Teaching Comparative Government and Politics

Thursday, May 31, 2012

Spying on dissidents' computers

The media have widely reported on apparent efforts to spy on the computer activities of Iranian officials. But the BBC reports that it appears that the Iranian government has been doing the same thing in order to learn what political dissidents have been doing.

Trojan targets Iranian and Syrian dissidents via proxy tool

Web users in Iran and Syria aiming to circumvent censorship controls are being targeted with spyware, according to security researchers.

A team at the University of Toronto said installation software for the popular proxy tool Simurgh also implanted keylogging spyware.

Simurgh is designed to anonymise net use and allow access to blocked sites.

However, an added Trojan is said to send data from victims' PCs to a site registered with a Saudi Arabian ISP.

This can include the computer operator's username and machine name, as well as every window clicked and every keystroke entered…
"This Trojan has been specifically crafted to target people attempting to evade government censorship," he added…

The news comes as investigators probe a malware attack - dubbed Flame - found to have infected computers in Iran and other parts of the Middle East, which is thought to have been designed to steal sensitive data.

However, Sophos suggested that the the Simurgh Trojan was likely to have compromised more computers.

"Unlike Flame, which is highly targeted malware that has only been found on a handful of computers globally, this malware is targeting users for whom having their communications compromised could result in imprisonment or worse," wrote Chester Wisniewski, senior security advisor at Sophos, on his company's blog.