Jump to content

HackingTeam

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by RebelSkum (talk | contribs) at 02:48, 25 March 2017 (→Customer list: Added CIA to list of customers as per WikiLeaks release from Hacking Team describing "cliente CIA"). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

HackingTeam
IndustryInformation technology
Founded2003
FoundersDavid Vincenzetti, Valeriano Bedeschi
Headquarters
Milan
,
Italy
Key people
Alberto Ornaghi (ALoR), Marco Valleri (NaGA)
Products
  • Software
Websitewww.hackingteam.it

HackingTeam is a Milan-based information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.[1] Its "Remote Control Systems" enable governments and corporations to monitor the communications of internet users, decipher their encrypted files and emails, record Skype and other Voice over IP communications, and remotely activate microphones and camera on target computers.[2] The company has been criticized for providing these capabilities to governments with poor human rights records,[3] though HackingTeam states that they have the ability to disable their software if it is used unethically.[4][5] The Italian government has restricted their license to do business with countries outside Europe.[6]

HackingTeam employs around 40 people in its Italian office, and has subsidiary branches in Annapolis, Washington, D.C. and Singapore.[7] Its products are in use in dozens of countries across six continents.[8]

History

HackingTeam was started by two Italian programmers: Alberto Ornaghi and Marco Valleri. Prior to the company's formal establishment, Ornaghi and Valleri (under the aliases of ALoR, and NaGA respectively), created a set of tools that could be used to monitor and remotely manipulate target computers. The program, called Ettercap, was embraced both by hackers looking to spy on people, and by companies that hoped to test the security of their own networks.

The Milan police department learned of the tools. Hoping to use Ettercap to spy on Italian citizens and listen to their Skype calls, the police contacted Ornaghi and Valleri and asked them to help modify the program. HackingTeam was born, and became "the first sellers of commercial hacking software to the police."[8]

According to former employee Alberto Pelliccione, the company began as security services provider, offering penetration testing, auditing and other defensive capabilities to clients.[9] Pelliccione states that as malware and other offensive capabilities were developed and accounted for a larger percentage of revenues, the organization pivoted in a more offensive direction and became increasingly compartmentalized. Pelliccione claims fellow employees working on aspects of the same platform – for example, Android exploits and payloads – would not communicate with one another, possibly leading to tensions and strife within the organization.[9]

In February 2014, a report from Citizen Lab identified the organisation to be using hosting services from Linode, Telecom Italia, Rackspace, NOC4Hosts and notorious bullet proof hosting company Santrex.[10]

On July 5, 2015 the company suffered a major data breach of customer data, software code, internal documents and emails. - See: § 2015 data breach

Products and capabilities

HackingTeam enables clients to perform remote monitoring functions against citizens via their RCS (Remote Control Systems), including their Da Vinci and Galileo platforms:[1]

  • Covert collection of emails, text message, phone call history and address books
  • Keystroke logging
  • Uncover search history data and take screenshots
  • Record audio from phone calls
  • Capture audio and video stream from device memory to bypass cryptography of Skype sessions[11]
  • Use microphones on device to collect ambient background noise and conversations
  • Activate phone or computer cameras
  • Hijack telephone GPS systems to monitor target's location
  • Infect target computer's UEFI BIOS firmware with a rootkit[12]
  • Extract WiFi passwords[13]
  • Exfiltrate Bitcoin and other cryptocurrency wallet files to collect data on local accounts, contacts and transaction histories.[14]

HackingTeam uses advanced techniques to avoid draining cell phone batteries, which could potentially raise suspicions, and other methods to avoid detection.[15][16]

The malware has payloads for Android,[13] BlackBerry, Apple iOS, Linux, Mac OS X, Symbian, as well as Microsoft Windows, Windows Mobile and Windows Phone class of operating systems.[17]

RCS is a management platform that allows operators to remotely deploy exploits and payloads against targeted systems, remotely manage devices once compromised, and exfiltrate data for remote analysis.

