Publication Details
Title: When Governments Hack Opponents: A Look at Actors and Technology
Author: W. R. Marczak, J. Scott-Railton, M. Marquis-Boire, and V. Paxson
Bibliographic Information: Proceedings of the 23rd USENIX Security Symposium, San Diego, California
Date: August 2014
Research Area: Networking and Security
Type: Article in conference proceedings
PDF: [Not available online]
Overview:
Repressive nation-states have long monitored telecommunications to keep tabs on political dissent. The Internet and online social networks, however, pose novel technical challenges to this practice, even as they open up new domains for surveillance. We analyze an extensive collection of suspicious files and links targeting activists, opposition members, and non- governmental organizations in the Middle East over the past several years. We find that these artifacts reflect efforts to attack targets’ devices for the purposes of eavesdropping, stealing information, and/or unmasking anonymous users. We describe attack campaigns we have observed in Bahrain, Syria, and the United Arab Emirates, investigating attackers, tools, and techniques. In addition to off-the-shelf remote access trojans and the use of third-party IP-tracking services, we identify commercial spyware marketed exclusively to governments, including Gamma’s FinSpy and Hacking Team’s Remote Control System (RCS). We describe their use in Bahrain and the UAE, and map out the potential broader scope of this activity by conducting global scans of the corresponding command-and-control (C&C) servers. Finally, we frame the real-world consequences of these campaigns via strong circumstantial evidence linking hacking to arrests, interrogations, and imprisonment.
Acknowledgements:
This work was partially supported by funding provided to ICSI through National Science Foundation grants CNS : 1223717 (“Censorship Counterstrike via Measurement, Filtering, Evasion, and Protocol Enhancement”) and CNS : 1237265 (``Beyond Technical Security: Developing an Empirical Basis for Socio-Economic Perspectives"). Additional funding was provided through a Citizen Lab Fellowship. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors or originators and do not necessarily reflect the views of the National Science Foundation or the Citizen Lab.
Bibliographic Reference:
W. R. Marczak, J. Scott-Railton, M. Marquis-Boire, and V. Paxson. When Governments Hack Opponents: A Look at Actors and Technology. Proceedings of the 23rd USENIX Security Symposium, San Diego, California, August 2014
Author: W. R. Marczak, J. Scott-Railton, M. Marquis-Boire, and V. Paxson
Bibliographic Information: Proceedings of the 23rd USENIX Security Symposium, San Diego, California
Date: August 2014
Research Area: Networking and Security
Type: Article in conference proceedings
PDF: [Not available online]
Overview:
Repressive nation-states have long monitored telecommunications to keep tabs on political dissent. The Internet and online social networks, however, pose novel technical challenges to this practice, even as they open up new domains for surveillance. We analyze an extensive collection of suspicious files and links targeting activists, opposition members, and non- governmental organizations in the Middle East over the past several years. We find that these artifacts reflect efforts to attack targets’ devices for the purposes of eavesdropping, stealing information, and/or unmasking anonymous users. We describe attack campaigns we have observed in Bahrain, Syria, and the United Arab Emirates, investigating attackers, tools, and techniques. In addition to off-the-shelf remote access trojans and the use of third-party IP-tracking services, we identify commercial spyware marketed exclusively to governments, including Gamma’s FinSpy and Hacking Team’s Remote Control System (RCS). We describe their use in Bahrain and the UAE, and map out the potential broader scope of this activity by conducting global scans of the corresponding command-and-control (C&C) servers. Finally, we frame the real-world consequences of these campaigns via strong circumstantial evidence linking hacking to arrests, interrogations, and imprisonment.
Acknowledgements:
This work was partially supported by funding provided to ICSI through National Science Foundation grants CNS : 1223717 (“Censorship Counterstrike via Measurement, Filtering, Evasion, and Protocol Enhancement”) and CNS : 1237265 (``Beyond Technical Security: Developing an Empirical Basis for Socio-Economic Perspectives"). Additional funding was provided through a Citizen Lab Fellowship. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors or originators and do not necessarily reflect the views of the National Science Foundation or the Citizen Lab.
Bibliographic Reference:
W. R. Marczak, J. Scott-Railton, M. Marquis-Boire, and V. Paxson. When Governments Hack Opponents: A Look at Actors and Technology. Proceedings of the 23rd USENIX Security Symposium, San Diego, California, August 2014