Feeds

Trojan poses as privacy tool, spies on Iranian surfers

Looks like a popular free encrypted proxy tool

5 things you didn’t know about cloud backup

Backdoored versions of a widely used privacy tool have surfaced in Iran, raising fears that its government is using the Trojanised software to spy on its citizens.

A free encrypted proxy tool called Simurgh – official website https://simurghesabz.net – is used by many Iranians to circumvent locally applied net censorship technologies. Recently a Trojanised version of the tool (Simurgh-setup.zip) has begun appearing on file-sharing networks and wares sites.

The real software works as a standalone tool that can be run off a USB stick at locations such as cybercafes and other public internet access points. By contrast, the Trojanised version requires installation on a client PC. Thereafter, the software tracks user activities including keystrokes and websites visited. This data is then uploaded to US-based servers registered to a Saudi Arabian organisation, human rights activist group CitizenLab.org says.

Morgan Marquis-Boire from CitizenLab.org was among the first to publicise the presence of malware in knock-off copies of a tool used by Iranian dissidents and others looking to safeguard their privacy or visit proscribed websites.

Both the Trojanised version of the tool and the real thing connect to a web page that confirms that users are surfing through a proxy. Developers at Simurgh are taking advantage of this behaviour to automatically detect if a surfer is using a Trojanised version of their software before warning them that they are in danger.

Iran's internet censorship regime already blocks access to many foreign websites, social networks and other web services. Attempts to "phish" for social network usernames and passwords have been reported in Syria and Iran, as well as the use of false security certificates. More recently Iran rolled the capability to block https and the ports used by Virtual Private Networks, according to Reporters Without Borders (here).

The web has played a central role in recent campaigns of political dissent inside the country and free expression more generally – hence the ongoing push by the country's rulers to tighten the screws on what its citizens can do online. This has stimulated interest in web proxies, such as Simurgh, designed to circumvent censorship controls, making the appearance of Trojanised versions of the tool all the more dangerous.

"This malware is targeting users for whom having their communications compromised could result in imprisonment or worse," warns Chester Wisniewski, a senior security advisor at Sophos Canada. Wisniewski added that it is "almost always a bad idea" to download and run files from unknown websites, especially files from torrent and file-sharing sites. Computer users would do far better to go to a developer's website for software download instead, he argues.

A blog post by Sophos explained the Trojanised Simurgh threat in greater depth can be found here. ®

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.