Attacks/Breaches

7/15/2015
05:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

4 Lasting Impacts Of The Hacking Team Leaks

Doxing attack against Italian surveillance company put some nasty tools in the hands of attackers and might be the final nail in the coffin for Adobe Flash.

It's a sprint between criminals and security researchers to see who can find vulnerabilities and attack tools hidden in the leaked Hacking Team files fastest. Adobe and Microsoft are scrambling to keep up, but these are just some of the immediate concerns.

So what will the long-term impacts be of the doxing attack on the Italian surveillance company?   

 

1. The Death of Flash?

Tuesday, Adobe was forced to patch two more critical zero-day vulnerabilities discovered in the leaked Hacking Team files, CVE-2015-5122 and CVE-2015-5123. Both (like CVE-2015-5119 last week) are use-after-free vulnerabilities that allow for remote code execution. The 5122 bug was being exploited in the Angler exploit kit within a matter of hours, according to security researcher Kafeine, and has since shown up in the Neutrino, RIG, and Magnitude exploit kits.

Adobe Flash has been riddled with critical vulnerabilities in the past year, causing some to say it's time for Flash to retire. However, the Flash vulnerabilities revealed in the Hacking Team breach have pushed from commentary to action.

Mozilla on Monday began preventing Flash from running by default in Firefox. Then on Tuesday, Mozilla temporarily blocked Flash altogether while waiting for Adobe to release patches for the latest vulnerabilities to come out of the leaked Hacking Team files.

US-CERT today updated an advisory (originally released Tuesday) about these vulnerabilities. Not only does the advisory say to prioritize security updates for the affected software, it also says to "limit Flash content" and that "updating is not sufficient, and it is important to use exploit mitigation and other defensive techniques."

And on Sunday, Facebook's security chief Alex Stamos tweeted: "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day."

2. More Sophisticated Tools In Hands Of More Attackers

The CVE-2015-5119 Flash vulnerability was used by the APT3 (a.k.a. UPS) advanced persistent threat actor in a targeted attack against the US government last week, according to Palo Alto Networks.

It isn't just the vulnerabilities that are the problem, though; it's the surveillance software Hacking Team sold to its customers -- which is, as Adam McNeil of Malwarebytes wrote, "basically nothing more than a Remote Access Trojan," like Zeus or AlienSpy.

The source code for Hacking Team's flagship product, Remote Control System (RCS), was leaked in the attack, and Malwarebytes researchers took a closer look at it. "RCS is feature-rich with surveillance capabilities and can collect or monitor most components on a personal computer or cell phone," wrote McNeil. "The software has the ability to exploit systems, execute code, destroy files, and monitor an array of peripherals, applications, and communications." 

Meanwhile, Hacking Team CEO David Vincenzetti told reporters today that "Only a part of the source code has been stolen," softening his initial, much more dire account of the attack.

RCS works on Windows, OSX, Linux, Android, Blackberry, iOS, Symbian, and Windows Phones and comes with all the typical RAT tools, like keyloggers and screenshot grabbers. It also uses anti-analysis methods. And according to McNeil, its management software is hidden behind a chain of anonymizers.

The cloaking and persistence mechanisms are impressive. According to Trend Micro Labs, RCS comes equipped with a UEFI BIOS rootkit -- and even reformatting the infected machine or replacing the disk wouldn't remove the infection.

Further, according to Malwarebytes, Hacking Team claimed that the exploit portal would always contain at least three zero-days at any time.

On the black market, any of these tools would come at a very high price and require a base level of technical knowledge to operate (except, perhaps, for the Blackshades RAT, which was ultimately undone by its own user-friendliness). However, the Hacking Team breach has not only brought the masses this tradecraft for free, it also provided extensive documentation and how-to manuals to make it easier for their customers to use the tools Hacking Team sold.

3. Secret Bitcoin Transactions Not So Secret

In the RCS 9.2 upgrade, Hacking Team added its "Money Module," which could track cryptocurrencies like Bitcoin, and according to leaked emails "is able to collect various information: list of contacts and local accounts, wallet (i.e., the money) and the history of transactions."

Money Module has been available since January 2014.

4. Greater Concern About Government Interference With Privacy Controls

Numbered among Hacking Team's customers was the FBI. Today, it was revealed that the Bureau had enlisted the Italian company's aid in uncovering the true identity of a user of the TOR anonymization service.

Not only has the breach shown that the government is using a tool being equated to a malicious RAT, but that governments of countries with histories of significant human rights abuses -- including Egypt, Sudan, Russia, and Ethiopia -- have been sold the very same tools. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
rrahmanov
50%
50%
rrahmanov,
User Rank: Apprentice
7/20/2015 | 3:29:37 PM
Re: This may be the final straw for Flash
Yea, that is all valid. But how do you see the death of the such an integral part of the web these days, even a slow death? There are so many objects that rely on flash like different variations of online media players, web page content representation and etc. And if we assume that Adobe "retires" Flash, it sure won't be graceful as it would keep being patched for years. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:12:48 PM
Death of flash
 

Is actual a good news. We do not have to go tough the problems coming from this tool. Most site shave moved to HTML5 anyway, it is time to get rid of it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:12:18 PM
Re: Here's another instance where Steve Jobs was right about something...
Steve jobs was more focused on Apple's competitive advantage and flash's resource hug problem of the flash. He did not really know all the vulnerabilities we are facing now.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:09:09 PM
Re: This may be the final straw for Flash
Flash has always been the problem, not only vulnerabilities but also the fact that it requires high level of resources to run. That is why we do not have it in iOS.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:04:38 PM
Monitoring citizens
We all know that all the countries monitor their own citizens. That is the main reason why most governments in most countries never privatize telecom industry to avoid losing control over the monitoring systems. 
Anna C
50%
50%
Anna C,
User Rank: Author
7/17/2015 | 4:29:35 PM
Here's another instance where Steve Jobs was right about something...
It's been over 5 years since Jobs went the HTML5 route with Apple products instead of Flash. Wow, it's been that long before the security issues have finally caught up with Flash...

Thanks for an insightful summary of the Hacking Team breach and its implications. 
LanceCottrell
100%
0%
LanceCottrell,
User Rank: Author
7/16/2015 | 6:07:11 PM
This may be the final straw for Flash
These latest Flash vulnerabilities do seem to be the final straw shifing the momentum more strongly against Flash.

Thanks for the concise analysis of the implications of the Hacking Team leaks.
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Privacy Ops: The New Nexus for CISOs & DPOs
Amit Ashbel, Security Evangelist, Cognigo,  2/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8955
PUBLISHED: 2019-02-21
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.
CVE-2019-1698
PUBLISHED: 2019-02-21
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External E...
CVE-2019-1700
PUBLISHED: 2019-02-21
A vulnerability in field-programmable gate array (FPGA) ingress buffer management for the Cisco Firepower 9000 Series with the Cisco Firepower 2-port 100G double-width network module (PID: FPR9K-DNM-2X100G) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) conditio...
CVE-2019-6340
PUBLISHED: 2019-02-21
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RE...
CVE-2019-8996
PUBLISHED: 2019-02-21
In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow.