Spy code creator kills project after Syrian abuse

BBC News, 10 July 2012

Related Stories 

• Syrian activists hit by virus
• Spyware targets Iran's dissidents
• US probes Syria's web block kit

Opponents of the government in Syria
have  been spied on using many
different hi-tech tools

Widely used security software has been discontinued after its creator discovered the Syrian government was using it to spy on its opponents.

The "disgusting" way the DarkComet Remote Admin Tool (Rat) was being used in Syria had led to its production being halted, said Jean-Pierre Lesueur.

He said his intention had only ever been to produce tools that were better than those commercially available.

Experts welcomed DarkComet's demise, saying the Rat was being widely abused.

Syria's use of the tool emerged earlier this year as the government sought to keep tabs on opponents in the country's ongoing civil conflict.

Once DarkComet is installed on a target PC it allows remote access to that machine and can log any activity on it.

The Syrian government attempted to use this function of the Rat by trying to trick its opponents into opening a booby-trapped Skype chat message.

In a message posted to the DarkComet website, Mr Lesueur said he was ending the project after four years of work because of the widespread "misuse of the tool".

He said it was never his intention for the tool to be used by hacker groups and he did not want to be held responsible for what people, and governments, had done with DarkComet.

Mr Lesueur said he would continue working in computer security but only on projects that could not be turned to malicious ends.

Rat poison

The decision to shut down DarkComet means there will be no future versions, but nothing has been done to remove copies of the programs already in use.

Rik Ferguson, director of security research in Europe for Trend Micro, said he and many other professionals had used DarkComet for penetration testing and malware detection but not as a management tool.

However, he said, the overwhelming use of DarkComet was by those with malicious or dubious intentions. He said some of the tool's menu items and functions made it hard to believe it was intended entirely for legitimate use.

"It was no surprise to hear of the Syrian regime using this Rat to spy on their population," Mr Ferguson told the BBC. "It follows in the grand tradition of using Rats in targeted, politically motivated attacks such as LuckyCat, Gh0stnet and Shadownet."

He added: "It's not often you can welcome the demise of anything, however, let's hope DarkComet is only the first Rat to take the poison."