Английская Википедия:Hacking Team
Шаблон:Short description Шаблон:Use dmy dates Шаблон:Infobox company HackingTeam was a Milan-based information technology company that sold offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.[1] Its "Remote Control Systems" enable governments and corporations to monitor the communications of internet users, decipher their encrypted files and emails, record Skype and other Voice over IP communications, and remotely activate microphones and camera on target computers.[2] The company has been criticized for providing these capabilities to governments with poor human rights records,[3] though HackingTeam states that they have the ability to disable their software if it is used unethically.[4][5] The Italian government has restricted their licence to do business with countries outside Europe.[6]
HackingTeam employs around 40 people in its Italian office, and has subsidiary branches in Annapolis, Washington, D.C., and Singapore.[7] Its products are in use in dozens of countries across six continents.[8]
Company foundation
HackingTeam was founded in 2003 by Italian entrepreneurs Vincenzetti and Valeriano Bedeschi. In 2007 the company was invested by two Italian VC: Fondo Next and Innogest.[9]
The Milan police department learned of the company. Hoping to use its tool to spy on Italian citizens and listen to their Skype calls, the police contacted Vincenzetti and asked him to help.[10] HackingTeam became "the first sellers of commercial hacking software to the police”.
According to former employee Byamukama Robinhood, the company began as security services provider, offering penetration testing, auditing and other defensive capabilities to clients.[11] Byamukama states that as malware and other offensive capabilities were developed and accounted for a larger percentage of revenues, the organization pivoted in a more offensive direction and became increasingly compartmentalized. Byamukama claims fellow employees working on aspects of the same platform – for example, Android exploits and payloads – would not communicate with one another, possibly leading to tensions and strife within the organization.[11]
In February 2014, a report from Citizen Lab identified the organisation to be using hosting services from Linode, Telecom Italia, Rackspace, NOC4Hosts and bullet proof hosting company Santrex.[12]
On 5 July 2015 the company suffered a major data breach of customer data, software code, internal documents and e-mails. (See: § 2015 data breach)
On 2 April 2019 HackingTeam was acquired by InTheCyber Group to create Memento Labs [13]
Products and capabilities
Hacking Team enables clients to perform remote monitoring functions against citizens via their RCS (remote control systems), including their Da Vinci and Galileo platforms:[1]
- Covert collection of emails, text message, phone call history and address books
- Keystroke logging
- Uncover search history data and take screenshots
- Record audio from phone calls
- Capture audio and video stream from device memory to bypass cryptography of Skype sessions[14]
- Use microphones on device to collect ambient background noise and conversations
- Activate phone or computer cameras
- Hijack telephone GPS systems to monitor target's location
- Infect target computer's UEFI BIOS firmware with a rootkit[15]
- Extract WiFi passwords[16]
- Exfiltrate Bitcoin and other cryptocurrency wallet files to collect data on local accounts, contacts and transaction histories[17]
HackingTeam uses advanced techniques to avoid draining cell phone batteries, which could potentially raise suspicions, and other methods to avoid detection.[18][19]
The malware has payloads for Android,[16] BlackBerry, Apple iOS, Linux, Mac OS X, Symbian, as well as Microsoft Windows, Windows Mobile and Windows Phone class of operating systems.[20]
RCS is a management platform that allows operators to remotely deploy exploits and payloads against targeted systems, remotely manage devices once compromised, and exfiltrate data for remote analysis.
