Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/15/2015
05:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

4 Lasting Impacts Of The Hacking Team Leaks

Doxing attack against Italian surveillance company put some nasty tools in the hands of attackers and might be the final nail in the coffin for Adobe Flash.

It's a sprint between criminals and security researchers to see who can find vulnerabilities and attack tools hidden in the leaked Hacking Team files fastest. Adobe and Microsoft are scrambling to keep up, but these are just some of the immediate concerns.

So what will the long-term impacts be of the doxing attack on the Italian surveillance company?   

 

1. The Death of Flash?

Tuesday, Adobe was forced to patch two more critical zero-day vulnerabilities discovered in the leaked Hacking Team files, CVE-2015-5122 and CVE-2015-5123. Both (like CVE-2015-5119 last week) are use-after-free vulnerabilities that allow for remote code execution. The 5122 bug was being exploited in the Angler exploit kit within a matter of hours, according to security researcher Kafeine, and has since shown up in the Neutrino, RIG, and Magnitude exploit kits.

Adobe Flash has been riddled with critical vulnerabilities in the past year, causing some to say it's time for Flash to retire. However, the Flash vulnerabilities revealed in the Hacking Team breach have pushed from commentary to action.

Mozilla on Monday began preventing Flash from running by default in Firefox. Then on Tuesday, Mozilla temporarily blocked Flash altogether while waiting for Adobe to release patches for the latest vulnerabilities to come out of the leaked Hacking Team files.

US-CERT today updated an advisory (originally released Tuesday) about these vulnerabilities. Not only does the advisory say to prioritize security updates for the affected software, it also says to "limit Flash content" and that "updating is not sufficient, and it is important to use exploit mitigation and other defensive techniques."

And on Sunday, Facebook's security chief Alex Stamos tweeted: "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day."

2. More Sophisticated Tools In Hands Of More Attackers

The CVE-2015-5119 Flash vulnerability was used by the APT3 (a.k.a. UPS) advanced persistent threat actor in a targeted attack against the US government last week, according to Palo Alto Networks.

It isn't just the vulnerabilities that are the problem, though; it's the surveillance software Hacking Team sold to its customers -- which is, as Adam McNeil of Malwarebytes wrote, "basically nothing more than a Remote Access Trojan," like Zeus or AlienSpy.

The source code for Hacking Team's flagship product, Remote Control System (RCS), was leaked in the attack, and Malwarebytes researchers took a closer look at it. "RCS is feature-rich with surveillance capabilities and can collect or monitor most components on a personal computer or cell phone," wrote McNeil. "The software has the ability to exploit systems, execute code, destroy files, and monitor an array of peripherals, applications, and communications." 

Meanwhile, Hacking Team CEO David Vincenzetti told reporters today that "Only a part of the source code has been stolen," softening his initial, much more dire account of the attack.

RCS works on Windows, OSX, Linux, Android, Blackberry, iOS, Symbian, and Windows Phones and comes with all the typical RAT tools, like keyloggers and screenshot grabbers. It also uses anti-analysis methods. And according to McNeil, its management software is hidden behind a chain of anonymizers.

The cloaking and persistence mechanisms are impressive. According to Trend Micro Labs, RCS comes equipped with a UEFI BIOS rootkit -- and even reformatting the infected machine or replacing the disk wouldn't remove the infection.

Further, according to Malwarebytes, Hacking Team claimed that the exploit portal would always contain at least three zero-days at any time.

On the black market, any of these tools would come at a very high price and require a base level of technical knowledge to operate (except, perhaps, for the Blackshades RAT, which was ultimately undone by its own user-friendliness). However, the Hacking Team breach has not only brought the masses this tradecraft for free, it also provided extensive documentation and how-to manuals to make it easier for their customers to use the tools Hacking Team sold.

3. Secret Bitcoin Transactions Not So Secret

In the RCS 9.2 upgrade, Hacking Team added its "Money Module," which could track cryptocurrencies like Bitcoin, and according to leaked emails "is able to collect various information: list of contacts and local accounts, wallet (i.e., the money) and the history of transactions."

Money Module has been available since January 2014.

4. Greater Concern About Government Interference With Privacy Controls

Numbered among Hacking Team's customers was the FBI. Today, it was revealed that the Bureau had enlisted the Italian company's aid in uncovering the true identity of a user of the TOR anonymization service.

Not only has the breach shown that the government is using a tool being equated to a malicious RAT, but that governments of countries with histories of significant human rights abuses -- including Egypt, Sudan, Russia, and Ethiopia -- have been sold the very same tools. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
rrahmanov
50%
50%
rrahmanov,
User Rank: Apprentice
7/20/2015 | 3:29:37 PM
Re: This may be the final straw for Flash
Yea, that is all valid. But how do you see the death of the such an integral part of the web these days, even a slow death? There are so many objects that rely on flash like different variations of online media players, web page content representation and etc. And if we assume that Adobe "retires" Flash, it sure won't be graceful as it would keep being patched for years. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:12:48 PM
Death of flash
 

Is actual a good news. We do not have to go tough the problems coming from this tool. Most site shave moved to HTML5 anyway, it is time to get rid of it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:12:18 PM
Re: Here's another instance where Steve Jobs was right about something...
Steve jobs was more focused on Apple's competitive advantage and flash's resource hug problem of the flash. He did not really know all the vulnerabilities we are facing now.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:09:09 PM
Re: This may be the final straw for Flash
Flash has always been the problem, not only vulnerabilities but also the fact that it requires high level of resources to run. That is why we do not have it in iOS.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/20/2015 | 2:04:38 PM
Monitoring citizens
We all know that all the countries monitor their own citizens. That is the main reason why most governments in most countries never privatize telecom industry to avoid losing control over the monitoring systems. 
Anna C
50%
50%
Anna C,
User Rank: Author
7/17/2015 | 4:29:35 PM
Here's another instance where Steve Jobs was right about something...
It's been over 5 years since Jobs went the HTML5 route with Apple products instead of Flash. Wow, it's been that long before the security issues have finally caught up with Flash...

Thanks for an insightful summary of the Hacking Team breach and its implications. 
LanceCottrell
100%
0%
LanceCottrell,
User Rank: Author
7/16/2015 | 6:07:11 PM
This may be the final straw for Flash
These latest Flash vulnerabilities do seem to be the final straw shifing the momentum more strongly against Flash.

Thanks for the concise analysis of the implications of the Hacking Team leaks.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...