Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/6/2015
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Italian Surveillance Software Maker Falls Victim To Doxing Attack

Milan-based Hacking Team tells customers to stop using its products after leaked documents reveal the product's source code and the company's history of selling to governments with records of human rights abuses.

Source code for the Remote Control System (RCS) surveillance software as well as details of the international government agencies that purchased it were revealed today in an apparent doxing attack on Hacking Team, the Milan-based makers of RCS.

The dumped data revealed that Hacking Team had sold its products to several countries with poor human rights records, as well as to the FBI and U.S. Drug Enforcement Administration (DEA). Unnamed sources told Motherboard that Hacking Team has told customers to suspend use of the software, of which the newest version is named Galileo, and was previously known as Da Vinci.

In total, attackers uploaded to BitTorrent 400 gigabytes of data (and might have stolen as much as a terabyte), which also included internal documents, audio recordings, email correspondence, and employee passwords. One of the leaked files was a PowerPoint presentation explaining how the company was able to intercept communications on the Tor network, which is supposed to be anonymous. One of the leaked files was a spreadsheet, from the end of 2014, of active and inactive clients. Among those clients were police and state agencies in nations with records of human rights abuses, including Russia, Egypt, Sudan, Ethiopia, Kazakhstan, Morocco, Nigeria, and Saudi Arabia.

The attackers also hijacked Hacking Team's Twitter account, posting "Since we have nothing to hide, we're publishing all our emails, files and source code." Tweets posted by the attackers have been deleted, but the account appears to still be active as of publishing time.

Motherboard's anonymous source says the attacker seems to have compromised the client machines of two of Hacking Team's system administrators, who had complete access to the company's files. While the company has asked customers to suspend use of the product, the source said "The company, in fact, has 'a backdoor' into every customer’s software, giving it ability to suspend it or shut it down—something that even customers aren’t told about."

[Human rights are closely intertwined with Internet freedom, privacy, and encryption -- all of which are at risk. Learn more next month at Black Hat Las Vegas in sessions like "The Lifecycle of a Revolution", with Jennifer Granick of the Stanford Center for Internet and Society, "The Battle For Free Speech on the Internet," with Matthew Prince of Cloudflare, and "The NSA Playset: A Year of Toys and Tools," with Michael Ossmann of Great Scott Gadgets.]

Some are comparing this event to another recent attack against a cybersecurity company: the Duqu 2.0 nation-state attacks against Kaspersky Lab. Most are focusing on the evidence the attackers have provided for prior accusations about Hacking Team's lack of ethics when it comes to selling its product.

As Electronic Frontier Foundation (EFF) global policy analyst Eva Galperin said on Twitter, "Thank you, Anti-Surveillance Santa, for bringing me so many leaked files for Anti-Surveillance Christmas. I have been very good this year."

[Galperin's colleague, EFF legislative analyst Mark Jaycox, and Jamil Jaffer, senior Senate staffer and adjunct professor of law at George Mason University, will be investigating the topic of surveillance at Black Hat next month in their session, "Is the NSA Still Listening to Your Phone Calls? A Surveillance Debate: Congressional Success or Epic Fail."]

Hacking Team says, "We provide our software only to governments or government agencies. We do not sell products to individuals or private businesses. We do not sell products to governments or to countries blacklisted by the U.S., E.U., U.N., NATO or ASEAN." Yet, it has been suspected of breaking that last rule before. Reporters Without Borders added the company to its "Enemies of the Internet" list in 2012.

The RCS product is essentially spyware. The company itself describes RCS as "a solution designed to evade encryption by means of an agent directly installed on the device to monitor. Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."

Some of the governments listed in Hacking Team's purported customer list are given scathing reviews in the United Nations' Human Rights Watch 2015 World Report. For example, the report says that Egypt is in a "human rights crisis, the most serious in the country’s modern history" and described how "security forces and an increasingly politicized judiciary ... invoked national security to muzzle nearly all dissent." The report states "Sudan saw no progress in its abysmal rights record ... and authorities continued to stifle civil society and independent media." As for Russia, it states "The Kremlin took another leap backward in 2014 by intensifying its crackdown on civil society, media, and the Internet."

Great Cannon

Then there's China, which has developed its own surveillance tool, the Great Cannon.

"You hear about China and cyber espionage, [organizations] getting breached, but no one really talks too often about other things they are doing that are really outlandish, like the redirection of traffic to block things" that are counter to the Chinese government regime, Adam Meyers, vice president of intelligence at CrowdStrike told Dark Reading.

"The Chinese have basically taken a lot of DNS traffic generated by the Great Firewall," he says. The massive, five-day distributed denial-of-service attack earlier this year on Github was an example where China employed its Great Cannon to block Chinese citizens from accessing a tool housed there for bypassing the Great Firewall. "That was a pretty aggressive move on the part of China."

So when a Chinese citizen tries to visit a site that the Chinese government doesn’t approve of, it redirects the traffic. "They are redirecting traffic and attacking [sites] that are not in line with" the government’s views, he says.

"It’s not really an espionage tool. But it could be a smokescreen for a broader espionage campaign, possibly," Meyers says of China's Great Cannon.

Meyers says CrowdStrike’s senior intel analyst Adam Kozy and junior researcher Johannes Gilger, in their Black Hat talk next month will reveal both technical and cultural aspects of China's Great Cannon. 

Kelly Jackson Higgins contributed to this article.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Whoopty
100%
0%
Whoopty,
User Rank: Ninja
7/7/2015 | 7:01:30 AM
Good, but...
As much as I'm pleased that Hacking Team's dirty laundry has been aired here, anyone annoyed by what its done should direct their anger equally to US and British intelligence agencies, which have been doing the same sort of spying on their own citizens for the better part of a decade at this point. 
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12551
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVE-2019-12552
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVE-2019-3414
PUBLISHED: 2019-07-22
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front en...
CVE-2019-10102
PUBLISHED: 2019-07-22
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". Th...
CVE-2019-10102
PUBLISHED: 2019-07-22
aubio 0.4.8 and earlier is affected by: null pointer. The impact is: crash. The component is: filterbank. The attack vector is: pass invalid arguments to new_aubio_filterbank. The fixed version is: after commit eda95c9c22b4f0b466ae94c4708765eaae6e709e.