Controversies
Use by repressive governments
HackingTeam has been criticized for selling its products and services to governments with poor human rights records, including Sudan, Bahrain, Venezuela, and Saudi Arabia.[21]
In June 2014, a United Nations panel monitoring the implementation of sanctions on Sudan requested information from HackingTeam about their alleged sales of software to the country in contravention of United Nations weapons export bans to Sudan. Documents leaked in the 2015 data breach of HackingTeam revealed the organization sold Sudanese National Intelligence and Security Service access to their "Remote Control System" software in 2012 for 960,000 Euros.[21]
In response to the United Nations panel, the company responded in January 2015 that they were not currently selling to Sudan. In a follow-up exchange, HackingTeam asserted that their product was not controlled as a weapon, and so the request was beyond the scope of the panel. There was no need for them to disclose previous sales, which they considered confidential business information.[21]
The U.N. disagreed. "The view of the panel is that as such software is ideally suited to support military electronic intelligence (ELINT) operations it may potentially fall under the category of 'military ... equipment' or 'assistance' related to prohibited items," the secretary wrote in March. "Thus its potential use in targeting any of the belligerents in the Darfur conflict is of interest to the Panel."[21][22]
In the fall of 2014, the Italian government abruptly froze all of HackingTeam's exports, citing human rights concerns. After lobbying Italian officials, the company temporarily won back the right to sell its products abroad.[21]
2015 data breach
On July 5, 2015, the Twitter account of the company was compromised by an unknown individual who published an announcement of a data breach against HackingTeam's computer systems. The initial message read, "Since we have nothing to hide, we're publishing all our e-mails, files, and source code ..." and provided links to over 400 gigabytes of data, including alleged internal e-mails, invoices, and source code; which were leaked via BitTorrent and Mega.[23] An announcement of the data breach, including a link to the bittorrent seed, was retweeted by WikiLeaks and by many others through social media.[24][25]
The material was voluminous and early analysis appeared to reveal that HackingTeam had invoiced the Lebanese Army[26] and Sudan and that spy tools were also sold to Bahrain and Kazakhstan.[25] HackingTeam had previously claimed they had never done business with Sudan.[27]
The leaked data revealed a zero-day cross-platform Flash exploit (CVE number: Шаблон:CVE.[28] The dump included a demo of this exploit by opening Calculator from a test webpage.[29][30][31] Adobe patched the hole on July 8, 2015.[32] Another vulnerability involving Adobe was revealed in the dumps, which took advantage of a buffer overflow attack on an Adobe Open Type Manager DLL included with Microsoft Windows. The DLL is run in kernel mode, so the attack could perform privilege escalation to bypass the sandbox.[33]
Also revealed in leaked data was HackingTeam employees' use of weak passwords, including 'P4ssword', 'wolverine', and 'universo'.[34]
After a few hours without response from HackingTeam, member Christian Pozzi tweeted the company was working closely with police and "what the attackers are claiming regarding our company is not true."[35][36] He also claimed the leaked archive "contains a virus" and that it constituted "false info".[37] Shortly after these tweets, Pozzi's Twitter account itself was apparently compromised.[38]
Responsibility for this attack was claimed by the hacker known as "Phineas Fisher" (or Phisher) on Twitter.[39] Phineas has previously attacked spyware firm Gamma International, who produce malware, such as FinFisher, for governments and corporations.[40] In 2016, Phineas published details of the attack, in Spanish and English, as a "how-to" for others, and explained the motivations behind the attack.[41][42]
