When Predator Becomes Prey

The controversial Italian surveillance company Hacking Team, which sells spyware to governments all around the world, including agencies in Ethiopia, Morocco, the United Arab Emirates, as well as the US Drug Enforcement Administration, has been seriously hacked. Hackers have made 400GB of client files, contracts, financial documents, and internal emails, some as recent as 2015, publicly available for download.

What’s more interesting, the unknown hackers announced their feat through Hacking Team’s own Twitter account. 

Torrent Links


Source Codes

Wikileaks released over one million searchable emails from spyware contractor  #HackingTeam Click Here

Last year, a hacker who only went by the name “PhineasFisher” hacked the controversial surveillance tech company Gamma International, a British-German surveillance company that sells the spyware software FinFisher. He then went on to leak more than 40GB of internal data from the company, which has been long criticized for selling to repressive governments.

That same hacker has now claimed responsibility for the breach of Hacking Team, that sells a similar product called Remote Control System Galileo.

So how on earth HT got hacked ?

The attacker who stole Hacking Team's data gained access to an employee's computer while the victim was still logged in.

The attacker either had direct physical access to security engineer Christian Pozzi's PC or they used malware to achieve a similar level of access. Whichever way it was, it seems that Christian was logged in at the time simply by looking at a folder name among the files that were leaked onto the internet.

Christian's password files have been published online and most commentators have focussed on the low quality of many of these passwords. However, look at the folder in which these files were stored: /Truecrypt Volume/.

Christian stored his passwords in text files that were encrypted inside a TrueCrypt volume. Presumably Christian felt that such valuable data should be protected, and he'd be right. But there are clearly security limitations to using encrypted volumes. It is very likely that the victim was logged in and had opened this volume when the files were stolen. 

The lesson to learn from this story is that even excellent encryption has its limits. Hard disk encryption is great for protecting lost or stolen computers and disks, but it won't hinder attackers who have access to your computer while you are logged in. Whether they creep over to your desk during a rest break, or install malware remotely over the internet, it amounts to the same thing.

Benefit from Hacking Team's failure by reconsidering the wisdom of storing passwords on the computer. That last recommendation is not trivial to implement and most likely will include some level of white-listing, which can be effective but a pain to implement - either for the administrator or the user.

Flame: The new dimension of Cyber espionage?

A nation-state is most likely to blame for unleashing "Flame" on the World Wide Web. Iran appears to be the primary target of the data-snatching virus that has swept through the Middle East, though other countries have also been affected. The sheer complexity of the virus and its targets made the security researchers believe that it seems, a state is behind the attack.

Kaspersky first spotted the virus in 2010, though it may have been wrecking havoc on computer systems for many years. Kaspersky Lab was initially searching for a different form of malware. Kaspersky has earlier reported about the "Stuxnet". Malware researchers of Kaspersky Labs were aware of the malware that had spread throughout the Middle East, attacked hundreds of computers and wiped their hard drives, making the systems unbootable after that. 

It was actually after an inquiry from the International Telecommunications Union, which is a part of the United Nations, who actually requested the Kaspersky Lab to start conducting research. Flame is on the same level as the notoriously known Stuxnet and Duqu, hence Kaspersky Labs suspect that there is a nation state behind the development of this cyber attack, and there are reasons for that. 

There are traditional cyber criminals who are hunting users’ data (like log-ins and passwords) to access bank accounts over the Internet and steal money, send spam, or conduct dubious attacks. Flame doesn’t fit into the group of traditional cyber criminal malware. Also, it doesn’t fit into the activists’ malware who are using typically free and open source tools to attack computers on the Internet. And the third known group at this time is nation-states. 

