4 Lasting Impacts Of The Hacking Team Leaks

It's a sprint between criminals and security researchers to see who can find vulnerabilities and attack tools hidden in the leaked Hacking Team files fastest. Adobe and Microsoft are scrambling to keep up, but these are just some of the immediate concerns.

So what will the long-term impacts be of the doxing attack on the Italian surveillance company?   

1. The Death of Flash?

Tuesday, Adobe was forced to patch two more critical zero-day vulnerabilities discovered in the leaked Hacking Team files, CVE-2015-5122 and CVE-2015-5123. Both (like CVE-2015-5119 last week) are use-after-free vulnerabilities that allow for remote code execution. The 5122 bug was being exploited in the Angler exploit kit within a matter of hours, according to security researcher Kafeine, and has since shown up in the Neutrino, RIG, and Magnitude exploit kits.

Adobe Flash has been riddled with critical vulnerabilities in the past year, causing some to say it's time for Flash to retire. However, the Flash vulnerabilities revealed in the Hacking Team breach have pushed from commentary to action.

Mozilla on Monday began preventing Flash from running by default in Firefox. Then on Tuesday, Mozilla temporarily blocked Flash altogether while waiting for Adobe to release patches for the latest vulnerabilities to come out of the leaked Hacking Team files.

US-CERT today updated an advisory (originally released Tuesday) about these vulnerabilities. Not only does the advisory say to prioritize security updates for the affected software, it also says to "limit Flash content" and that "updating is not sufficient, and it is important to use exploit mitigation and other defensive techniques."

And on Sunday, Facebook's security chief Alex Stamos tweeted: "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day."

2. More Sophisticated Tools In Hands Of More Attackers

The CVE-2015-5119 Flash vulnerability was used by the APT3 (a.k.a. UPS) advanced persistent threat actor in a targeted attack against the US government last week, according to Palo Alto Networks.

It isn't just the vulnerabilities that are the problem, though; it's the surveillance software Hacking Team sold to its customers -- which is, as Adam McNeil of Malwarebytes wrote, "basically nothing more than a Remote Access Trojan," like Zeus or AlienSpy.

The source code for Hacking Team's flagship product, Remote Control System (RCS), was leaked in the attack, and Malwarebytes researchers took a closer look at it. "RCS is feature-rich with surveillance capabilities and can collect or monitor most components on a personal computer or cell phone," wrote McNeil. "The software has the ability to exploit systems, execute code, destroy files, and monitor an array of peripherals, applications, and communications." 

Meanwhile, Hacking Team CEO David Vincenzetti told reporters today that "Only a part of the source code has been stolen," softening his initial, much more dire account of the attack.

RCS works on Windows, OSX, Linux, Android, Blackberry, iOS, Symbian, and Windows Phones and comes with all the typical RAT tools, like keyloggers and screenshot grabbers. It also uses anti-analysis methods. And according to McNeil, its management software is hidden behind a chain of anonymizers.

The cloaking and persistence mechanisms are impressive. According to Trend Micro Labs, RCS comes equipped with a UEFI BIOS rootkit -- and even reformatting the infected machine or replacing the disk wouldn't remove the infection.

Further, according to Malwarebytes, Hacking Team claimed that the exploit portal would always contain at least three zero-days at any time.

On the black market, any of these tools would come at a very high price and require a base level of technical knowledge to operate (except, perhaps, for the Blackshades RAT, which was ultimately undone by its own user-friendliness). However, the Hacking Team breach has not only brought the masses this tradecraft for free, it also provided extensive documentation and how-to manuals to make it easier for their customers to use the tools Hacking Team sold.

3. Secret Bitcoin Transactions Not So Secret

In the RCS 9.2 upgrade, Hacking Team added its "Money Module," which could track cryptocurrencies like Bitcoin, and according to leaked emails "is able to collect various information: list of contacts and local accounts, wallet (i.e., the money) and the history of transactions."

Money Module has been available since January 2014.

4. Greater Concern About Government Interference With Privacy Controls

Numbered among Hacking Team's customers was the FBI. Today, it was revealed that the Bureau had enlisted the Italian company's aid in uncovering the true identity of a user of the TOR anonymization service.

Not only has the breach shown that the government is using a tool being equated to a malicious RAT, but that governments of countries with histories of significant human rights abuses -- including Egypt, Sudan, Russia, and Ethiopia -- have been sold the very same tools.