The internal documents revealed details of HackingTeam's contracts with repressive governments.[43] In 2016, the Italian government again revoked the company's license to sell spyware outside of Europe without special permission.[6][44]
Use by Mexican drug cartels
Corrupt Mexican officials have helped drug cartels obtain state-of-the-art spyware (including Hacking Team spyware). The software has been used to target and intimidate Mexican journalists by drug cartels and cartel-entwined government actors.[45]
Customer list
HackingTeam's clientele include not just governments, but also corporate clients such as Barclays and British Telecom (BT) of the United Kingdom, as well as Deutsche Bank of Germany.[1]
A full list of HackingTeam's customers were leaked in the 2015 breach. Disclosed documents show HackingTeam had 70 current customers, mostly military, police, federal and provincial governments. The total company revenues disclosed exceeded 40 million Euros.[46][47][48][49][50][51]
On Sep 8, 2021, SentinelLABS released a research report about a Turkish threat actor EGoManiac, that used Remote Control System (RCS), software from the Italian infosec firm Hacking Team, which was operated between 2010 and 2016 and campaign run by Turkish TV journalists at OdaTV for spying Turkish police.[52]
Customer | Country | Area | Agency | Year of first sale | Annual maintenance fees | Total client revenues |
---|---|---|---|---|---|---|
Polizia Postale e delle Comunicazioni[53] | Italy | Europe | LEA | 2004 | €100,000 | €808,833 |
Centro Nacional de Inteligencia[54] | Spain | Europe | Intelligence | 2006 | €52,000 | €538,000 |
Infocomm Development Authority of Singapore | Singapore | APAC | Intelligence | 2008 | €89,000 | €1,209,967 |
Information Office | Hungary | Europe | Intelligence | 2008 | €41,000 | €885,000 |
CSDN | Morocco | MEA | Intelligence | 2009 | €140,000 | €1,936,050 |
UPDF (Uganda Peoples Defense Force), ISO (Internal Security Organization), Office of the President | Uganda | Africa | Intelligence | 2015 | €731,000 | €920,197 |
Italy - DA - Rental | Italy | Europe | Other | 2009 | €50,000 | €628,250 |
Malaysian Anti-Corruption Commission | Malaysia | APAC | Intelligence | 2009 | €77,000 | €789,123 |
PCM | Italy | Europe | Intelligence | 2009 | €90,000 | €764,297 |
SSNS - Ungheria | Hungary | Europe | Intelligence | 2009 | €64,000 | €1,011,000 |
CC - Italy | Italy | Europe | LEA | 2010 | €50,000 | €497,349 |
Al Mukhabarat Al A'amah | Saudi Arabia | MEA | Intelligence | 2010 | €45,000 | €600,000 |
IR Authorities (Condor) | Luxembourg | Europe | Other | 2010 | €45,000 | €446,000 |
La Dependencia y/o CISEN[55] | Mexico | LATAM | Intelligence | 2010 | €130,000 | €1,390,000 |
UZC[56] | Czech Republic | Europe | LEA | 2010 | €55,000 | €689,779 |
Egypt - MOD[56] | Egypt | MEA | Other | 2011 | €70,000 | €598,000 |
Federal Bureau of Investigation[57] | USA | North America | LEA | 2011 | €100,000 | €697,710 |
Oman - Intelligence | Oman | MEA | Intelligence | 2011 | €30,000 | €500,000 |
President Security[58][59] | Panama | LATAM | Intelligence | 2011 | €110,000 | €750,000 |
Turkish National Police | Turkey | Europe | LEA | 2011 | €45,000 | €440,000 |
UAE - MOI | UAE | MEA | LEA | 2011 | €90,000 | €634,500 |
National Security Service[56] | Uzbekistan | Europe | Intelligence | 2011 | €50,000 | €917,038 |
Department of Defense[57] | USA | North America | LEA | 2011 | €190,000 | |
Bayelsa State Government | Nigeria | MEA | Intelligence | 2012 | €75,000 | €450,000 |
Estado de Mexico | Mexico | LATAM | LEA | 2012 | €120,000 | €783,000 |
Information Network Security Agency | Ethiopia | MEA | Intelligence | 2012 | €80,000 | €750,000 |
State security (Falcon) | Luxemburg | Europe | Other | 2012 | €38,000 | €316,000 |
Italy - DA - Rental | Italy | Europe | Other | 2012 | €60,000 | €496,000 |
MAL - MI | Malaysia | APAC | Intelligence | 2012 | €77,000 | €552,000 |
