Because so many countries are starting to censor what their citizens can access on the internet, or ban websites from being seen entirely, citizens have found a way to access those sites through a program known as Green Simurgh.

According to ComputerWorld, “Green Simurgh is an anti-censorship application that routes a computer’s outbound connections to a server located in the U.S. This allows the software’s users to bypass network filters and access Internet resources that would normally be banned by their ISP. Green Simurgh doesn’t require any installation and can run directly from USB memory sticks, which makes it suitable for users who access the Internet from cafes and public computers.”

Unfortunately for users however, several copies of Green Simurgh that have been distributed have been found to have a Trojan horse and malware that reveals the internet user’s each and every keystroke they make. According to a University of Toronto laboratory, Citizen Lab (known for its specialization in researching digital media, human rights and global security), the software has been used in Iran since 2009 and Syrian users have also begun to rely on it.

“It has recently come to our attention that this software is being recommended and circulated among Syrian Internet users for bypassing censorship in their country,” said Citizen Lab technical adviser Morgan Marquis-Boire in a blog post on Friday. “This information led to the discovery and analysis of a back-doored version of this software.”

The malicious version of Green Simurgh comes in a package Simurgh-setup.zip from file sharing websites, one of which is 4shared.com.

Chester Wisniewski, a senior security adviser at antivirus vendor Sophos explains how users were convinced to use the malware version of Green Simurgh:

“When run on a Windows machine, the rogue installer drops a legitimate copy of the Green Simurgh software in the Program Files directory, but also installs a computer Trojan horse that runs in the background. [The Trojan horse] keeps a log of your username, machine name, every window clicked and keystroke entered,” he said.

 ”It attempts to submit these logs to some servers located in the United States, but registered to an entity that appears to be based in Saudi Arabia. Considering that thousands of users depend on the legitimate Simurgh software, it’s likely that a lot more people have been impacted by this malware than by Flame — a recently discovered cyber espionage threat that has received a lot of attention in the media.”

The creators of Green Simurgh have sent out a warning on their website to their users regarding the malware software, and for future users to only download the software directly from the Simurgh website itself. For those who have already been infected, the company recommends to run an anti-virus program and remove the program immediately.

Share This

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

About the author

Elizabeth Lowry
Elizabeth graduated from the E.W. Scripps School of Journalism at Ohio University with her specialization in Broadcast News as well as a minor in business and psychology. She enjoys writing, reading and researching about humanitarian affairs, health & fitness, fashion and sports. In her free time she enjoys working out, traveling and exploring different cultures, trying new things and spending time with her Chocolate Lab.