Spyware Company That Said It Would Leave Spyware World Shows Up At Arms Fair

Credit to Author: Lorenzo Franceschi-Bicchierai| Date: Mon, 18 Sep 2017 13:00:00 +0000

In the unregulated, digital weapons gold rush, it looks like old habits die hard.

Last year, Motherboard published some pages of a leaked catalog offering governments sketchy services such as “weaponized information” to infiltrate, “ruse,” and “sting,” with the goal to discredit a target or a company—basically astroturfing, disinformation campaigns. The catalog, prepared by the little-known Indian-based vendor Aglaya, also offered distributed denial-of-service or DDoS as a service, and a wide range of other more commonplace products such as computer and smartphone spyware, or alleged industrial control systems exploits.

Read more: The Forgotten Prisoner of a Spyware Deal Gone Wrong

When we exposed the catalog and inquired about it, Aglaya’s founder and CEO Ankur Srivastava had a puzzling response. These offerings, he said, don’t “represent the vision of our product portfolio.” Srivastava said the products were only a “custom proposal for one customer,” and not something that was advertised on the company’s site or actually sold to any customer. And, moreover, they were outdated information anyway, since “we are not a part of this market and unintentionally underwent a marketing event at the wrong trade-show,” Srivastava told me over email.

And yet, one year later, Aglaya is advertising some of the same products at the arms fair Defence and Security Equipment International (DSEI), which closes on Friday in London.

Independent investigative journalist Matt Kennard spotted Aglaya as he was walking the show’s aisles, peddling its wares with a big “CYBER WARFARE” sign in front of its booth with a camping chair and a few signs.

Funnily, Aglaya was advertising a tool to detect cellphone tracking devices called “rouge [sic] base station catcher,” misspelling rogue. Last year, in my email correspondence with Srivastava, he also misspelled rogue the same exact way.

In case you think this might be a different Aglaya, the address it advertised in the DSEI brochure (pictured below), is the same one that was included in another catalog published online. (DSEI did not respond to my request for comment via email on Aglaya’s presence at the fair.)

At this point, it’s unclear how successful Aglaya is in the crowded market of surveillance tech for governments, where well-known and long-established players like Hacking Team, FinFisher, and NSO Group compete with upstarts such as Aglaya, GR Sistemi, Wolf Intelligence, or RCS Lab.

There is some evidence that Aglaya has some real products. Forbes‘ reporter Thomas Fox-Brewster and security researcher Morgan Marquis-Boire obtained last year some samples of Aglaya’s Android and BlackBerry malware. Moreover, the company has two apps that claim to offer secure encrypted chat on the Google Play store.

No one knows, however, who its customers are. I tried to contact Srivastava but my email to him bounced back.

Get six of our favorite Motherboard stories every day by signing up for our newsletter.

https://motherboard.vice.com/en_us/rss