F-Secure: security firms should block state malware
F-Secure says state-run spying tools should be included in anti-virus package where possible
Anti-virus companies should spot and block state-sponsored intrusion, according to security company F-Secure.
The company was reacting to revelations that the Egyptian authorities may have purchased and employed a German-made surveillance system to use on its citizens, as suggested in documents taken from former Government buildings.
F-Secure said the documents came from the headquarters of the Egyptian State Security, but admitted they had yet to be confirmed as genuine. The papers suggested the security services had received offers to use a product called FinFinder.
According to Elaman, the German company that makes the suite, FinFinder offers governments a range of tools to tap into user or business computers.
If the US Government would ask us not to detect something and we complied, then what?
Under the heading “Governmental security solutions”, Elaman offers products such as FinSpy, “which guarantees full and real-time remote access and control of the target's computer”, and FinFly, which is “an infection proxy used to deliver intrusion software”.
Whether the Egyptian authorities used the software or not remains unknown, but the possibility raises interesting questions about the independence of security companies and how they should treat states' cyber activity.
Should Government trojans be blocked?
The big question for security companies, claimed F-Secure, is whether these tools should be treated in the same way as general criminal viruses, trojans and other security threats.
“It would be a slippery slope to stop detecting government trojans,” said Mikko Hypponen, chief research officer at F-Secure, on the company blog.
“If the US Government would ask us not to detect something and we complied, then what? Should we avoid detecting hacking software used by goverments ... of which country? Germany? UK? Israel? Egypt? Iran?"
“We are in the business of selling protection," he added. "We're selling products to protect our customers from attack programs - regardless of the source of such programs."
However, because the code for FinFinder and other government-backed trojans are closely-guarded secrets, F-Secure admits it can't currently add them to its list of malware signatures.
“The obvious question here is: do we detect FinFisher? And the answer is: we don't know, as we don't have a sample at hand we could use to confirm this,” said Hypponen.
“It's perfectly possible that we have already received a sample of FinFisher or some similar tools from our customers. However, if that has happened, we have been unable to distinguish them from 'normal' criminal trojans. We don't have any known government intrusion tools in our possession.”