Slashdot Mirror
Hacking Team Scrambling To Limit Damage Brought On By Explosive Data Leak
An anonymous reader writes: Who hacked Hacking Team, the Milan-based company selling intrusion and surveillance software to governments, law enforcement agencies and (as it turns out) companies? A hacker who goes by "Phineas Fisher" claims it was him (her? them?). In the meantime, Hacking Team is scrambling to minimize the damage this hack and data leak is doing to the company. They sent out emails to all its customers, requesting them to shut down all deployments of its Remote Control System software ("Galileo") — even though it seems they could do that themselves, as the customer software apparently has secret backdoors. Perhaps they chose the first route because they hoped to keep that fact hidden from the customers? And because every copy of Hacking Team's Galileo software is secretly watermarked, the leaked information could allow researchers to link a certain backdoor to a specific customer.
Let's hope they see how much it hurts people when stuff like this happens, and change their ways.
Nobody cries when the thief gets robbed.
That doesn't say anything of the gender of the person using that nom de plume.
Boys and girls there is a lesson in this story. Each of us has a karma bucket. When that karma bucket is depleted the "fickle finger of fate" may reach and touch us causing untold calamity. Hacking Team's karma bucket has a giant hole in the bottom and can never be refilled. All of their tricks and source code have been laid bare, and are now in full view of the Internet.
If someone has a link the to torrent, please post it.
Ah, schadenfreude. Seeing these jerks die by the sword they have wielded against the rest of us is just too satisfying.
I particularly like how it's come out that they were backdooring (and presumably screwing, or at least reserving the opportunity to screw) their own ethically-challenged customer base.
Really, it's not nice to take such delight in the downfall of others, but it just feels so damn good.
The Future of Human Evolution: Autonomy
is to take big brothers toys away from them and show everyone how undermining the security measures of the global tech. economy and culture is tantamount to shooting yourself in the foot.
Also some GPL derived drivers that they have been distributing to their customers. https://twitter.com/mjg59/stat...
This is a lesson... software with backdoors, the backdoors eventually get found out. This is a real proof against the anti-encryption lobby, that if encryption is gutted, then only the bad guys will have actual security.
Even if it something that requires a private key to access, the private key can be hacked or physically stolen if stashed on a HSM.
Yep, a great number of our most 'prestigious' institutions need this little lesson. I hope it starts happening much more often, especially around election time, to test peoples' faith.
“He’s not deformed, he’s just drunk!”
Who needs a name? Statistical probability indicates that person is almost certainly a male.
Irony: Agile development has too much intertia to be abandoned now.
I'm curious what Hacking Team thought was worth the risk of watermarking their products to customer installations and having these alleged backdoors to backdoors. Seems like a lot of risk for no payoff unless they hoped one day to "flip the script" and hack their customer base...
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
So basically even security researchers are morons who put in secret back doors?
Bloody idiots.
This is really simple: companies need to have very strict liability for doing stupid stuff like this. Putting secret backdoors should be treated the same as hacking into it ... especially if someone else exploits that.
Lost at C:>. Found at C.
That doesn't say anything of the gender of the person using that nom de plume.
Oh no, please don't let this turn into a LBGT debate
In the free world the media isn't government run; the government is media run.
https://filetea.me/#t1sfShLaTe... (zip) https://filetea.me/t1sKByZZuOr... (tar xz)
Right now everything we touch is excessively bloated and unscrutinised. We need to eliminate 99.999% of the bloat. There is a ton of code under the hood that is not needed. I'd love to see a group analyse that bloat and eliminate it. There are a lot of features implemented to spec in an attempt to cover all bases that nobody actually uses in the real world. If nobody is actively using it then it should be eliminated.
When security is more important than backwards compatibility (government, etc) it's one of the first steps that should be taken in designing a secure system. Everything from the firmware to drivers should get audited and you can't do that properly if there is too much code.
One of my engineers (big wig in a small company) reduced the size of the kernel to 1/100 its normal size (keep in mind it was for a specific set of hardware in an embedded application) and is working to reduce the image (not the kernel, but other components) further. The goal is to fit everything in 2-4MB of flash. That's still too bloated when you begin to factor in security. 2-4MB is HUGE when it comes to auditing code. The unfortunate reality is (particularly in embedded applications) most of the code out there is utter crap and will never be of even reasonably decent quality because what drives most development is money- not security. Features sell. Actual security is rarely if ever taken into account. It's at best an afterthought even in the environments which need it most.
While I am happy that Hacking Team got their comeuppance I am not ready to support their new found nemesis. This could be nothing more then a turf war and the last thing I want is another set of more cunning bad guys getting their seed money from me.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
fickle fingers, watermarks, explosive data leaks, reducing bloat, secret backdoors. I mean it just doesn't help the fact that I ...
... oh man, I don't think I'm gonna make it to the bathroom.
Inside any corp dump this large is dirt. What it really reveals is that this company enjoys an excess of hubris likely along with a money cushion with which to entitle it
Who will guard the guards themselves
Yet, according to ]Hacking Team[ Six Confidential Whitepapers on cryptome.org, HT explicitly state on page 31
So, if HT lie to their rather high powered customers about a major detail like that, what else?
Yo dog, I heard you like backdoors. So I backdoored your backdoor so you can get p0wned while you p0wn!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
This singular fact may lead to the exposure of this company as a very impressive, long-term false front for an intel shop. Probably not the NSA, given that the FBI (backdoor irony alert) and other FedGov organs were apparently customers. Who *is not* on that customer list: GCHQ? Interpol? Russia?
There may be a popcorn shortage before all this plays out.
Who says it has to be anything of the sort. How many female characters in {pick your MMO} are played by males for {fill in reason}?
Two of my imaginary friends reproduced once
Phineas Freakowoski agrees.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Phineas is all talk. Ferb is the real man of action.
Sleep your way to a whiter smile...date a dentist!
https://github.com/hackedteam/...
No mention of iceweasel and family. I may delete my X server after reading all those stuff, they hate GUI programs.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
If this were even moderately uncommon software (e.g. a global market of tens of thousands or fewer), and moderately valuable (ten thousand dollars per seat-year, or so) then I'd expect the vendor to have put in some sort of watermarking as part of the license validation software. I'm pretty sure that our software (which works in this region) incorporates the putative license number and the 16-byte serial number of the hardware dongle in it's packets attempting to negotiate a connection with a license server. Which allows us to know if the serial numbers of the software or dongles have leaked out of the contexts (net blocks) in which they should occur. We advertise this to our clients as "proactive monitoring for the security of their data" ; whether, or how-much, we charge them is a question for Beancounter-Central.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"