Feeds

Trojan poses as privacy tool, spies on Iranian surfers

Looks like a popular free encrypted proxy tool

Internet Security Threat Report 2014

Backdoored versions of a widely used privacy tool have surfaced in Iran, raising fears that its government is using the Trojanised software to spy on its citizens.

A free encrypted proxy tool called Simurgh – official website https://simurghesabz.net – is used by many Iranians to circumvent locally applied net censorship technologies. Recently a Trojanised version of the tool (Simurgh-setup.zip) has begun appearing on file-sharing networks and wares sites.

The real software works as a standalone tool that can be run off a USB stick at locations such as cybercafes and other public internet access points. By contrast, the Trojanised version requires installation on a client PC. Thereafter, the software tracks user activities including keystrokes and websites visited. This data is then uploaded to US-based servers registered to a Saudi Arabian organisation, human rights activist group CitizenLab.org says.

Morgan Marquis-Boire from CitizenLab.org was among the first to publicise the presence of malware in knock-off copies of a tool used by Iranian dissidents and others looking to safeguard their privacy or visit proscribed websites.

Both the Trojanised version of the tool and the real thing connect to a web page that confirms that users are surfing through a proxy. Developers at Simurgh are taking advantage of this behaviour to automatically detect if a surfer is using a Trojanised version of their software before warning them that they are in danger.

Iran's internet censorship regime already blocks access to many foreign websites, social networks and other web services. Attempts to "phish" for social network usernames and passwords have been reported in Syria and Iran, as well as the use of false security certificates. More recently Iran rolled the capability to block https and the ports used by Virtual Private Networks, according to Reporters Without Borders (here).

The web has played a central role in recent campaigns of political dissent inside the country and free expression more generally – hence the ongoing push by the country's rulers to tighten the screws on what its citizens can do online. This has stimulated interest in web proxies, such as Simurgh, designed to circumvent censorship controls, making the appearance of Trojanised versions of the tool all the more dangerous.

"This malware is targeting users for whom having their communications compromised could result in imprisonment or worse," warns Chester Wisniewski, a senior security advisor at Sophos Canada. Wisniewski added that it is "almost always a bad idea" to download and run files from unknown websites, especially files from torrent and file-sharing sites. Computer users would do far better to go to a developer's website for software download instead, he argues.

A blog post by Sophos explained the Trojanised Simurgh threat in greater depth can be found here. ®

Remote control for virtualized desktops

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
State Dept shuts off unclassified email after hack. Classified mail? That's CLASSIFIED
Classified systems 'not affected' - but, is this reconnaissance?
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.