Controversies

Use by repressive governments

HackingTeam has been criticized for selling its products and services to governments with poor human rights records, including Sudan, Bahrain, Venezuela, and Saudi Arabia.[18]

In June 2014, a United Nations panel monitoring the implementation of sanctions on Sudan requested information from HackingTeam about their alleged sales of software to the country in contravention of United Nations weapons export bans to Sudan. Documents leaked in the 2015 data breach of HackingTeam revealed the organization sold Sudanese National Intelligence and Security Service access to their "Remote Control System" software in 2012 for 960,000 Euros.[18][19]

In response to the United Nations panel, the company responded in January 2015 that they were not currently selling to Sudan. In a follow-up exchange, HackingTeam asserted that their product was not controlled as a weapon, and so the request was beyond the scope of the panel. There was no need for them to disclose previous sales, which they considered confidential business information.[18][20]

The U.N. disagreed. "The view of the panel is that as such software is ideally suited to support military electronic intelligence (ELINT) operations it may potentially fall under the category of ‘military … equipment’ or ‘assistance’ related to prohibited items," the secretary wrote in March. "Thus its potential use in targeting any of the belligerents in the Darfur conflict is of interest to the Panel."[18][21]

In the fall of 2014, the Italian government abruptly froze all of HackingTeam's exports, citing human rights concerns. After lobbying Italian officials, the company temporarily won back the right to sell its products abroad.[18]

2015 data breach

On July 5, 2015, the Twitter account of the company was compromised by an unknown individual who published an announcement of a data breach against HackingTeam's computer systems. The initial message read, "Since we have nothing to hide, we're publishing all our e-mails, files, and source code …" and provided links to over 400 gigabytes of data, including alleged internal e-mails, invoices, and source code; which were leaked via BitTorrent and Mega.[22] An announcement of the data breach, including a link to the bittorrent seed, was retweeted by WikiLeaks and by many others through social media.[23][24]

The material was voluminous and early analysis appeared to reveal that HackingTeam had invoiced the Lebanese Army[25] and Sudan and that spy tools were also sold to Bahrain and Kazakhstan.[24] HackingTeam had previously claimed they had never done business with Sudan.[26]

The leaked data revealed a zero-day cross-platform Flash exploit (CVE number: CVE-2015-5119).[27] The dump included a demo of this exploit by opening Calculator from a test webpage.[28][29] Adobe patched the hole on July 8, 2015.[30] Another vulnerability involving Adobe was revealed in the dumps, which took advantage of a buffer overflow attack on an Adobe Open Type Manager DLL included with Microsoft Windows. The DLL is run in kernel mode, so the attack could perform privilege escalation to bypass the sandbox.[31]

Also revealed in leaked data was HackingTeam employees' use of weak passwords, including 'P4ssword', 'wolverine', and 'universo'.[32]

After a few hours without response from HackingTeam, member Christian Pozzi tweeted the company was working closely with police and "what the attackers are claiming regarding our company is not true."[33][34] He also claimed the leaked archive "contains a virus" and that it constituted "false info".[35] Shortly after these tweets, Pozzi's Twitter account itself was apparently compromised.[36]

Responsibility for this attack was claimed by the hacker known as "Phineas Fisher" (or Phisher) on Twitter.[37] Phineas has previously attacked spyware firm Gamma International, who produce malware, such as FinFisher, for governments and corporations.[38] In 2016, Phineas published details of the attack, in Spanish and English, as a "how-to" for others, and explained the motivations behind the attack.[39]

The internal documents revealed details of HackingTeam's contracts with repressive governments.[40] In 2016, the Italian government again revoked the company’s license to sell spyware outside of Europe without special permission.[6][41]

Customer list

HackingTeam's clientele include not just governments, but also corporate clients such as Barclay's Bank and British Telecom (BT) of the United Kingdom, as well as Deutsche Bank of Germany.[1]

A full list of HackingTeam's customers were leaked in the 2015 breach. Disclosed documents show HackingTeam had 70 current customers, mostly military, police, federal and provincial governments. The total company revenues disclosed exceeded 40 million Euros.[42][43][44][45][46][47]

