Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Technology

Hacking Team Hacked, Attackers Grab 400GB of Internal Data 95

Posted by Soulskill from the bet-they-have-a-case-of-the-mondays dept.
Several readers sent word that notorious surveillance company Hacking Team has itself been hacked. Attackers made off with 400GB worth of emails, documents, and source code. The company is known for providing interception tools to government and law enforcement agencies. According to the leaked files, Hacking Team has customers in Egypt, South Korea, Kazakhstan, Saudi Arabia, Oman, Lebanon, Mongolia, Russia, Germany, Sudan, and the United States — to name a few. It has been labeled an enemy of the internet by Reporters Without Borders. "Clients have had their passwords exposed as well, as several documents related to contracts and configurations have been circulating online." Nobody knows yet who perpetrated the hack.
This discussion has been archived. No new comments can be posted.

Hacking Team Hacked, Attackers Grab 400GB of Internal Data More

Hacking Team Hacked, Attackers Grab 400GB of Internal Data

Comments Filter:

  • Find the source code on GitHub (Score:5, Informative)

    by Anonymous Coward on Monday July 06, 2015 @08:01AM (#50053199)

    Someone started uploading all the HackingTeam source code to GitHub: https://github.com/hackedteam?... [github.com]
    There are also some signing keys for kernel drivers in here.

    That's a bad day for Hacking Team and a good day for everyone else.

    • >> https://github.com/hackedteam/... [github.com]
      >> https://github.com/hackedteam/... [github.com]

      ndisk, eh? With a couple of components to collect, report and transmit?

      This thing kind of looks like the kit used in Shamoon, Sony, Icefog/Korea, etc.

    • Brilliant, people can start translating the comments in the source code from Italian [github.com] to English! Would be even funnier it people started filing issues and fix bugs in their code.

      But more to the point, will this help bona fide security researchers with their work on fighting exploits on all platforms or is there not much of interest there? Any experts on the matter?

      • Re:Find the source code on GitHub (Score:4, Funny)

        by johanw ( 1001493 ) on Monday July 06, 2015 @08:35AM (#50053495)

        Some 0-day leaks were found too, so I think MS will be quick to patch them.

      • >> people can start translating the comments in the source code from Italian to English!

        Really, you can't follow the code without English comments?

        >> will this help bona fide security researchers with their work on fighting exploits on all platforms?

        It gives us a couple more signatures to look for. I'm really getting sick of the "fake driver" vector though; it's 2015 and still trivial to get Windows platforms to cough up anything you'd want. As long as AV vendors ignore things like this (e.g.,

        • Re: (Score:1)

          by Anonymous Coward

          >> people can start translating the comments in the source code from Italian to English!

          Really, you can't follow the code without English comments?

          Surely if it needed comments in the first place then it implies that the code isn't easy to follow, even for the original author.

          • Re: (Score:1, Troll)

            by xxxJonBoyxxx ( 565205 )

            >> Surely if it needed comments in the first place then it implies that the code isn't easy to follow

            (facepalm)

        • Re:Find the source code on GitHub (Score:4, Informative)

          by jimbolauski ( 882977 ) on Monday July 06, 2015 @09:06AM (#50053799) Journal

          Really, you can't follow the code without English comments?

          I pray you don't write any software that other people have to use. Most companies will flat out reject code if it has not been properly documented.

          • Really, you can't follow the code without English comments?

            I pray you don't write any software that other people have to use. Most companies will flat out reject code if it has not been properly documented.

            Maybe you should have watched all the "be professional programmer" webinars.

        • Re:Find the source code on GitHub (Score:5, Insightful)

          by dunkelfalke ( 91624 ) on Monday July 06, 2015 @09:14AM (#50053859)

          Comments aren't there for following the code - even a code monkey like me can do that. They are to explain the reasoning behind the code.

          • They are to explain the reasoning behind the code.

