Attacks/Breaches

7/6/2015
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Italian Surveillance Software Maker Falls Victim To Doxing Attack

Milan-based Hacking Team tells customers to stop using its products after leaked documents reveal the product's source code and the company's history of selling to governments with records of human rights abuses.

Source code for the Remote Control System (RCS) surveillance software as well as details of the international government agencies that purchased it were revealed today in an apparent doxing attack on Hacking Team, the Milan-based makers of RCS.

The dumped data revealed that Hacking Team had sold its products to several countries with poor human rights records, as well as to the FBI and U.S. Drug Enforcement Administration (DEA). Unnamed sources told Motherboard that Hacking Team has told customers to suspend use of the software, of which the newest version is named Galileo, and was previously known as Da Vinci.

In total, attackers uploaded to BitTorrent 400 gigabytes of data (and might have stolen as much as a terabyte), which also included internal documents, audio recordings, email correspondence, and employee passwords. One of the leaked files was a PowerPoint presentation explaining how the company was able to intercept communications on the Tor network, which is supposed to be anonymous. One of the leaked files was a spreadsheet, from the end of 2014, of active and inactive clients. Among those clients were police and state agencies in nations with records of human rights abuses, including Russia, Egypt, Sudan, Ethiopia, Kazakhstan, Morocco, Nigeria, and Saudi Arabia.

The attackers also hijacked Hacking Team's Twitter account, posting "Since we have nothing to hide, we're publishing all our emails, files and source code." Tweets posted by the attackers have been deleted, but the account appears to still be active as of publishing time.

Motherboard's anonymous source says the attacker seems to have compromised the client machines of two of Hacking Team's system administrators, who had complete access to the company's files. While the company has asked customers to suspend use of the product, the source said "The company, in fact, has 'a backdoor' into every customer’s software, giving it ability to suspend it or shut it down—something that even customers aren’t told about."

[Human rights are closely intertwined with Internet freedom, privacy, and encryption -- all of which are at risk. Learn more next month at Black Hat Las Vegas in sessions like "The Lifecycle of a Revolution", with Jennifer Granick of the Stanford Center for Internet and Society, "The Battle For Free Speech on the Internet," with Matthew Prince of Cloudflare, and "The NSA Playset: A Year of Toys and Tools," with Michael Ossmann of Great Scott Gadgets.]

Some are comparing this event to another recent attack against a cybersecurity company: the Duqu 2.0 nation-state attacks against Kaspersky Lab. Most are focusing on the evidence the attackers have provided for prior accusations about Hacking Team's lack of ethics when it comes to selling its product.

As Electronic Frontier Foundation (EFF) global policy analyst Eva Galperin said on Twitter, "Thank you, Anti-Surveillance Santa, for bringing me so many leaked files for Anti-Surveillance Christmas. I have been very good this year."

[Galperin's colleague, EFF legislative analyst Mark Jaycox, and Jamil Jaffer, senior Senate staffer and adjunct professor of law at George Mason University, will be investigating the topic of surveillance at Black Hat next month in their session, "Is the NSA Still Listening to Your Phone Calls? A Surveillance Debate: Congressional Success or Epic Fail."]

Hacking Team says, "We provide our software only to governments or government agencies. We do not sell products to individuals or private businesses. We do not sell products to governments or to countries blacklisted by the U.S., E.U., U.N., NATO or ASEAN." Yet, it has been suspected of breaking that last rule before. Reporters Without Borders added the company to its "Enemies of the Internet" list in 2012.

The RCS product is essentially spyware. The company itself describes RCS as "a solution designed to evade encryption by means of an agent directly installed on the device to monitor. Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."

Some of the governments listed in Hacking Team's purported customer list are given scathing reviews in the United Nations' Human Rights Watch 2015 World Report. For example, the report says that Egypt is in a "human rights crisis, the most serious in the country’s modern history" and described how "security forces and an increasingly politicized judiciary ... invoked national security to muzzle nearly all dissent." The report states "Sudan saw no progress in its abysmal rights record ... and authorities continued to stifle civil society and independent media." As for Russia, it states "The Kremlin took another leap backward in 2014 by intensifying its crackdown on civil society, media, and the Internet."

Great Cannon

Then there's China, which has developed its own surveillance tool, the Great Cannon.

"You hear about China and cyber espionage, [organizations] getting breached, but no one really talks too often about other things they are doing that are really outlandish, like the redirection of traffic to block things" that are counter to the Chinese government regime, Adam Meyers, vice president of intelligence at CrowdStrike told Dark Reading.

"The Chinese have basically taken a lot of DNS traffic generated by the Great Firewall," he says. The massive, five-day distributed denial-of-service attack earlier this year on Github was an example where China employed its Great Cannon to block Chinese citizens from accessing a tool housed there for bypassing the Great Firewall. "That was a pretty aggressive move on the part of China."

So when a Chinese citizen tries to visit a site that the Chinese government doesn’t approve of, it redirects the traffic. "They are redirecting traffic and attacking [sites] that are not in line with" the government’s views, he says.

"It’s not really an espionage tool. But it could be a smokescreen for a broader espionage campaign, possibly," Meyers says of China's Great Cannon.

Meyers says CrowdStrike’s senior intel analyst Adam Kozy and junior researcher Johannes Gilger, in their Black Hat talk next month will reveal both technical and cultural aspects of China's Great Cannon. 

Kelly Jackson Higgins contributed to this article.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Whoopty
100%
0%
Whoopty,
User Rank: Ninja
7/7/2015 | 7:01:30 AM
Good, but...
As much as I'm pleased that Hacking Team's dirty laundry has been aired here, anyone annoyed by what its done should direct their anger equally to US and British intelligence agencies, which have been doing the same sort of spying on their own citizens for the better part of a decade at this point. 
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10727
PUBLISHED: 2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive ...
CVE-2018-8018
PUBLISHED: 2018-07-20
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a spe...
CVE-2018-14415
PUBLISHED: 2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVE-2018-14418
PUBLISHED: 2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVE-2018-14419
PUBLISHED: 2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.