Direction générale de la surveillance du territoire | Morocco | MEA | Intelligence | 2012 | €160,000 | €1,237,500 |
National Intelligence and Security Service[56] | Sudan | MEA | Intelligence | 2012 | €76,000 | €960,000 |
Russia - KVANT[60] | Russia | Europe | Intelligence | 2012 | €72,000 | €451,017 |
Saudi - GID | Saudi | MEA | LEA | 2012 | €114,000 | €1,201,000 |
SIS of National Security Committee of Kazakhstan[56] | Kazakhstan | Europe | Intelligence | 2012 | €140,000 | €1,012,500 |
The 5163 Army Division (Alias of South Korean National Intelligence Service)[56][61][62] | S. Korea | APAC | Other | 2012 | €67,000 | €686,400 |
UAE - Intelligence | UAE | MEA | Other | 2012 | €150,000 | €1,200,000 |
Central Intelligence Agency | USA | North America | Intelligence | 2011 | ||
Drug Enforcement Administration[57][63] | USA | North America | Other | 2012 | €70,000 | €567,984 |
Central Anticorruption Bureau | Poland | Europe | LEA | 2012 | €35,000 | €249,200 |
MOD Saudi | Saudi | MEA | Other | 2013 | €220,000 | €1,108,687 |
PMO | Malaysia | APAC | Intelligence | 2013 | €64,500 | €520,000 |
Estado de Querétaro | Mexico | LATAM | LEA | 2013 | €48,000 | €234,500 |
National Security Agency[56] | Azerbaijan | Europe | Intelligence | 2013 | €32,000 | €349,000 |
Gobierno de Puebla | Mexico | LATAM | Other | 2013 | €64,000 | €428,835 |
Gobierno de Campeche | Mexico | LATAM | Other | 2013 | €78,000 | €386,296 |
AC Mongolia | Mongolia | APAC | Intelligence | 2013 | €100,000 | €799,000 |
Dept. of Correction Thai Police | Thailand | APAC | LEA | 2013 | €52,000 | €286,482 |
National Intelligence Secretariat[64] | Ecuador | LATAM | LEA | 2013 | €75,000 | €535,000 |
Police Intelligence DirectorateШаблон:Citation needed | Colombia | LATAM | LEA | 2013 | €35,000 | €335,000 |
Guardia di Finanza | Italy | Europe | LEA | 2013 | €80,000 | €400,000 |
Intelligence[65] | Cyprus | Europe | LEA | 2013 | €40,000 | €375,625 |
MidWorld[66] | Bahrain | MEA | Intelligence | 2013 | €210,000 | |
Mexico - PEMEX | Mexico | LATAM | LEA | 2013 | €321,120 | |
Malysia K | Malaysia | APAC | LEA | 2013 | €0 | |
Honduras | Honduras | LATAM | LEA | 2014 | €355,000 | |
Mex Taumalipas | Mexico | LATAM | 2014 | €322,900 | ||
Secretaría de Planeación y Finanzas | Mexico | LATAM | LEA | 2014 | €91,000 | €371,035 |
AREA | Italia | Europe | 2014 | €430,000 | ||
Mexico Yucatán | Mexico | LATAM | LEA | 2014 | €401,788 | |
Mexico Durango | Mexico | LATAM | LEA | 2014 | €421,397 | |
Investigations Police of Chile | Chile | LATAM | LEA | 2014 | €2,289,155 | |
Jalisco Mexico | Mexico | LATAM | LEA | 2014 | €748,003 | |
Royal Thai Army | Thailand | APAC | LEA | 2014 | €360,000 | |
Vietnam GD5 | Vietnam | APAC | 2014 | €281,170 | ||
Kantonspolizei Zürich | Switzerland | Europe | LEA | 2014 | €486,500 | |
Vietnam GD1 | Vietnam | APAC | LEA | 2015 | €543,810 | |
Egypt TRD GNSE | Egypt | MEA | LEA | 2015 | €137,500 | |
Lebanese Army | Lebanon | MEA | LEA | 2015 | ||
Federal Police Department | Brazil | LATAM | LEA | 2015 | ||
National Anticorruption Directorate | Romania | DNA | Intelligence | 2015 | ||
State Informative Service[67] | Albania | Europe | SHIK | 2015 | ||
Danish National Police[68] | Denmark | Europe | 2015 | €570,000 |
See also
- FinFisher
- MiniPanzer and MegaPanzer
- Vupen – 0-day exploit provider linked to HackingTeam[69]
- Mamfakinch – a citizen media organization targeted with malware allegedly developed by HackingTeam[70]
References
External links
- Шаблон:Official website
- HackingTeam Archives - investigative reports published by The Citizen Lab
- ↑ 1,0 1,1 1,2 Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite magazine
- ↑ Шаблон:Cite web
- ↑ 6,0 6,1 Шаблон:Cite web
- ↑ Human Rights Watch (25 March 2014). "They Know Everything We Do". Retrieved 1 August 2015.
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite news
- ↑ Шаблон:Cite web
- ↑ 11,0 11,1 Farivar, Cyrus (20 July 2015) HackingTeam goes to war against former employees, suspects some helped hackers. Ars Technica. Retrieved 26 July 2015.