Customer Country Area Agency Year First Sale Annual Maintenance Fees Total Client Revenues
Polizia Postale e delle Comunicazioni[48] Italy Europe LEA 2004 €100,000 €808,833
Centro Nacional de Inteligencia[49] Spain Europe Intelligence 2006 €52,000 €538,000
Infocomm Development Authority of Singapore Singapore APAC Intelligence 2008 €89,000 €1,209,967
Information Office Hungary Europe Intelligence 2008 €41,000 €885,000
CSDN Morocco MEA Intelligence 2009 €140,000 €1,936,050
UPDF (Uganda Peoples Defense Force), ISO (Internal Security Organization), Office of the President Uganda Africa Intelligence 2015 €831,000 €52,197,100
Italy - DA - Rental Italy Europe Other 2009 €50,000 €628,250
Malaysian Anti-Corruption Commission Malaysia APAC Intelligence 2009 €77,000 €789,123
PCM Italy Europe Intelligence 2009 €90,000 €764,297
SSNS - Ungheria Hungary Europe Intelligence 2009 €64,000 €1,011,000
CC - Italy Italy Europe LEA 2010 €50,000 €497,349
Al Mukhabarat Al A'amah Saudi Arabia MEA Intelligence 2010 €45,000 €600,000
IR Authorities (Condor) Luxembourg Europe Other 2010 €45,000 €446,000
La Dependencia y/o CISEN[50] Mexico LATAM Intelligence 2010 €130,000 €1,390,000
UZC[51] Czech Republic Europe LEA 2010 €55,000 €689,779
Egypt - MOD[51] Egypt MEA Other 2011 €70,000 €598,000
Federal Bureau of Investigation[52] USA North America LEA 2011 €100,000 €697,710
Oman - Intelligence Oman MEA Intelligence 2011 €30,000 €500,000
President Security[53][54] Panama LATAM Intelligence 2011 €110,000 €750,000
Turkish National Police Turkey Europe LEA 2011 €45,000 €440,000
UAE - MOI UAE MEA LEA 2011 €90,000 €634,500
National Security Service[51] Uzbekistan Europe Intelligence 2011 €50,000 €917,038
Department of Defense[52] USA North America LEA 2011 €190,000
Bayelsa State Government Nigeria MEA Intelligence 2012 €75,000 €450,000
Estado del Mexico Mexico LATAM LEA 2012 €120,000 €783,000
Information Network Security Agency Ethiopia MEA Intelligence 2012 €80,000 €750,000
State security (Falcon) Luxemburg Europe Other 2012 €38,000 €316,000
Italy - DA - Rental Italy Europe Other 2012 €60,000 €496,000
MAL - MI Malaysia APAC Intelligence 2012 €77,000 €552,000
Direction générale de la surveillance du territoire Morocco MEA Intelligence 2012 €160,000 €1,237,500
National Intelligence and Security Service[51] Sudan MEA Intelligence 2012 €76,000 €960,000
Russia - KVANT[55] Russia Europe Intelligence 2012 €72,000 €451,017
Saudi - GID Saudi MEA LEA 2012 €114,000 €1,201,000
SIS of National Security Committee of Kazakhstan[51] Kazakhstan Europe Intelligence 2012 €140,000 €1,012,500
The 5163 Army Division (Alias of South Korean National Intelligence Service)[51][56][57] S. Korea APAC Other 2012 €67,000 €686,400
UAE - Intelligence UAE MEA Other 2012 €150,000 €1,200,000
Central Intelligence Agency[58] USA North America Intelligence 2011
Drug Enforcement Administration[52][59] USA North America Other 2012 €70,000 €567,984
Central Anticorruption Bureau Poland Europe LEA 2012 €35,000 €249,200
MOD Saudi Saudi MEA Other 2013 €220,000 €1,108,687
PMO Malaysia APAC Intelligence 2013 €64,500 €520,000
Estado de Qeretaro Mexico LATAM LEA 2013 €48,000 €234,500
National Security Agency[51] Azerbaijan Europe Intelligence 2013 €32,000 €349,000
Gobierno de Puebla Mexico LATAM Other 2013 €64,000 €428,835
Gobierno de Campeche Mexico LATAM Other 2013 €78,000 €386,296
AC Mongolia Mongolia APAC Intelligence 2013 €100,000 €799,000
Dept. of Correction Thai Police Thailand APAC LEA 2013 €52,000 €286,482
National Intelligence Secretariat[60] Ecuador LATAM LEA 2013 €75,000 €535,000
Police Intelligence Directorate[61] Colombia LATAM LEA 2013 €35,000 €335,000
Guardia di Finanza Italy Europe LEA 2013 €80,000 €400,000
Intelligence[62] Cyprus Europe LEA 2013 €40,000 €375,625
MidWorld[63] Bahrain MEA Intelligence 2013 €210,000
Mexico - PEMEX Mexico LATAM LEA 2013 €321,120
Malysia K Malaysia APAC LEA 2013 €0
Honduras Honduras LATAM LEA 2014 €355,000
Mex Taumalipas Mexico LATAM 2014 €322,900
Secretaría de Planeación y Finanzas Mexico LATAM LEA 2014 €91,000 €371,035
AREA Italia Europe 2014 €430,000
Mexico Yucatán Mexico LATAM LEA 2014 €401,788
Mexico Durango Mexico LATAM LEA 2014 €421,397
Investigations Police of Chile Chile LATAM LEA 2014 €2,289,155
Jalisco Mexico Mexico LATAM LEA 2014 €748,003
Royal Thai Army Thailand APAC LEA 2014 €360,000
Vietnam GD5 Vietnam APAC 2014 €281,170
Kantonspolizei Zürich Switzerland Europe LEA 2014 €486,500
Vietnam GD1 Vietnam APAC LEA 2015 €543,810
Egypt TRD GNSE Egypt MEA LEA 2015 €137,500
Lebanese Army Lebanon MEA LEA 2015
Federal Police Department Brazil LATAM LEA 2015
State Informative Service[64] Albania Europe SHIK 2015