            This is a huge purpose for comments. Also, maybe I can interpret the code perfectly well without comments. How well can I depend on everyone else who is modifying the code to be able to interpret it properly.

            Well-documented code helps protect it from the introduction of bugs by later contributors.

            • They are to explain the reasoning behind the code.

              This is a huge purpose for comments. Also, maybe I can interpret the code perfectly well without comments. How well can I depend on everyone else who is modifying the code to be able to interpret it properly.

              Well-documented code helps protect it from the introduction of bugs by later contributors.

              Imagine comments like "Manager asked me to implement this to make it easier for to target " Not so interesting wrt the code, very useful though for anyone interested in the meta game.

              I bet theres all kinds of incriminating stuff in there of no interest to programmers.

        • >> people can start translating the comments in the source code from Italian to English!

          Really, you can't follow the code without English comments?

          >> will this help bona fide security researchers with their work on fighting exploits on all platforms?

          It gives us a couple more signatures to look for. I'm really getting sick of the "fake driver" vector though; it's 2015 and still trivial to get Windows platforms to cough up anything you'd want. As long as AV vendors ignore things like this (e.g., https://www.google.com/webhp?s... [google.com]) it will continue to be easy for nearly anyone to write their own "advanced persistent threat."

          Comments often contain all kinds of juicy info. Its not about following the code its about getting insights into all kinds of non-code related things.

      • Brilliant, people can start translating the comments in the source code from Italian [github.com] to English!

        Comments in Italian is actually a blessing for English speaking coders. Dijkstra's dictum was: "Never debug the comments. Always debug the code". (I could not find the reference, if he did not say it, someone equally great said it, because it is certainly not my original idea. ) Often comments are redundant, insanely stupid, misleading or obsolete. The only useful comments I find in my own code are along the lines of: "Yes, this function searches through the entire edge list, we tried to speed it up, but t

      • ... will this help bona fide security researchers with their work on fighting exploits on all platforms ... ?

        I wonder if this will also help people trying to write open software for closed devices? Signing keys, driver sources with spyware installed, ... Not only does it expose the malware bypassing the user's security, it may also expose the internal details of how the devices are driven and/or how to compromise the malware's and devices' anti-user "security".

        (I have often wondered how many of the closed

    • Someone started uploading all the HackingTeam source code to GitHub ... There are also some signing keys for kernel drivers in here.

      IMHO:

      Anyone with a project hosted on git hub should pull a backup copy NOW!

      Hosting this leak on git hub could lead to moves by authorities to contain it - which could have the side effect of making GitHub and/or some projects on it unavailable - temporarily or permanently.

      Better safe than sorry.

  • *What's good for the goose...*

    Schadenfreude...

  • Serves those maggots well.

    • Re:SubjectsInCommentsAreStupid (Score:5, Interesting)

      by D.McG. ( 3986101 ) on Monday July 06, 2015 @08:34AM (#50053479)
      How does a group like that not notice 400GB of traffic exiting the building? If it were done in a single day, the hackers would need to draw down 4,629,629 bytes per second sustained for 24 hours.

      • Re:SubjectsInCommentsAreStupid (Score:5, Funny)

        by s0litaire ( 1205168 ) on Monday July 06, 2015 @08:41AM (#50053543)

        Probably thought it was one of their bit-torrent clients..

        Even evil hackers require an extensive porn collection to do their job...

      • Re: SubjectsInCommentsAreStupid (Score:1)

        by Anonymous Coward

        Which is a pretty slow bandwith nowadays... I would get 400gb down in roughly 22 hours with my lazy connection at home... i could bet the involved parties both have a little more speed at hand

        • If I've got my calculations right, to complete the downloading of that amount of data in a single day, it would need a 37,9259 Mib/s bandwidth -- 37,9255 Mib/s on last 6/30 --, which is quite trivial in some places.
          • I have a friend who lives in a Condo in Toronto and his residential pipe is 100/100 for 40 bucks a month, and they offered to boost it to 400/400 for an extra 30 bucks a month, but he has no need for that much speed. (Note, this is atypical for Canada, but it's the same building Deadmau5 used to live in, and he augured to bring in a high-end ISP.)
  • It's 2015, I just finished competing in BattleBots, and this is front page news. 12 year old me would be very happy about how things are going.

