Researchers have uncovered a nefarious but comically incompetent spyware campaign that’s targeting Ethiopian dissidents in the US, UK, and other countries.
A report published Wednesday morning by the University of Toronto’s Citizen Lab said the campaign, which has operated for at least 14 months, is carried out using hacking tools sold by Cyberbit, a wholly owned subsidiary of Elbit Systems, an Israeli company whose shares are sold on the Nasdaq stock exchange. Log files left unprotected on the Internet showed people inside Ethiopia using the spyware in an attempt to surreptitiously surveil journalists, researchers, and activists in 20 countries.
The report is the latest to expose the shady world of commercial spyware, which often sells potent hacking tools to countries with known human rights abuses. Previous companies caught selling surveillance wares to rogue nations include UK-based Gamma Group, Italy-based Hacking Team, and NSO Group of Israel. Use of Elbit-owned Cyberbit tools to spy on Ethiopian dissidents all but confirms the Israeli company does the same thing.
In Wednesday’s report, Citizen Lab researchers wrote:
As a provider of powerful surveillance technology, Cyberbit has the responsibility under both Israel’s export control regime as well as the UN Guiding Principles on Business and Human Rights to concern itself with the potential for human rights abuses facilitated through use of its product. The fact that PSS wound up in the hands of Ethiopian government agencies, which for many years have demonstrably misused spyware to target civil society, raises urgent questions around Cyberbit’s corporate social responsibility and due diligence efforts, and the effectiveness of Israel’s export controls in preventing human rights abuses.
Confidential video made public
In October 2016, Ethiopian activist Jawar Mohammed received an email asking for comment on a video posted to a page that impersonated a legitimate video website in Eritrea, a country that borders Ethiopia. Code hosted on the page checked to see if Windows computers used an outdated version of Adobe’s Flash Player. If it did, the page redirected the browser to a page on getadobeplayer[.]com, which offered a genuine Flash update that was bundled with spyware called PC Surveillance System from Cyberbit. Mohammed forwarded the email to Citizen Lab, which has monitored the campaign for more than a year. Other targets included a US-based media outlet that serves Oromo people, a PhD student and a lawyer who have both worked on Oromo issues, and Citizen Lab Research Fellow Bill Marczak.
Loading comments...