Flame is undoubtedly pretty advanced – one of the most sophisticated examples of malware ever seen. File size over 20 megabytes, when sum up all the sizes of the modules that are part of the attacking toolkit. It’s very big compared to Stuxnet, which was just hundreds of kilobytes of code: it’s over 20 megabyes. It’s also quite unique in the way it steals information. It’s possible to steal different types of information with the help of this spyware tool. It can record audio if a microphone is attached to the infected system, it can do screen captures and transmit visual data. It can steal information from the input boxes when they are hidden behind asterisks, password fields; it can get information from there.Also it can scan for locally visible Bluetooth devices if there is a Bluetooth adapter attached to the local system. Flame is an universal attacking tool kit used mostly for cyber espionage

Stuxnet and Duqu were bright examples of cyber weapons which could even physically destroy infrastructure, and Flame is a continuation of this story. So this is another development in this roe which continues in addition to Stuxnet and Duqu.There are also nation stations supporting these developments. 

Cyber warfare has been going on for years already. People were just probably not aware of it because cyber warfare has a unique feature: it’s hidden. Nobody knows when cyber warfare operations are going on. 

Recently an in depth study has been conducted by Laboratory of Cryptography and System Security at Hungary's University of Technology and Economics. Find the document here

Mr. Alexander Gostev from Kaspersky Labs has given a brief overview about Flame which can be found here

Honestly humanity is losing, because we are fighting between each other instead of fighting against global problems which everyone faces in their lives.

Operation Global Blackout

Operation Global Blackout, planned for March 31, is apparently a protest against “SOPA, Wallstreet, our irresponsible leaders and the beloved bankers who are starving the world for their own selfish needs”.

So how serious are these threats?

Well, for a start, it’s worth pointing out that the date of the take-down could be an indication of an April Fools joke – albeit one day early. And then there are the suggestions that whoever published the announcement does not really represent Anonymous. Instead, they appear just to be using Anonymous' name and reputation to give their anti-SOPA campaign some publicity.

But even if the plans of “Anonymous” don’t come to fruition, would their take-down methods actually work? Is it possible to shut down the internet?

At the top of the hierarchy are the 13 root servers that Anonymous is apparently going to target. The idea is that if you take down all 13 root DNS servers, domain name resolution for the internet would eventually fail.Of course, we shouldn’t discount Anonymous' ability to marshall many botnets to an attack, but for this particular attack to succeed, an enormous number of bots would be needed.

Finally, even if the root servers could be brought down, most ISPs cache queries from these root servers for substantial amounts of time. For Anonymous to “take down” the internet, they would need to maintain a sustained attack. Only after the cached entries have timed out would the attack start to be noticed by users. This would likely take several hours; much longer than the minutes claimed by Anonymous.

So, all things considered, it’s very unlikely a DDoS attack on the internet’s root DNS servers would succeed. But that’s not to say there aren’t other weaknesses that could be exploited to shut the internet down.

Regardless, if the internet is ever brought down, I suspect it will be through something more sophisticated and more arcane than a DDoS of the net’s DNS root servers.

Microsoft's L33t and Lame Moves in 2011

Microsoft has always created a buzz in the entire technology world. Some of its decisions regarded the best while the rest invited a wide range of criticism from the tech savvy. Listed below are some of the good and bad moves made by Microsoft in 2011.

L33t moves:

Breaking the tradition with Windows8

The compatibility of old software’s to new OS has always been a big advantage and disadvantage of windows. The need to support these vast software’s continued to be an obstacle for Windows in refining itself. But With windows8, Microsoft is going radical with a whole new set of applications and software’s created for the new UI. The new apps promise to be less expensive. With its new OS built focusing more on tablets than the PC’s Microsoft is moving closely to the future ‘cloud computing’.

Vast market with the Skype acquisition

With $8.5 billion, Microsoft not only bought Skype, but also its broad base of customers eager to chat and video conference across the PC’s and Smartphones. Microsoft also gained 50 patents with Skype which will help in its battle with the Android market. Microsoft promised to continue support of Skype on all devices. Before closing its deal with Microsoft, Skype cleared its biggest complaint by adding video support to a wide range of android devices.