See also

References

  1. ^ a b c Batey, Angus (24 November 2011). "The spies behind your screen". The Telegraph. Retrieved 26 July 2015. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  2. ^ "Enemies of the Internet: HackingTeam". Reporters Without Borders. Retrieved 24 April 2014.
  3. ^ Marczak, Bill; Gaurnieri, Claudio; Marquis-Boire, Morgan; Scott-Railton, John (February 17, 2014). "Mapping HackingTeam's "Untraceable" Spyware".
  4. ^ Kopstein, Joshua (10 March 2014). "Hackers Without Borders". The New Yorker. Retrieved 24 April 2014.
  5. ^ Marquis-Boire, Morgan; Gaurnieri, Claudio; Scott-Railton, John; Kleemola, Katie (June 24, 2014). "Police Story: HackingTeam's Government Surveillance Malware". Citizen Lab. University of Toronto. Retrieved August 3, 2014.
  6. ^ a b Zorabedian, John (2016-04-08). "HackingTeam loses global license to sell spyware". Naked Security. Retrieved 2016-05-15.
  7. ^ Human Rights Watch (25 March 2014). "They Know Everything We Do". Retrieved 1 August 2015.
  8. ^ a b Jeffries, Adrianne (13 September 2013). "Meet HackingTeam, the company that helps the police hack you". The Verge. Retrieved 21 April 2014.
  9. ^ a b Farivar, Cyrus (20 July 2015) HackingTeam goes to war against former employees, suspects some helped hackers. Ars Technica. Retrieved 26 July 2015.
  10. ^ "HackingTeam's US Nexus". 28 February 2014. Retrieved 2 August 2015.
  11. ^ Stecklow, Steve; Sonne, Paul; Bradley, Matt (1 June 2011). "Mideast Uses Western Tools to Battle the Skype Rebellion". Wall Street Journal. Retrieved 26 July 2015. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  12. ^ Lin, Philippe (July 13, 2015). "HackingTeam Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems". TrendLabs Security Intelligence Blog. Trend Micro. Retrieved July 26, 2015.
  13. ^ a b "Advanced spyware for Android now available to script kiddies everywhere". Ars Technica. Retrieved on 2 August 2015.
  14. ^ Farivar, Cyrus (14 July 2015). "HackingTeam broke Bitcoin secrecy by targeting crucial wallet file". Ars Technica. Retrieved 26 July 2015.
  15. ^ Schneier, Bruce. "More on HackingTeam's Government Spying Software".
  16. ^ "HackingTeam Tools Allow Governments To Take Full Control of Your Smartphone". International Business Times UK. 2014-06-24. Retrieved 2016-05-15.
  17. ^ Guarnieri, Claudio; Marquis-Boire, Morgan (13 January 2014). "To Protect And Infect: The militarization of the Internet". At the 30th Chaos Communications Congress – "30C3". (Video or Audio). Chaos Computer Club. Retrieved on 15 August 2015.
  18. ^ a b c d e Currier, Cora; Marquis-Boire, Morgan. "A Detailed Look at HackingTeam's Emails About Its Repressive Clients". Retrieved 7 July 2015.
  19. ^ Hay Newman, Lily. "A Detailed Look at HackingTeam's Emails About Its Repressive Clients". The Intercept. Retrieved 2016-05-15.
