentive to do these exploits instead of reporting it.
- hkon 5y ago
  Yes, incentive wise it increases respect for the ones that do research and report it instead of exploiting it.

qwerty456127 5y ago

As a society, we absolutely have to start actively developing software (OS in the first place) and hardware with privacy as a topmost priority. Using Windows and common Windows apps leaves bizarrely many tracks on the computer. Just take a look at one of the many resources on "computer forensics" and you'll see. And I doubt this can be addressed without decreasing complexity.

deregulateMed 5y ago
I wonder if those supposedly secure Linux distros are actually secure. Anything from MS, Google, and Apple cannot be trusted.
- deleted 5y ago
  [deleted]
- ipaddr 5y ago
  kde linux is popular.
- Anunayj 5y ago
  Well unless you are building everything from source (after auditing software), you end up trusting someone for the executable (packaged by distro maintainers). Distros like Gentoo solve this pretty well by giving a good suite of build tools, Nevertheless it's too bothersome for most users. Arch distributes it's package signing abilities to multiple maintainers who can revoke each other's keys. which imo is better than trusting a downloaded exe signed by Microsoft. Open source has one really good benefit, Having more eyes on the code, which means less likely a bug goes undetected. It also means reduced effort for finding bugs. Though imo Linux is arguably more safer because if it's smaller surface area. I think Linux (with additions like AppArmor/SELinux) is definitely more than enough for most high profile people. That coupled with Good Security practices (not running untrusted binaries, using end-to-end encrypted mediums for communication) imo should deter 99.9% of those surveillance attacks.
  - squarefoot 5y ago

colinprince 5y ago

Let's link to a non-paywalled article: https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ https://citizenlab.ca/2021/07/hooking-candiru-another-mercen... (instead of: https://www.bloomberg.com/news/articles/2021-07-15/israeli-firm-s-spyware-used-against-dissidents-microsoft-says https://www.bloomberg.com/news/articles/2021-07-15/israeli-f... )

dang 5y ago
Changed.

tgragnato 5y ago

Funny thing is that they used zcombinator[.]co for one of their C2

codetrotter 5y ago
Probably they read HN then. Wonder if any of them ever commented something on HN.

weeweww32 5y ago

oy vey