Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:30 PM
Connect Directly

Italian Surveillance Software Maker Falls Victim To Doxing Attack

Milan-based Hacking Team tells customers to stop using its products after leaked documents reveal the product's source code and the company's history of selling to governments with records of human rights abuses.

Source code for the Remote Control System (RCS) surveillance software as well as details of the international government agencies that purchased it were revealed today in an apparent doxing attack on Hacking Team, the Milan-based makers of RCS.

The dumped data revealed that Hacking Team had sold its products to several countries with poor human rights records, as well as to the FBI and U.S. Drug Enforcement Administration (DEA). Unnamed sources told Motherboard that Hacking Team has told customers to suspend use of the software, of which the newest version is named Galileo, and was previously known as Da Vinci.

In total, attackers uploaded to BitTorrent 400 gigabytes of data (and might have stolen as much as a terabyte), which also included internal documents, audio recordings, email correspondence, and employee passwords. One of the leaked files was a PowerPoint presentation explaining how the company was able to intercept communications on the Tor network, which is supposed to be anonymous. One of the leaked files was a spreadsheet, from the end of 2014, of active and inactive clients. Among those clients were police and state agencies in nations with records of human rights abuses, including Russia, Egypt, Sudan, Ethiopia, Kazakhstan, Morocco, Nigeria, and Saudi Arabia.

The attackers also hijacked Hacking Team's Twitter account, posting "Since we have nothing to hide, we're publishing all our emails, files and source code." Tweets posted by the attackers have been deleted, but the account appears to still be active as of publishing time.

Motherboard's anonymous source says the attacker seems to have compromised the client machines of two of Hacking Team's system administrators, who had complete access to the company's files. While the company has asked customers to suspend use of the product, the source said "The company, in fact, has 'a backdoor' into every customer’s software, giving it ability to suspend it or shut it down—something that even customers aren’t told about."

[Human rights are closely intertwined with Internet freedom, privacy, and encryption -- all of which are at risk. Learn more next month at Black Hat Las Vegas in sessions like "The Lifecycle of a Revolution", with Jennifer Granick of the Stanford Center for Internet and Society, "The Battle For Free Speech on the Internet," with Matthew Prince of Cloudflare, and "The NSA Playset: A Year of Toys and Tools," with Michael Ossmann of Great Scott Gadgets.]

Some are comparing this event to another recent attack against a cybersecurity company: the Duqu 2.0 nation-state attacks against Kaspersky Lab. Most are focusing on the evidence the attackers have provided for prior accusations about Hacking Team's lack of ethics when it comes to selling its product.

As Electronic Frontier Foundation (EFF) global policy analyst Eva Galperin said on Twitter, "Thank you, Anti-Surveillance Santa, for bringing me so many leaked files for Anti-Surveillance Christmas. I have been very good this year."

[Galperin's colleague, EFF legislative analyst Mark Jaycox, and Jamil Jaffer, senior Senate staffer and adjunct professor of law at George Mason University, will be investigating the topic of surveillance at Black Hat next month in their session, "Is the NSA Still Listening to Your Phone Calls? A Surveillance Debate: Congressional Success or Epic Fail."]

Hacking Team says, "We provide our software only to governments or government agencies. We do not sell products to individuals or private businesses. We do not sell products to governments or to countries blacklisted by the U.S., E.U., U.N., NATO or ASEAN." Yet, it has been suspected of breaking that last rule before. Reporters Without Borders added the company to its "Enemies of the Internet" list in 2012.

The RCS product is essentially spyware. The company itself describes RCS as "a solution designed to evade encryption by means of an agent directly installed on the device to monitor. Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."

Some of the governments listed in Hacking Team's purported customer list are given scathing reviews in the United Nations' Human Rights Watch 2015 World Report. For example, the report says that Egypt is in a "human rights crisis, the most serious in the country’s modern history" and described how "security forces and an increasingly politicized judiciary ... invoked national security to muzzle nearly all dissent." The report states "Sudan saw no progress in its abysmal rights record ... and authorities continued to stifle civil society and independent media." As for Russia, it states "The Kremlin took another leap backward in 2014 by intensifying its crackdown on civil society, media, and the Internet."

Great Cannon

Then there's China, which has developed its own surveillance tool, the Great Cannon.

"You hear about China and cyber espionage, [organizations] getting breached, but no one really talks too often about other things they are doing that are really outlandish, like the redirection of traffic to block things" that are counter to the Chinese government regime, Adam Meyers, vice president of intelligence at CrowdStrike told Dark Reading.

"The Chinese have basically taken a lot of DNS traffic generated by the Great Firewall," he says. The massive, five-day distributed denial-of-service attack earlier this year on Github was an example where China employed its Great Cannon to block Chinese citizens from accessing a tool housed there for bypassing the Great Firewall. "That was a pretty aggressive move on the part of China."

So when a Chinese citizen tries to visit a site that the Chinese government doesn’t approve of, it redirects the traffic. "They are redirecting traffic and attacking [sites] that are not in line with" the government’s views, he says.

"It’s not really an espionage tool. But it could be a smokescreen for a broader espionage campaign, possibly," Meyers says of China's Great Cannon.

Meyers says CrowdStrike’s senior intel analyst Adam Kozy and junior researcher Johannes Gilger, in their Black Hat talk next month will reveal both technical and cultural aspects of China's Great Cannon. 

Kelly Jackson Higgins contributed to this article.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
7/7/2015 | 7:01:30 AM
Good, but...
As much as I'm pleased that Hacking Team's dirty laundry has been aired here, anyone annoyed by what its done should direct their anger equally to US and British intelligence agencies, which have been doing the same sort of spying on their own citizens for the better part of a decade at this point. 
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-21
The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to reconfig...
PUBLISHED: 2021-04-21
Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any...
PUBLISHED: 2021-04-21
The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency.
PUBLISHED: 2021-04-21
An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.
PUBLISHED: 2021-04-21
An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::GetSampleSize() located in Ap4StszAtom.cpp. It allows an attacker to cause Denial of Service.