July 10, 2019 FinSpy Strikes Again: New Versions for iOS and Android Targeted Surveillance Revealed

Kaspersky experts have uncovered new versions of the advanced malicious surveillance tool FinSpy, which allow attackers to spy on device activities and exfiltrate sensitive data such as GPS location, messages, pictures and calls. The new implants work on both iOS and Android devices and can monitor activity on almost all popular messaging services, including encrypted ones, and hide their traces better than before.

FinSpy is an extremely effective software tool for targeted surveillance that has been observed stealing information from governments, law enforcement organizations and NGOs all over the world. Its operators can tailor the behavior of each malicious FinSpy implant to a specific target or group of targets.

The basic functionality of the malware involves almost unlimited monitoring of the device’s activities. This includes monitoring geolocation, all incoming and outgoing messages, contacts, media stored on the device, and data from popular messaging services like WhatsApp, Facebook messenger or Viber. All the exfiltrated data is transferred to the attacker via SMS messages or the HTTP protocol.

The latest known versions of the malware extend the surveillance functionality to additional messaging services, including those considered ‘secure,’ such as Telegram, Signal and Threema. The malware’s creators are also becoming more adept at covering their tracks. For instance, the iOS malware (targeting iOS 11 and older versions) can now hide signs of jailbreak, while the new version for Android contains an exploit capable of gaining root privileges – almost unlimited, complete access to all files and commands – on an unrooted device.

Based on the information available to Kaspersky, in order to successfully infect both Android and iOS-based devices, attackers need either physical access to the phone or an already jailbroken/rooted device. For jailbroken/rooted phones, there are at least three possible infection vectors: SMS message, email or push notifications.

According to Kaspersky telemetry, several dozen mobile devices have been infected over the past year.

“The developers behind FinSpy constantly monitor security updates for mobile platforms and tend to quickly change their malicious programs to avoid their operation being blocked by fixes,” said Alexey Firsh, security researcher at Kaspersky. “Moreover, they follow trends and implement functionality to exfiltrate data from applications that are currently popular. We observe victims of the FinSpy implants on a daily basis, so it’s worth keeping an eye on the latest platform updates and install them as soon as they are released. Regardless of how secure the apps you use might be, and how protected your data, once the phone is rooted or jailbroken, it is wide open to spying.”

To avoid falling victim to FinSpy, Kaspersky researchers advise the following:

• Secure your smartphone or tablet with a password or PIN, and never leave it unlocked. Do not share the passcode with anyone, even those that you trust.
• Do not jailbreak or root your device, as that will only make an attacker’s job easier.
• Only install mobile applications from official app stores.
• Do not follow suspicious links sent to you from unknown numbers.
• In your device settings, block the installation of programs from unknown sources.
• Never store unfamiliar files or applications on your device, as they could harm your privacy.
• Download a proven security solution for mobile devices, such as Kaspersky Internet Security for Android.

Read the full report on Kaspersky’s latest research into FinSpy on Securelist.

About Kaspersky

Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.