Acknowledging the HTML5

2011 witnessed the changing face of Microsoft towards HTML5. It started supporting HTML5 in Windows8 and IE 10, making the developers more than happy. Microsoft also released an HTML5 app for Bing which extends its search functions to android and iphone. The Microsoft’s old Silverlight is now relabeled as a tool for enterprise web development.

Spam Control

Microsoft went a step further in fighting the spam by petitioning the US courts to order Verisign to shut down 21 internet domains associated with Botnets. Microsoft was successful in its previous attempts on controlling Rustock and Kelihos Botnets.

Popularizing Kinect

Microsoft encouraged Kinect applications in 2011 by releasing an SDK for non commercial uses and also designed a program to help 10 developers or startups launch businesses around products for Kinect, the controller that senses motion and voice. Kinect has gained Microsoft a whole new generation of Gamers.

Lame Moves :

Android war

Microsoft’s secret plans on collecting the all available android patents and thereby forcing the android device makers to pay large fees are exposed with the legal battle with Barnes & Noble. At least some of Microsoft's patent licenses involving Android were broad cross-patent license agreements with hardware partners (like Samsung). B&N really blows the lid off of what Microsoft is doing and how they are forcing money from Android.

Windows Clouds

Microsoft’s cloud applications which are promised to run smoothly on any device and any OS is continuously failing to do so. Be the new browser or the OS, Microsoft is taking a long time in recognizing the non windows platforms. For example Intune, Microsoft’s managed software distribution and security monitoring service is said to enable the users work on every platform. But it currently only supports Windows platform and not even Windows phone 7.

Anticipated Tablets

Microsoft is waiting for the launch of Windows8 to widen its works on tablets. But the world is not waiting till the launch as it shows an aggressive increase in the tablet market. Even though the Microsoft introduced touch support in Windows7, it is still nowhere in the tablet market. Forrester, an analytics firm already predicted that by the time Windows8 arrives, Microsoft will have surrendered the market to others in terms of feature, price and performance specifications.

Control Open Source Programming with Windows 8

Microsoft had created a controversy when it demanded the hardware developers to implement the next generation boot specification in its secure mode, which is known as Unified Extensible Firmware Interface. This prevents users from loading operating systems and drivers onto a device when it is in secure mode. It usually comes with an off button but Microsoft wanted the hardware makers to remove the button which prevents the open source developers from installing other OS like Linux.

Problems with Office 365

Microsoft has launched its upgraded version of Business Productivity Online Standard Suite (BPOS), Office 365 in 2011 in order to compete with wide adoption of the Google apps. But the product lacked certain features as it rolled out without a perfect feature set. The testers always complain about the limitations in importing the contacts. Also office 365 doesn’t match some of the main features of its rivals like simultaneous co editing in word processing documents.

Sony, Are You Listening?

14-Year-Old Hacker Scoops Job At Microsoft After Being Caught Phishing Via Call of Duty Server.

An interesting little tidbit coming out of Microsoft today, with news that the Redmond outfit has offered a job to a young Irish boy who came to their attention though a Call of Duty: Modern Warfare 2 phishing scam.

The 14 year old who’s not been named has been given the opportunity by Microsoft to turn his back on more nefarious uses for his talent.

Microsoft is reported to be working with the 14-year-old Irish hacker who managed to stir up a little trouble with his Call of Duty: Modern Warfare 2 phishing scam alert. According to the managing director of Microsoft of Ireland, the company is helping the hacker “develop his talent for legitimate purposes.”

This move has obviously caused many to wonder why Sony didn’t take a similar stance over the infamous George Hotz affair.This is exactly what Sony should have done with George Hotz – given him a job as a security specialist, instead of suing him in court and getting its PlayStation Network and other Sony websites hacked day in and out.