  20. ^ Myers West, Sarah (2015-07-08). "HackingTeam Leaks Reveal Spyware Industry's Growth, Negligence of Human Rights". Electronic Frontier Foundation. Retrieved 2016-05-15.
  21. ^ Knibbs, Kate (2015-07-08). "HackingTeam's Lame Excuse for Selling Digital Weapons to Sudan". Gizmodo. Retrieved 2016-05-15.
  22. ^ Hacked Team (@hackingteam) at the Wayback Machine (archived July 6, 2015)
  23. ^ WikiLeaks [@wikileaks] (July 6, 2015). "Inside malware makers "HackingTeam": hundreds of gigabytes of e-mails, files, and source code" (Tweet). Retrieved July 6, 2015 – via Twitter.
  24. ^ a b "HackingTeam hacked: Spy tools sold to oppressive regimes Sudan, Bahrain and Kazakhstan". International Business Times. 2015-06-06. Retrieved 2015-07-06.
  25. ^ HackingTeam on Twitter [dead link]
  26. ^ Ragan, Steve. "HackingTeam hacked, attackers claim 400GB in dumped data". Retrieved 2015-07-06.
  27. ^ "Security Advisory for Adobe Flash Player". helpx.adobe.com. Adobe Systems. July 8, 2015. Retrieved August 30, 2016.
  28. ^ Khandelwal, Swati. "Zero-Day Flash Player Exploit Disclosed In 'HackingTeam' Data Dump". Retrieved 2015-07-06.
  29. ^ Pi, Peter. "Unpatched Flash Player Flaw, More POCs Found in HackingTeam Leak". Retrieved 2015-07-08.
  30. ^ Adobe Systems (corporate author). "Adobe Security Bulletin". Retrieved 2015-07-11. {{cite web}}: |last= has generic name (help)
  31. ^ Tang, Jack. "A Look at the Open Type Font Manager Vulnerability from the HackingTeam Leak". Retrieved 2015-07-08.
  32. ^ Whittaker, Zack. "HackingTeam used shockingly bad passwords". Retrieved 2015-07-06.
  33. ^ "Christian Pozzi on Twitter". Retrieved 2015-07-06.
  34. ^ "Christian Pozzi on Twitter". Retrieved 2015-07-06.
  35. ^ "Christian Pozzi on Twitter". Retrieved 2015-07-06.
  36. ^ "Christian Pozzi on Twitter: "Uh Oh - my twitter account was also hacked."". 2015-07-06. Archived from the original on July 6, 2015. Retrieved 2015-07-06. {{cite web}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  37. ^ Phineas Fisher [@gammagrouppr] (6 July 2015). "gamma and HT down, a few more to go :)" (Tweet) – via Twitter.
  38. ^ Osbourne, Charlie. "HackingTeam: We won't 'shrivel up and go away' after cyberattack". Retrieved 2015-07-06.
  39. ^ "How HackingTeam got hacked". Ars Technica. Retrieved 2016-05-15.
  40. ^ "A Detailed Look at HackingTeam's Emails About Its Repressive Clients". The Intercept. Retrieved 2016-05-15.
  41. ^ "HackingTeam's Global License Revoked by Italian Export Authorities | Privacy International". www.privacyinternational.org. Retrieved 2016-05-15.
  42. ^ Kopstein, Justin (6 July 2015). "Here Are All the Sketchy Government Agencies Buying HackingTeam's Spy Tech". Vice Magazine.
  43. ^ Weissman, Cale Guthrie (6 July 2015). "Hacked security company's documents show a laundry list of questionable clients".
  44. ^ Ragan, Steve. "In Pictures: HackingTeam's hack curated". CSO Online (Australia).
