Slashdot Mirror

← Back to Stories (view on slashdot.org)

Free Tools For Detecting Hacking Team Malware In Your Systems

Posted by timothy on from the just-checking dept.

An anonymous reader writes: Worried that you might have been targeted with Hacking Team spyware, but don't know how to find out for sure? IT security firm Rook Security has released Milano, a free automated tool meant to detect the Hacking Team malware on a computer system. Facebook has also offered a way to discover if your Mac(s) have been compromised by Hacking Team malware: they have provided a specific query pack for its open source OS analysis tool osquery.

9 of 62 comments (clear)

  1. Hmmm ... by gstoddart · · Score: 5, Insightful

    So how do we know we can trust the hacking tools designed to tell us if the hacking tools have installed hacking tools?

    If this shit isn't proof that giving governments backdoors to security and crypto is a terrible idea, I have no idea what is.

    --
    Lost at C:>. Found at C.
    1. Re:Hmmm ... by ArcadeMan · · Score: 4, Funny

      The evil bit is turned off.

      --
      Get free satoshi (Bitcoin) and Dogecoins
  2. Where do I sign up? by sjbe · · Score: 4, Funny

    Hmm, some security firm I've never heard of, releases a tool I've never heard of, which is supposed to tell me if I've been got spyware with alleged government ties. Yeah, that sounds super trustworthy...

    Oops, I left the sarcasm bit turned on. Sorry about that...

  3. Let me see if I understand this by argStyopa · · Score: 5, Insightful

    ...so, to see if I have undetected malware buried in my system, I should run an unidentified exe file from a company I've NEVER heard of?

    Well, that sounds like a great idea.

    --
    -Styopa
    1. Re:Let me see if I understand this by Anonymous Coward · · Score: 5, Informative

      Well, following their own whois information:

      Rook Security is apparently a front for the "Rook Group,"

      Registrant Name: Rook Group
      Registrant Organization: Rook Consulting
      Registrant Street: 560 S. Winchester Blvd
      Registrant Street: Suite 500
      Registrant City: San Jose
      Registrant State/Province: California
      Registrant Postal Code: 95128
      Registrant Country: United States
      Registrant Phone: +1.8887129531
      Registrant Phone Ext:
      Registrant Fax:
      Registrant Fax Ext:
      Registrant Email: info@rookconsulting.net ..of "Rook Consulting." So it's already sounding like a holding company...the interesting part is who's behind all -that- mess, on rooksecurity.com, they list their "PR" contact as twhitman@vocecomm.com...Tim Whitman, who apparently is also the PR contact for another no-name outfit, BeyondTrust:

      http://www.beyondtrust.com/New...

      One of the few articles I can find advertising their "skills" is one of their own press releases and all the companies involved seem to be awfully vague about what services they're offering exactly...

  4. Re:Zero need is always free by behrooz0az · · Score: 3, Insightful

    Hate to break it to You, You look so pretty in your small little iSheep bubble. but their malware IS cross-platform and those platforms DO INCLUDE Mac.

    --
    Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
  5. I downloaded it and then uploaded to virustotal by waspleg · · Score: 3, Informative

    2/54, could be false positives I've at least heard of Rook Security although I forget in what context ;)

  6. Facebook's tool by CanadianMacFan · · Score: 3, Insightful

    I'll take my chances with the Hacking Team malware, I trust them more.

  7. Not sure I can trust them... by Raxxon · · Score: 3, Informative

    Figured I'd take a look at the tools. Download what claims to be the software for windows (first link). Get presented with a Zip file, as expected. Open zip file and find.... OSX software. Thinking I clicked on the wrong link I went back to download a second time... Same file.

    So... yeah.. ranking real high on the trust value right now.