For those not up to speed on the matter, Hotz was taken to court by Sony over his PlayStation 3 hacking exploits. After much media speculation and legal wrangling, the pair finally settled out of court, but could it all have been avoided? Even at the time many suggested Sony should have taken George Hotz onboard to use his undoubted talent instead of taking him to task. Perhaps they could have avoided the PSN hacking debacle?

Congrats to that young hacker, whose name was not disclosed. While the new prospect for the Dublin kid is not meant to be an example for other hackers to follow, companies do have to realize that there are many talented people among hackers. Why make an enemy when you can have them on your side?

Red Dragon's Cyberarmy

Chinese government officials have acknowledged the existence of a military unit dedicated to cyber warfare activity, according to intelligence sources. Chinese Defense Ministry spokesman Geng Yansheng said that the unit, called the "cyber blue team", is designed to "better safeguard the internet security of the armed forces".

Geng stated that the unit was organized in response to international threats to Internet security, and that China is still relatively weak in regards to cyber security and its ability to defend against cyberterrorism. Intelligence analyst Glenmore Trenear-Harvey says many in the intelligence field believe China has had a cyber offensive unit active for at least the last five years.

"They [China] may have acknowledged that they have set up this unit but they have been doing it for a long time, and they have been enormously successful in their attacks," Trenear-Harvey said.

China has recruited thousands of hackers for a cyber force tasked with infiltrating a multitude of computers to establish a large botnet which can be utilized to conduct denial of service (DoS) campaigns to disrupt targeted websites as well as conducting cyber espionage activity to pilfer sensitive information. "It is one of the greatest threats we have... But do remember that - the US and UK - are doing this in reverse and are very successful. It's an incredibly potent weapon which will certainly be utilized," Trenear-Harvey said.

According to a recent article by Joshua Philipp and Matthew Robertson, the Chinese have long seen a tactical cyber offensive capability as being a potentially powerful equalizer in their quest to attain superpower status and undermine the effectiveness of international political rivals.

The Chinese strategy extends well beyond potential military targets, posing a significant threat to the core industries and critical infrastructure systems a nation relies upon to sustain a healthy military presence. Attacks on private sector assets are seen as a central aspect of a successful Chinese cyber aggression strategy by eroding the industrial and technological superiority of an adversary over time.

Chinese hackers are not merely tasked with infiltrating established western economies, they are also conducting extensive operations in emerging economies (India, Brazil..etc) and extending their presence in regions fraught by political conflict and economic turmoil.

While numerous nations are involved in varying levels of cyber aggression, what makes the Chinese threat so much more palpable is the systemic nature and comparatively large scale of the state-sponsored cyber-offensive operations, as evidenced by attacks like Operation Aurora, Ghostnet, and most recently Night Dragon.

WebApp $ecurity expenditure.

Companies Spend More on Coffee Than Web App Security
A recent report by the Ponemon Institute, Cenzic and Barracuda Networks has produced a startling statistic: eight-eight percent of companies surveyed indicate they spend more on coffee than they do on securing Web applications.

In spite of this staggering revelation, seventy-four percent of the organizations surveyed still ranked Web application security as being equal to or more important than other security priorities. Clearly, organizations are struggling with Web application security issues.

"While it is encouraging to see that Web application security is on the minds of most organizations, there still seems to be a real disconnect between the desire and implementation of security countermeasures required for Web application security.

Other findings from the survey include:
  • 66 percent test less than 25 percent of these applications for vulnerabilities
  • 62 percent cited data protection as impetus for Web app security
  • 51 percent cited compliance as the top reason for securing Web apps
  • 51 percent listing compliance as a key driver for Web application security
  • 41 percent reported having over 100 Web applications or more
"The fact that 69 percent of respondents are relying upon network firewalls to secure Web applications is like relying upon a cardboard shield for protection in a sword fight – eventually your shield will prove that it's insufficient and an attack will reach you that can fly past a network firewall," Judge stated. With cloud becoming popular everyday WebApp security is going to be a big challenge for service providers.