  45. ^ Hern, Alex (6 July 2015). "HackingTeam hacked: firm sold spying tools to repressive regimes, documents claim". The Guardian. Retrieved 22 July 2015. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  46. ^ Ragan, Steve (6 July 2015). "HackingTeam responds to data breach, issues public threats and denials". CSO Online. Retrieved 22 July 2015. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  47. ^ Stevenson, Alastair (14 July 2015). "A whole bunch of downed government surveillance programs are about to go back online". Business Insider. Retrieved 22 July 2015. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  48. ^ Jone Pierantonio. "Ecco chi ha bucato HackingTeam". International Business Times. Retrieved on 2 August 2015.
  49. ^ Ediciones El País (8 July 2015). "HackingTeam: “Ofrecemos tecnología ofensiva para la Policía”". EL PAÍS. Retrieved on 2 August 2015.
  50. ^ "The HackingTeam leak shows Mexico was its top client, but why?". Fusion. Retrieved on 2 August 2015.
  51. ^ a b c d e f g "Leaked emails from security firm HackingTeam show government use - Fortune". Fortune. Retrieved on 2 August 2015.
  52. ^ a b c "Leaked Documents Show FBI, DEA and U.S. Army Buying Italian Spyware". The Intercept. Retrieved on 2 August 2015.
  53. ^ "HackingTeam's Equipment Got Stolen in Panama". Motherboard. Retrieved on 2 August 2015.
  54. ^ Molina, Thabata (13 August 2015). "Panama to Investigate Martinelli in HackingTeam Spying Scandal". Panama Post. Retrieved 15 August 2015.
  55. ^ "HackingTeam apparently violated EU rules in sale of spyware to Russian agency". Ars Technica. Retrieved on 2 August 2015.
  56. ^ "How HackingTeam Created Spyware that Allowed the FBI To Monitor Tor Browser". The Intercept. Retrieved on 2 August 2015.
  57. ^ McGrath, Ben (25 July 2015). "Further revelations in South Korean hacking scandal". World Socialist Web Site. Retrieved 26 July 2015.
  58. ^ "WikiLeaks - The Hackingteam Archives". wikileaks.org. Retrieved 2017-03-25.
  59. ^ "The DEA Just Cancelled Its Contract With HackingTeam". Motherboard. Retrieved on 2 August 2015.
  60. ^
  61. ^ Podour, Justin (23 July 2015). #HackedTeam y Colombia: Cómo la vigilancia ayuda a un Estado violento. Telesur. Retrieved 26 July 2015.
  62. ^ In Cyprus (11 July 2015).Intelligence Service chief steps down. Retrieved 26 July 2015.
  63. ^ Bahrain Center for Human Rights (15 July 2015). "HackingTeam's troubling connections to Bahrain" IFEX. Retrieved 26 July 2015.
  64. ^ Lexime (14 July 2015). "Burime të sigurta, SHISH përdor programet përgjuese që prej 2015. HackingTeams: Nuk e kemi nën kontroll sistemin!" (video). BalkanWeb. Retrieved 27 July 2015.
  65. ^ HackingTeam: a zero-day market case study, Vlad Tsyrklevich's blog
  66. ^ Perlroth, Nicole (10 October 2012). Ahead of Spyware Conference, More Evidence of Abuse. New York Times (Bits).
Retrieved from "https://en.wikipedia.org/w/index.php?title=HackingTeam&oldid=772059906"