    • What's your bot? (My boys and I are watching the show on ABC.)

      • What's your bot? (My boys and I are watching the show on ABC.)

        What a horrible job they did of putting that show together. Battles are only 3 minutes, but with all the commentary, backgrounders, interviews and fluff, they can only fit FOUR battles into an hour-long show. Worse, they include so much commentary they actually EXCLUDE about 1/2 the battles, and just show a few highlights from some.

        Imagine if a network covered the NBA playoffs like that? Producers at ABC certainly showed a lot of incompetence with that show.

        • I think they did a better job than CC did... and yeah we didn't pay a whole lot of attention to the commentators :) The two battles that weren't shown had a big problem: underpowered weapons. Basically very little happened.

        • Re:Yay! (Score:4, Funny)

          by jandrese ( 485 ) <kensama@vt.edu> on Monday July 06, 2015 @12:03PM (#50055437) Homepage Journal
          In other words they covered it exactly the same way they cover the Olympics?

        • What's your bot? (My boys and I are watching the show on ABC.)

          What a horrible job they did of putting that show together. Battles are only 3 minutes, but with all the commentary, backgrounders, interviews and fluff, they can only fit FOUR battles into an hour-long show. Worse, they include so much commentary they actually EXCLUDE about 1/2 the battles, and just show a few highlights from some.

          Imagine if a network covered the NBA playoffs like that? Producers at ABC certainly showed a lot of incompetence with that show.

          Let me guess, they also flick the video fast never lingering on a single scene for more than a few seconds so you can't really follow anything?

        • And yet, it's still better than pretty much any reality show on TV. Not saying much, I know, but I'd rather watch Battlebots (poorly put together or not) than Survivor: Yet Another Location.

        • The battles don't need to be longer than 3 minutes. I think there was a single match so far that went to a split decision and could have benefited from an extra minute.

          ABC excluded less interesting preliminary fights. Now that a viewing audience has built up all the matches get shown.

  • Monty Python. (Score:5, Funny)

    by Ukab the Great ( 87152 ) on Monday July 06, 2015 @08:07AM (#50053229)

    We apologize for corporate and govt data breeches. Those responsible have been
    hacked.

    ---

    We apologise again for the data breeches. Those responsible for hacking
    the people who have just been hacked,
    have been hacked.

  • 400GB (Score:3)

    by troon ( 724114 ) on Monday July 06, 2015 @08:32AM (#50053449)

    "400GB worth of emails, documents, and source code"

    Seems unlikely. There's going to be a lot of... binary data in there, surely.

    • "400GB worth of emails, documents, and source code"

      Seems unlikely. There's going to be a lot of... binary data in there, surely.

      They got it all from /dev/null and used compression.

    • Re: (Score:1)

      by AmiMoJo ( 196126 )

      Git repositories, with history going back... Now on Github for your convenience: https://github.com/hackedteam?... [github.com]

    • Re: (Score:2)

      by jandrese ( 485 )
      If you think 400GB of email alone is too much you clearly have never worked in a company that allows you to mail powerpoints around.

  • de haxx0rz be haxx0red na0 (Score:1)

    by Anonymous Coward

    Not anybody knows what really happened. It's an excuse to bandy around meaningless but scary-sounding terms yet once more. Any excuse will do.

  • GeoTrust signing keys (Score:4, Interesting)

    by fulldecent ( 598482 ) on Monday July 06, 2015 @09:01AM (#50053757) Homepage

    Can someone please explain the significance and consequences of publishing this:

    GeoTrust_SigningCertificateExported_2011.pfx

    https://github.com/hackedteam/... [github.com]

    • Re: (Score:1)

      by Anonymous Coward

      Can someone please explain the significance and consequences of publishing this:

      It means that anything signed by that key can't be trusted and probably contains a government Trojan.

