Privacy Groups Release 'Detekt' Tool to Spot Spyware

Privacy advocates jointly announced the release of a free malware detection tool meant to help human rights activists, journalists, and others thwart surveillance malware.

The tool, known as Detekt, was developed by Claudio Guarnieri. It was released Thursday in partnership with Amnesty International, Digitale Gesellschaft, Privacy International, and the Electronic Frontier Foundation. Detekt works by scanning computers for predefined patterns that have been linked to remote access Trojans such as DarkComet, FinFisher (FinSpy), njRAT, and Gh0st RAT.

Though some of those tools have been used by cybercriminals, others, such as FinFisher and Hacking Team's Remote Control System (RCS) tool, have been linked to various cyber espionage campaigns by governments.

"Recent years have seen a boom in the adoption of surveillance technology by governments around the world, including spyware that provides its purchasers the unchecked ability to target remote Internet users' computers, to read their personal emails, listen in on private audio calls, record keystrokes and passwords, and remotely activate their computer's camera or microphone," blogs Eva Galperin, global policy analyst at the Electronic Frontier Foundation (EFF). "EFF, together with Amnesty International, Digitale Gesellschaft, and Privacy International have all had experience assisting journalists and activists who have faced the illegitimate use of such software in defiance of accepted international human rights law."

That, she writes, is why the EFF got behind Detekt.

"Some of the software used by states against innocent citizens is widely available on the Internet, while more sophisticated alternatives are made and sold by private companies and sold to governments everywhere from the United States and Europe to Ethiopia and Vietnam," she writes. "Detekt makes it easy for at-risk users to check their PCs for possible infection by this spyware, which often goes undetected by existing commercial anti-virus products."

Detekt is a Python tool that relies on Yara, Volatility, and Winpmem to scan the memory of a running Windows system. It currently supports Windows XP to Windows 8, both 32- and 64-bit, and Windows 8.1 32-bit.

"Because Detekt is a best-effort tool and spyware companies make frequent changes to their software to avoid detection, users should keep in mind that Detekt cannot conclusively guarantee that your computer is not compromised by the spyware it aims to detect," writes Galperin. "However, we hope that the availability of this tool will help us to detect some ongoing infections, provide advice to infected users, and contribute to the debate around curbing the use of government spyware in countries where it is linked to human rights abuses."

Before launching the tool, users should close all applications and make sure the computer is disconnected from the Internet. If spyware is detected, users are advised not to reconnect the computer to the Internet until the machine has been cleaned.

Michael Sutton, vice president of security research for Zscaler, says that in today's world, spyware is not only used by cyber criminals.

"For those concerned that they may be the target of such surveillance, it offers another tool to assist in determining if their PC has been infected," says Sutton. "It will, however, suffer from the same limitations as antivirus products in that it is signature-based and must therefore try and identify known patterns in previously observed binaries. Given that the goal of those leveraging the spyware in the first place is to remain undetected, there's little doubt that they will adapt and start to develop spyware variants specifically not identified by Detekt. For those seeking absolute assurance that they are not under surveillance, Detekt will fall short, but it does offer a free option for those seeking at least basic assurances that they aren't being targeted."