Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/15/2015
05:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

4 Lasting Impacts Of The Hacking Team Leaks

Doxing attack against Italian surveillance company put some nasty tools in the hands of attackers and might be the final nail in the coffin for Adobe Flash.

It's a sprint between criminals and security researchers to see who can find vulnerabilities and attack tools hidden in the leaked Hacking Team files fastest. Adobe and Microsoft are scrambling to keep up, but these are just some of the immediate concerns.

So what will the long-term impacts be of the doxing attack on the Italian surveillance company?   

 

1. The Death of Flash?

Tuesday, Adobe was forced to patch two more critical zero-day vulnerabilities discovered in the leaked Hacking Team files, CVE-2015-5122 and CVE-2015-5123. Both (like CVE-2015-5119 last week) are use-after-free vulnerabilities that allow for remote code execution. The 5122 bug was being exploited in the Angler exploit kit within a matter of hours, according to security researcher Kafeine, and has since shown up in the Neutrino, RIG, and Magnitude exploit kits.

Adobe Flash has been riddled with critical vulnerabilities in the past year, causing some to say it's time for Flash to retire. However, the Flash vulnerabilities revealed in the Hacking Team breach have pushed from commentary to action.

Mozilla on Monday began preventing Flash from running by default in Firefox. Then on Tuesday, Mozilla temporarily blocked Flash altogether while waiting for Adobe to release patches for the latest vulnerabilities to come out of the leaked Hacking Team files.

US-CERT today updated an advisory (originally released Tuesday) about these vulnerabilities. Not only does the advisory say to prioritize security updates for the affected software, it also says to "limit Flash content" and that "updating is not sufficient, and it is important to use exploit mitigation and other defensive techniques."

And on Sunday, Facebook's security chief Alex Stamos tweeted: "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day."

2. More Sophisticated Tools In Hands Of More Attackers

The CVE-2015-5119 Flash vulnerability was used by the APT3 (a.k.a. UPS) advanced persistent threat actor in a targeted attack against the US government last week, according to Palo Alto Networks.

It isn't just the vulnerabilities that are the problem, though; it's the surveillance software Hacking Team sold to its customers -- which is, as Adam McNeil of Malwarebytes wrote, "basically nothing more than a Remote Access Trojan," like Zeus or AlienSpy.

The source code for Hacking Team's flagship product, Remote Control System (RCS), was leaked in the attack, and Malwarebytes researchers took a closer look at it. "RCS is feature-rich with surveillance capabilities and can collect or monitor most components on a personal computer or cell phone," wrote McNeil. "The software has the ability to exploit systems, execute code, destroy files, and monitor an array of peripherals, applications, and communications." 

Meanwhile, Hacking Team CEO David Vincenzetti told reporters today that "Only a part of the source code has been stolen," softening his initial, much more dire account of the attack.

RCS works on Windows, OSX, Linux, Android, Blackberry, iOS, Symbian, and Windows Phones and comes with all the typical RAT tools, like keyloggers and screenshot grabbers. It also uses anti-analysis methods. And according to McNeil, its management software is hidden behind a chain of anonymizers.

The cloaking and persistence mechanisms are impressive. According to Trend Micro Labs, RCS comes equipped with a UEFI BIOS rootkit -- and even reformatting the infected machine or replacing the disk wouldn't remove the infection.

Further, according to Malwarebytes, Hacking Team claimed that the exploit portal would always contain at least three zero-days at any time.

On the black market, any of these tools would come at a very high price and require a base level of technical knowledge to operate (except, perhaps, for the Blackshades RAT, which was ultimately undone by its own user-friendliness). However, the Hacking Team breach has not only brought the masses this tradecraft for free, it also provided extensive documentation and how-to manuals to make it easier for their customers to use the tools Hacking Team sold.

3. Secret Bitcoin Transactions Not So Secret

In the RCS 9.2 upgrade, Hacking Team added its "Money Module," which could track cryptocurrencies like Bitcoin, and according to leaked emails "is able to collect various information: list of contacts and local accounts, wallet (i.e., the money) and the history of transactions."

Money Module has been available since January 2014.

4. Greater Concern About Government Interference With Privacy Controls

Numbered among Hacking Team's customers was the FBI. Today, it was revealed that the Bureau had enlisted the Italian company's aid in uncovering the true identity of a user of the TOR anonymization service.

Not only has the breach shown that the government is using a tool being equated to a malicious RAT, but that governments of countries with histories of significant human rights abuses -- including Egypt, Sudan, Russia, and Ethiopia -- have been sold the very same tools. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
rrahmanov
50%
50%
rrahmanov,
User Rank: Apprentice
7/20/2015 | 3:29:37 PM
Re: This may be the final straw for Flash
Yea, that is all valid. But how do you see the death of the such an integral part of the web these days, even a slow death? There are so many objects that rely on flash like different variations of online media players, web page content representation and etc. And if we assume that Adobe "retires" Flash, it sure won't be graceful as it would keep being patched for years. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:12:48 PM
Death of flash
 

Is actual a good news. We do not have to go tough the problems coming from this tool. Most site shave moved to HTML5 anyway, it is time to get rid of it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:12:18 PM
Re: Here's another instance where Steve Jobs was right about something...
Steve jobs was more focused on Apple's competitive advantage and flash's resource hug problem of the flash. He did not really know all the vulnerabilities we are facing now.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:09:09 PM
Re: This may be the final straw for Flash
Flash has always been the problem, not only vulnerabilities but also the fact that it requires high level of resources to run. That is why we do not have it in iOS.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:04:38 PM
Monitoring citizens
We all know that all the countries monitor their own citizens. That is the main reason why most governments in most countries never privatize telecom industry to avoid losing control over the monitoring systems. 
Anna C
50%
50%
Anna C,
User Rank: Author
7/17/2015 | 4:29:35 PM
Here's another instance where Steve Jobs was right about something...
It's been over 5 years since Jobs went the HTML5 route with Apple products instead of Flash. Wow, it's been that long before the security issues have finally caught up with Flash...

Thanks for an insightful summary of the Hacking Team breach and its implications. 
LanceCottrell
100%
0%
LanceCottrell,
User Rank: Author
7/16/2015 | 6:07:11 PM
This may be the final straw for Flash
These latest Flash vulnerabilities do seem to be the final straw shifing the momentum more strongly against Flash.

Thanks for the concise analysis of the implications of the Hacking Team leaks.
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19794
PUBLISHED: 2019-12-13
The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
CVE-2019-19795
PUBLISHED: 2019-12-13
samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.
CVE-2019-19796
PUBLISHED: 2019-12-13
Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.
CVE-2019-5253
PUBLISHED: 2019-12-13
E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does not perform a sufficient authentication when doing certain operations, successful exploit could allow an attacker to cause the device to reboot after launch a man in the middle att...
CVE-2019-5260
PUBLISHED: 2019-12-13
Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vul...