Gamma FinFisher hacked: 40 GB of internal documents and source code published

Re:Gamma FinFisher hacked: 40 GB of internal documents and s... by sbierwagen on Wednesday August 06, 2014 @02:55PM (#8144176)

Which is mostly the point, I guess.

If the feds want to listen in on your calls they have several options:

  1.) Use a 0day exploit in Skype client software.
  2.) Use the LE backdoors on the local machine.
  3.) Install a rooted version of Skype using some other Windows 
      0day or LE backdoor.
  4.) Just record any sound the microphone hears.
  5.) Capture traffic as it travels across the backbone.
  6.) Capture traffic as it travels through Microsoft's 
      central servers.
  7.) Capture traffic at the other end if the callee is using
      an old version of Skype.

Saying "the feds can't spy on you if you use Metro Skype" is in one narrow sense true, and in a wider sense outrageously, mendaciously false. If they can't do #1, they'll do #2-7.

[ Parent | on HN ]

Re:Gamma FinFisher hacked: 40 GB of internal documents and s... by wlesieutre on Wednesday August 06, 2014 @03:08PM (#8144245)

The noise I've heard about FinFisher has been less about its use in Western countries, and more about Gamma selling it to oppressive regimes that use it against protestors.

If your goal is to keep your calls away from Egypt's State Security Investigations Service, by all means use metro Skype. If you're trying to hide from a country with law enforcement access to Skype's backend, then don't. But I don't see what the latter has to do with FinFisher.

As far as recording things from the mic outside of Skype, if FinFisher does that you're probably toast regardless. I haven't dug into the technical details, but I've seen it mentioned that it can deliver arbitrary payloads. Someone who reads through the doc dump will hopefully be able to confirm what exactly they've been doing with it.

[ Parent | on HN ]

Re:Gamma FinFisher hacked: 40 GB of internal documents and s... by x0x0 on Wednesday August 06, 2014 @04:43PM (#8144742)

Yeah, most of this finfisher stuff appears to be for surveillance states (plus assholes like nsa), not real law enforcement. Real cops / fbi can get a warrant and go straight to microsoft who appears to have very good skype capture ability. Why would you screw around with all this nonsense when all it takes is a couple hours of a DAs time to draft a warrant, a trip to see a judge (assuming you have a reasonable cause), then a fax to microsoft? Unless of course the reasonable cause thing is tripping you up...

ps -- that's not to say our governments aren't well aware of what FinFisher is doing. I bet the fastest way to seriously piss nsa/various pigs off is to sell an exploit before sharing it with the US/5 eyes. I mean, they don't "know know", but they know, the same way we know damn well what goes on in extraordinary rendition, though we all run around pretending to be shocked, shocked! that there's torture in egyptian prisons...

[ Parent | on HN ]