Surveillance Malware Hides as Legit Software

Tuesday, December 2, 2014 @ 04:12 PM gHale

A variant of the Remote Control System (RCS) malware developed by an Italian company called Hacking Team appears to be a bookmark management application called Linkman, but is really surveillance malware.

Detekt tool, launched last week to help users scan their computers for commercial spyware used by governments, led to the discovery of previously unknown malware variants, according to security researcher Claudio Guarnieri, who led development for the security app.

RELATED STORIES
Regin: ‘Complex Software’
Updated Malware Boosts Espionage Tool
Espionage Program 10 Years Old
Tool to Spy on Bad Guys

RCS ends up sold to law enforcement and other government agencies around the world as a tool for legitimate computer surveillance. Hacking Team said it screens its customers, but other published reports said the tool has seen action in countries with human rights issues.
https://citizenlab.org/2014/02/mapping-hacking-teams-untraceable-spyware/

It’s not clear how the new RCS sample ended up distributed to users, but it used the Linkman icon and product name, Guarnieri said.

Outertech, the German software firm that develops the real Linkman program, pointed out the RCS sample ended up signed with a digital certificate issued to an entity called Jagdeependra, while its legitimate application uses a certificate issued to Outertech.

“Please make sure the publisher is Outertech when installing Linkman,” the company said. “It’s best you download Outertech products directly from http://outertech.com to make sure you get clean files.”

The new RCS sample uploaded to the online scanning website VirusTotal and as of Monday two of the 54 supported antivirus engines detected it as malicious.

Antivirus company Bitdefender found three files in its database signed with the Jagdeependra digital certificate, which the issuing certificate authority, Comodo, has revoked.

One of those files is different than the one announced by Guarnieri, but also uses the Linkman product name and icon. The sample has been in Bitdefender’s database since Oct. 14, suggesting the effort to pass off RCS as Outertech Linkman is over a month old.



Leave a Reply

You must be logged in to post a comment.