Original URL: https://www.theregister.com/2012/05/30/trojaned_privacy_tool_hits_iran/

Trojan poses as privacy tool, spies on Iranian surfers

Looks like a popular free encrypted proxy tool

By John Leyden

Posted in Security, 30th May 2012 13:24 GMT

Backdoored versions of a widely used privacy tool have surfaced in Iran, raising fears that its government is using the Trojanised software to spy on its citizens.

A free encrypted proxy tool called Simurgh – official website https://simurghesabz.net – is used by many Iranians to circumvent locally applied net censorship technologies. Recently a Trojanised version of the tool (Simurgh-setup.zip) has begun appearing on file-sharing networks and wares sites.

The real software works as a standalone tool that can be run off a USB stick at locations such as cybercafes and other public internet access points. By contrast, the Trojanised version requires installation on a client PC. Thereafter, the software tracks user activities including keystrokes and websites visited. This data is then uploaded to US-based servers registered to a Saudi Arabian organisation, human rights activist group CitizenLab.org says.

Morgan Marquis-Boire from CitizenLab.org was among the first to publicise the presence of malware in knock-off copies of a tool used by Iranian dissidents and others looking to safeguard their privacy or visit proscribed websites.

Both the Trojanised version of the tool and the real thing connect to a web page that confirms that users are surfing through a proxy. Developers at Simurgh are taking advantage of this behaviour to automatically detect if a surfer is using a Trojanised version of their software before warning them that they are in danger.

Iran's internet censorship regime already blocks access to many foreign websites, social networks and other web services. Attempts to "phish" for social network usernames and passwords have been reported in Syria and Iran, as well as the use of false security certificates. More recently Iran rolled the capability to block https and the ports used by Virtual Private Networks, according to Reporters Without Borders (here).

The web has played a central role in recent campaigns of political dissent inside the country and free expression more generally – hence the ongoing push by the country's rulers to tighten the screws on what its citizens can do online. This has stimulated interest in web proxies, such as Simurgh, designed to circumvent censorship controls, making the appearance of Trojanised versions of the tool all the more dangerous.

"This malware is targeting users for whom having their communications compromised could result in imprisonment or worse," warns Chester Wisniewski, a senior security advisor at Sophos Canada. Wisniewski added that it is "almost always a bad idea" to download and run files from unknown websites, especially files from torrent and file-sharing sites. Computer users would do far better to go to a developer's website for software download instead, he argues.

A blog post by Sophos explained the Trojanised Simurgh threat in greater depth can be found here. ®