FinFisher, a surveillance spyware, has boosted its arsenal with deployment of UEFI (Unified Extensible Firmware Interface) bootkit to infect computers without being detected by security solutions.
The UEFI bootkit is software that loads before the operating system launches.
Kaspersky researchers revealed that its latest investigation into FinFisher, which took eight months to complete, had uncovered four-layer obfuscation and advanced anti-analysis measures employed by the spyware’s developers, as well as the employment of a UEFI bootkit to infect victims.
The findings suggest high emphasis on defense evasion, making FinFisher one of the hardest-to-detect spywares to date.
The comprehensive investigation by the Russian cybersecurity firm was conducted into all the recent updates on FinSpy spyware for Windows, Mac OS, Linux and its installers.
FinFisher, also known as FinSpy or Wingbird, is a surveillance spyware tool which Kaspersky has been tracking since 2011.
The spyware is capable of gathering various credentials, file listings and deleted files, as well as various documents, livestreaming or recording data; and gaining access to a webcam and microphone. Its Windows implants were detected and researched several times up to 2018 when FinFisher appeared to have gone under the radar.
Kaspersky solutions detected suspicious installers of legitimate applications such as TeamViewer, VLC Media Player and WinRAR, which contained malicious code that could not be connected to any known malware.
The firm then discovered a website in Burmese that contained the infected installers and samples of FinFisher for Android, helping to identify they were Trojanized with the same spyware. This discovery pushed Kaspersky researchers to investigate FinFisher further.
Unlike previous versions of the spyware, which contained the Trojan in the infected application at once, new samples were protected by two components: non-persistent pre-validator and a post-validator.
The first component runs multiple security checks to ensure that the device it is infecting does not belong to a security researcher. Only when the checks pass, is the post-validator component provided by the server. This component ensures that the infected victim is the intended one. Only then would the server command deployment of the full-fledged Trojan platform.
FinFisher is heavily obfuscated with four complex custom-made obfuscators. The primary function of this obfuscation is to slow down the analysis of the spyware. On top of that, the Trojan also employs peculiar ways to gather information. For instance, it uses the developers’ mode in browsers to intercept traffic protected with a HTTPS protocol.
The researchers also discovered a sample of FinFisher that replaced the Windows UEFI bootloader – a component that launches the operating system after firmware launch along with a malicious one.
This way of infection allowed the attackers to install a bootkit without the need to bypass firmware security checks. UEFI infections are very rare and generally hard to execute, they stand out due to their evasiveness and persistence. While in this case the attackers did not infect the UEFI firmware itself, but its next boot stage, the attack was particularly stealthy as the malicious module was installed on a separate partition and could control the boot process of the infected machine.
Igor Kuznetsov, principal security researcher at Kaspersky’s Global Research and Analysis Team (GReAT) said the amount of work put into making FinFisher inaccessible to security researchers was worrisome and impressive.
“It seems like the developers put at least as much work into obfuscation and anti-analysis measures as in the Trojan itself. As a result, its capabilities to evade any detection and analysis make this spyware particularly hard to track and detect,” he said.
“The fact that this spyware is deployed with high precision and is practically impossible to analyze also means that its victims are especially vulnerable, and researchers face a special challenge – having to invest an overwhelming amount of resources into untangling each and every sample.
“I believe complex threats such as FinFisher demonstrate the importance for security researchers to cooperate and exchange knowledge as well as invest in new types of security solutions that can combat such threats,” he added.
To protect against threats such as FinFisher, Kaspersky recommends to:
- Download apps and programs from trusted websites.
- Update the operating system and all software regularly.
- Distrust e-mail attachments by default.
- Avoid installing software from unknown sources as it may and often does, contain malicious files.
- Use a strong security solution on all computers and mobile devices.