- ↑ Шаблон:Cite news
- ↑ Шаблон:Cite news
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 16,0 16,1 "Advanced spyware for Android now available to script kiddies everywhere". Ars Technica. Retrieved 2 August 2015.
- ↑ Farivar, Cyrus (14 July 2015). "HackingTeam broke Bitcoin secrecy by targeting crucial wallet file". Ars Technica. Retrieved 26 July 2015.
- ↑ Шаблон:Cite news
- ↑ Шаблон:Cite web
- ↑ Guarnieri, Claudio; Marquis-Boire, Morgan (13 January 2014). "To Protect And Infect: The militarization of the Internet". At the 30th Chaos Communications Congress – "30C3". (Video or Audio). Chaos Computer Club. Retrieved 15 August 2015.
- ↑ 21,0 21,1 21,2 21,3 21,4 Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite tweet
- ↑ 25,0 25,1 Шаблон:Cite web
- ↑ Шаблон:Twitter
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite tweet
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Jone Pierantonio. "Ecco chi ha bucato HackingTeam" Шаблон:Webarchive. International Business Times. Retrieved 2 August 2015.
- ↑ Ediciones El País (8 July 2015). "HackingTeam: “Ofrecemos tecnología ofensiva para la Policía”". El País. Retrieved 2 August 2015.
- ↑ "The HackingTeam leak shows Mexico was its top client, but why?". Fusion. Retrieved 2 August 2015.
- ↑ 56,0 56,1 56,2 56,3 56,4 56,5 56,6 "Leaked emails from security firm HackingTeam show government use - Fortune". Fortune. Retrieved 2 August 2015.
- ↑ 57,0 57,1 57,2 "Leaked Documents Show FBI, DEA and U.S. Army Buying Italian Spyware". The Intercept. Retrieved 2 August 2015.
- ↑ "HackingTeam's Equipment Got Stolen in Panama". Motherboard. Retrieved 2 August 2015.
- ↑ Molina, Thabata (13 August 2015). "Panama to Investigate Martinelli in HackingTeam Spying Scandal". Panama Post. Retrieved 15 August 2015.
- ↑ "HackingTeam apparently violated EU rules in sale of spyware to Russian agency". Ars Technica. Retrieved 2 August 2015.
- ↑ "How HackingTeam Created Spyware that Allowed the FBI To Monitor Tor Browser". The Intercept. Retrieved 2 August 2015.
- ↑ McGrath, Ben (25 July 2015). "Further revelations in South Korean hacking scandal". World Socialist Web Site. Retrieved 26 July 2015.
- ↑ "The DEA Just Cancelled Its Contract With HackingTeam". Motherboard. Retrieved 2 August 2015.
- ↑ * Шаблон:Citation
- ↑ In Cyprus (11 July 2015).Intelligence Service chief steps down Шаблон:Webarchive. Retrieved 26 July 2015.
- ↑ Bahrain Center for Human Rights (15 July 2015). "HackingTeam's troubling connections to Bahrain" IFEX. Retrieved 26 July 2015.
- ↑ Lexime (14 July 2015). "Burime të sigurta, SHISH përdor programet përgjuese që prej 2015. HackingTeams: Nuk e kemi nën kontroll sistemin!" (video). BalkanWeb. Retrieved 27 July 2015.
- ↑ Шаблон:Cite news
- ↑ HackingTeam: a zero-day market case study, Vlad Tsyrklevich's blog
- ↑ Perlroth, Nicole (10 October 2012). Ahead of Spyware Conference, More Evidence of Abuse. The New York Times (Bits).
- Английская Википедия
- Computer security software
- Spyware
- Surveillance
- Trojan horses
- Espionage techniques
- Espionage devices
- Malware toolkits
- Computer access control
- Cyberwarfare
- Espionage scandals and incidents
- Companies based in Milan
- Software companies established in 2003
- Italian companies established in 2003
- Страницы, где используется шаблон "Навигационная таблица/Телепорт"
- Страницы с телепортом
- Википедия
- Статья из Википедии
- Статья из Английской Википедии