      • Re:GeoTrust signing keys (Score:4, Interesting)

        by mwvdlee ( 775178 ) on Monday July 06, 2015 @10:46AM (#50054657) Homepage

        From the looks of it, this key seems to be used for signing Windows binaries, not for SSL certificates.
        Surely somebody more knowledgeable can confirm or deny this?

        • Re:GeoTrust signing keys (Score:4, Informative)

          by Anonymous Coward on Monday July 06, 2015 @11:08AM (#50054861)

          It's confirmed. One of the news stories (can't remember which one) said that HT would recommend that their clients purchase digital certs to sign the malware they bought in order to skirt anti-virus scans. Apparently most antivirus software will ignore legitamite looking signed apps with certs that have been timestamped. The GeoTrust cert is probably a test cert that HT uses.

      • Re: (Score:1)

        by Anonymous Coward

        Certificate has been revoked. It is also only valid for code signing.

        The significance should be nil by now

        • Re: (Score:1)

          by Anonymous Coward

          Do you have a link to this information?

    • Re:GeoTrust signing keys (Score:4, Informative)

      by dissy ( 172727 ) on Monday July 06, 2015 @11:47AM (#50055255)

      Can someone please explain the significance and consequences of publishing this:
      GeoTrust_SigningCertificateExported_2011.pfx

      It's another couple good patters for antivirus software to look for and trigger upon finding.
      Anyone infected with their rootkitted drivers four years ago and haven't had the malware update may find out about being infected with it.

      If they used the same company name for their 2015 certificate as is used in the certs published, that would be another signature for AV software to trigger on if they kept your rootkitted drivers updated.

      That's about it however.

      The certificate is long expired so can't be used to sign any new code with.
      You can also be pretty certain their next certificate (to be issued any day now, if not already) will be under a different name as well.

  • It's a lame attempt at coolness, like "Black Asphalt" as a code for stealing random drivers' money during traffic stops. The name "Hacking Team" does not make it an actual hacking team.

  • apple issued enterprise dev cert to ht (Score:2, Informative)

    by Anonymous Coward

    https://twitter.com/FredericJa... [twitter.com]

    Subject: UID=DE9J4B8GTF, CN=iPhone Distribution: HT srl, OU=DE9J4B8GTF, O=HT srl, C=IT

  • Oh ya, we're fucked.

  • 51603bff88e0a1b3bad3962614978929c9d26955 (Score:1)

    by Anonymous Coward

    magnet [magnet]

  • Kevin Mitnick's twitter has this update:

    https://twitter.com/kevinmitni... [twitter.com]

  • From first link: "Hacking Team's Christian Pozzi was personally exposed by the incident, as the security engineer's [poor quality, easily guessed] password store from Firefox was published as part of the massive data dump. The websites indexed include social media (Live, Facebook, LinkedIn), financial (banks, PayPal), and network related (routers with default credentials)."

    What kind of security conscious person uses Firefox for storing important passwords, let alone someone calling themselves a security en

    • please elaborate on why it's dangerous to store passwords protected by a strong password in firefox sync. mozilla have no access to decrypted passwords, nobody has. the code is open source and the server can be your own instead of mozilla's.

  • Looks like some interesting stuff in there for Android, but none of it will now qualify for the Android Security Rewards Program: "Bugs initially disclosed publicly, or to a third-party for purposes other than fixing the bug, will typically not qualify for a reward." Source: http://www.google.com/about/ap... [google.com]
    • I doubt Google will fix them anyway, if they are on a carrier-locked device. They haven't even fixed TLS on the system default browser on a lot of their devices. 80% of Android installs are abandonware.

Slashdot Top Deals

"The vast majority of successful major crimes against property are perpetrated by individuals abusing positions of trust." -- Lawrence Dalzell

Close