Apparently, GhostSec exposed 20GB of data that involved source code relating to face recognition and motion detection systems of the Iranian software company – Fanap – which is appointed as a comprehensive surveillance system by the Iranian government, monitoring its citizens.
Following the confirmation, GhostSec revealed the intentions of making the data public and has also made a telegram channel ‘Iran Exposed’ to share further information about the breach. It says it is planning to share pieces of the Behnama code, along with various components including configuration files and API data, and that after all the data has been uploaded, detailed explanations will be given.
"This is not about technology and software, it's about the privacy of the people, civil liberties and a balance of power[…]Also publishing the source code for the public presenting this Fanap's lovely AI face recognition and various other privacy invading features and tools. We're simply making the fight a bit more equal," says GhostSec.
The group claims to have found equipment for facial recognition-based video surveillance, utilized in the Pasargad Bank Car GPS and tracking system, as well as a car numberplate identification system—which may have an impact on hijab alerts—and a facial recognition system used for producing ID cards.
Additionally, it claims that the Single Sign-On (SSO) platform, which the regime uses for online user authentication, is connected to the Fanap system. According to cybersecurity firm Cyberint, "This integration compiles intricate aspects of citizens’ lives, not only to determine access privileges for services but also to construct a virtual profile for facial recognition.”
"The group maintains that this evaluation is rooted in the software code, substantiating indisputable evidence of the software’s capabilities and deployment," adds Cyberint.
GhostSec initially claimed responsibility for taking down the fanap-infra.com website but later disclosed that a different website connected to the Fanap software company was only accessible within Iran. In addition, the company's primary GitHub repository was made private, probably in response to the GhostSec attack. "That mean[s], they are scared. That mean[s] it's time to hit harder," GhostSec said.