{"id":16160,"date":"2019-07-11T10:52:16","date_gmt":"2019-07-11T14:52:16","guid":{"rendered":"https:\/\/www.kaspersky.co.in\/blog\/finspy-commercial-spyware\/16160\/"},"modified":"2020-04-02T16:07:48","modified_gmt":"2020-04-02T10:37:48","slug":"finspy-commercial-spyware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.in\/blog\/finspy-commercial-spyware\/16160\/","title":{"rendered":"FinSpy \u2014 commercial spyware"},"content":{"rendered":"

What happens when spyware is developed not by underground malware coders, but by a serious IT firm? The result can be a nasty thing like FinSpy (also known as FinFisher), which has been developed and sold perfectly legally for quite some time now. Over the past year, we\u2019ve detected this spyware on dozens of mobile devices.<\/p>\n

What FinSpy gets up to<\/h2>\n

Although a desktop version of the spyware exists (not only for Windows, but also for macOS and Linux), the greatest danger largely comes from mobile implants: FinSpy can be installed on both iOS and Android, with the same set of functions available for each platform. The app gives an attacker almost total control over the data on an infected device.<\/p>\n

The malware can be configured individually for each victim and in such a way that provides the attack mastermind with detailed information about the user, including contacts, call history, geolocation, texts, calendar events, and so on.<\/p>\n

But that\u2019s not all. FinSpy can record voice and VoIP calls, and intercept instant messages. It has the ability to eavesdrop on many communication services\u00a0\u2014 WhatsApp, WeChat, Viber, Skype, Line, Telegram, as well as Signal and Threema. Besides messages, FinSpy extracts files sent and received by victims in messaging apps, as well as data about groups and contacts. More details about FinSpy are available on Securelist<\/a>.<\/p>\n\n

Who should beware of FinSpy<\/h3>\n

Getting infected with FinSpy happens the same as with most types of malware. It\u2019s most often a case of clicking a link in a malicious e-mail or text message.<\/p>\n

Android device owners are traditionally in the risk zone, and if their gadgets are also rooted<\/a>, that greatly facilitates the task of the malware. If, however, the user does not have root access, but a rooting app is installed on the smartphone (as happens when superuser rights are required for installation of some other app), FinSpy can exploit this to obtain the root. Even if a smartphone isn\u2019t rooted, and it has no rooting apps installed, the spyware can get root access using the DirtyCow exploit.<\/p>\n

Apple users have a slightly easier time. The iOS version of the spyware requires a system jailbreak<\/a>. If by some chance the iPhone\/iPad owner already did it, the device can be infected in the same way as an Android gadget. But if not, the attacker needs to gain physical access to the device, jailbreak it manually, and then install FinSpy.<\/p>\n

\"How<\/a><\/p>\n

How to guard against FinSpy<\/h3>\n

To avoid falling victim to FinSpy and similar spyware, you need to follow the standard guidelines:<\/p>\n