Italian Surveillance Software Maker Falls Victim To Doxing Attack

Source code for the Remote Control System (RCS) surveillance software as well as details of the international government agencies that purchased it were revealed today in an apparent doxing attack on Hacking Team, the Milan-based makers of RCS.

The dumped data revealed that Hacking Team had sold its products to several countries with poor human rights records, as well as to the FBI and U.S. Drug Enforcement Administration (DEA). Unnamed sources told Motherboard that Hacking Team has told customers to suspend use of the software, of which the newest version is named Galileo, and was previously known as Da Vinci.

In total, attackers uploaded to BitTorrent 400 gigabytes of data (and might have stolen as much as a terabyte), which also included internal documents, audio recordings, email correspondence, and employee passwords. One of the leaked files was a PowerPoint presentation explaining how the company was able to intercept communications on the Tor network, which is supposed to be anonymous. One of the leaked files was a spreadsheet, from the end of 2014, of active and inactive clients. Among those clients were police and state agencies in nations with records of human rights abuses, including Russia, Egypt, Sudan, Ethiopia, Kazakhstan, Morocco, Nigeria, and Saudi Arabia.

The attackers also hijacked Hacking Team's Twitter account, posting "Since we have nothing to hide, we're publishing all our emails, files and source code." Tweets posted by the attackers have been deleted, but the account appears to still be active as of publishing time.

Motherboard's anonymous source says the attacker seems to have compromised the client machines of two of Hacking Team's system administrators, who had complete access to the company's files. While the company has asked customers to suspend use of the product, the source said "The company, in fact, has 'a backdoor' into every customer’s software, giving it ability to suspend it or shut it down—something that even customers aren’t told about."

[Human rights are closely intertwined with Internet freedom, privacy, and encryption -- all of which are at risk. Learn more next month at Black Hat Las Vegas in sessions like "The Lifecycle of a Revolution", with Jennifer Granick of the Stanford Center for Internet and Society, "The Battle For Free Speech on the Internet," with Matthew Prince of Cloudflare, and "The NSA Playset: A Year of Toys and Tools," with Michael Ossmann of Great Scott Gadgets.]

Some are comparing this event to another recent attack against a cybersecurity company: the Duqu 2.0 nation-state attacks against Kaspersky Lab. Most are focusing on the evidence the attackers have provided for prior accusations about Hacking Team's lack of ethics when it comes to selling its product.

As Electronic Frontier Foundation (EFF) global policy analyst Eva Galperin said on Twitter, "Thank you, Anti-Surveillance Santa, for bringing me so many leaked files for Anti-Surveillance Christmas. I have been very good this year."

[Galperin's colleague, EFF legislative analyst Mark Jaycox, and Jamil Jaffer, senior Senate staffer and adjunct professor of law at George Mason University, will be investigating the topic of surveillance at Black Hat next month in their session, "Is the NSA Still Listening to Your Phone Calls? A Surveillance Debate: Congressional Success or Epic Fail."]

Hacking Team says, "We provide our software only to governments or government agencies. We do not sell products to individuals or private businesses. We do not sell products to governments or to countries blacklisted by the U.S., E.U., U.N., NATO or ASEAN." Yet, it has been suspected of breaking that last rule before. Reporters Without Borders added the company to its "Enemies of the Internet" list in 2012.

The RCS product is essentially spyware. The company itself describes RCS as "a solution designed to evade encryption by means of an agent directly installed on the device to monitor. Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."

Some of the governments listed in Hacking Team's purported customer list are given scathing reviews in the United Nations' Human Rights Watch 2015 World Report. For example, the report says that Egypt is in a "human rights crisis, the most serious in the country’s modern history" and described how "security forces and an increasingly politicized judiciary ... invoked national security to muzzle nearly all dissent." The report states "Sudan saw no progress in its abysmal rights record ... and authorities continued to stifle civil society and independent media." As for Russia, it states "The Kremlin took another leap backward in 2014 by intensifying its crackdown on civil society, media, and the Internet."

Great Cannon

Then there's China, which has developed its own surveillance tool, the Great Cannon.

"You hear about China and cyber espionage, [organizations] getting breached, but no one really talks too often about other things they are doing that are really outlandish, like the redirection of traffic to block things" that are counter to the Chinese government regime, Adam Meyers, vice president of intelligence at CrowdStrike told Dark Reading.

"The Chinese have basically taken a lot of DNS traffic generated by the Great Firewall," he says. The massive, five-day distributed denial-of-service attack earlier this year on Github was an example where China employed its Great Cannon to block Chinese citizens from accessing a tool housed there for bypassing the Great Firewall. "That was a pretty aggressive move on the part of China."

So when a Chinese citizen tries to visit a site that the Chinese government doesn’t approve of, it redirects the traffic. "They are redirecting traffic and attacking [sites] that are not in line with" the government’s views, he says.

"It’s not really an espionage tool. But it could be a smokescreen for a broader espionage campaign, possibly," Meyers says of China's Great Cannon.

Meyers says CrowdStrike’s senior intel analyst Adam Kozy and junior researcher Johannes Gilger, in their Black Hat talk next month will reveal both technical and cultural aspects of China's Great Cannon. 

Kelly Jackson Higgins contributed to this article.