Slashdot Mirror
Hacker's Account of How He Took Down Hacking Team's Servers (softpedia.com)
An anonymous reader writes: FinFisher, the hacker that broke into Italian firm Hacking Team, has published a step-by-step account of how he carried out the attacks, what tools he used, and what he learned from scouting HackingTeam's network. Published on PasteBin, the attack's timeline reveals he entered their network through a zero-day exploit in an (unnamed) embedded device, accessed a MongoDB database that had no password, discovered backups in the database, found a BES admin password in the backups, and eventually got admin access to the Windows Domain Server. From here, it was easy to reach into their email server and steal all the company's emails, and later access Git repos and steal the source code of their surveillance software.
FYI MongoDB databases with no passwords have exposed details of 191 million US voters. But those were probably set up by unskilled admins. A mistake like this from a company called "Hacking Team" is irony at its finest
Pasting to PasteBin with Tor is the same thing as pasting to GhostBin. Also, it was on GhostBin initially, but in Spanish. Apparently the hacker is from a Spanish-speaking country. Someone translated his text, and then the hacker corrected the translation, and repasted it to PasteBin.
Call it hacker, guilty by definition. Doesn't matter what he did really. "Hacker"==GUILTY.
And screw softpedia for the vapid clickbait-y crap it keeps spewing.
This is great
swish
woosh
"Exit node"? Is that how young people call it today? We used to say "watch your ass".
Ezekiel 23:20
I read the whole account, and although I by no means understood everything, it was a fascinating read.
It appears that almost any route into a system will lead to more exploitable routes, and those lead to even more, and so on, until you're basically free to roam at will, read and change key files, install all the backdoors you like, and so on. He basically ended up with an embarrassment of riches, so to speak, with as much (or likely more) access than all of the legit admins combined.
It would appear that truly locking down a large, complex network is next to impossible- there are so many moving parts and so many places to prod and poke that sooner or later, someone will find that one little vulnerability that opens the door.
It's hard not to admire someone with skills and the persistence it took to do this.
Just cruising through this digital world at 33 1/3 rpm...
The real shame here is that our governments are forking over millions in pork spending to skiddies like "Hacking Team" who don't even follow basic security practices, like setting a PW on your DB.
I've never seen a software ever decline in trustability so fast as Tor in the past year. Nice job FBI
FinFisher, the hacker that broke into Italian firm Hacking Team
I'm pretty sure FinFisher is the name of a competitor of Hacking Team, not the name of the hacker who broke into Hacking Team's network.
The main weaknesses found are: unpatched network appliance exposed to public, services on deep network layers exposed to less secure subnets, using mongo with no authentication, passwords in plaintext found in backups, weak, bruteforcable passwords across the board, no password rotation in place and unpatched windows boxes.
The linked article doesn't mention this but the way FinFisher got into the Backup server was by simply mounting its iSCSI volumes which required no authentication at all. (Technically, the iSCSI targets were supposed to be on a separate network, but it turns out you could still get at them from the main network.)
The lesson there: It doesn't matter which network the service is in, turn on authentication!
... by getting on his cross, polishing his halo and talk about "stopping their human rights abuses". Oh get over yourself son. The world isn't black and white, its shades of grey. The quicker you learn that fact the sooner you can pull that rod out of your arse. These guys just sell the software, they don't use it. If you really want to sort out human rights abuses there are plenty of governments and islamic terrorist networks you can try and hack. Though the latter might actually involve real personal danger, which is where most keyboard warriors draw the line.
MongoDB only pawn in game of IT
I've always thought of stealing as "taking something without permission". I've never considered it "taking the one thing without permission". Whether it's some or all of something doesn't stop it from being theft.
I could help laughing loudly at that...
Aren't we reminded, over and over, that the terms like "steal" (and "theft") apply only to tangible things? But not to, for example, music and video files?
Nope. Those examples are refuting equivocation - using the word "steal" or "theft" loosely and then drawing inferences as though they were strictly-correct usages of the words. This is simple a straightforward case of the word "steal" being used in a loose, borderline-metaphorical sense with no such conflation.
They sell software to despots and authoritarian regimes. Some of their customers are subject to export bans. I think he might be on to something with the human rights abuses rather than just preaching from the pulpit.
There was a talk at chaos communication congress in 2013 that had the subject of private companies creating hacking/surveillance tools for
See https://youtu.be/Y1aU3uw1QnA?t=24m38s (The time starts at the segment dealing with hacking team, the first half of the talk primarily deals with Fin Fisher, another company in the same niche). The list of some of their more worrying clients is detailed at around 32:30.
Dammit, slashdot ate my edit (I failed the captcha because it was unreadable and had to copy+paste it). Middle paragraph should say:
There was a talk at chaos communication congress in 2013 that had the subject of private companies creating hacking/surveillance tools for law enforcement and governments.
Stealing something from someone requires that it be in that victim's possession.
Before you go all NUH UH!!1!11!one on me, please do keep in mind that the federal government's standard excuse for nearly all of its metadata collection as well as their other, more flagrant, violations of the 4th Amendment basically boils down to a belief if its not in your personal possession it's not yours.
These guys just sell the software, they don't use it.
What a load of horseshit. They sell software to repressive governments to spy on honest people like independent journalists. The world is black and white along with grey too. HT is mostly black with a little bit of grey, and not much white.
If you want to say you approve of this kind of fascist bullshit, fine. But this isn't a matter of black and white, it's a matter of what kind of world you want to live in.
When you client list is oriented towards repressive regimes that suppress dissent using tactics like torture and murder, it's not just "These guys just sell the software, they don't use it". It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing.
They are in the same category as drug cartels or the pirates of West Africa. The only difference is that Hacking Team has a veneer of legitimacy, and they also sell to first world countries like the US and Germany. Frankly I expect that "legitimate" governments abuse this software to engage in illegal acts both at home and all over the world.
Pulling the "shades of grey" argument in this case is utter bullshit. We know who they are, we know what they do, and we know who they work for. They have chosen to work for some of the worst governments on the planet. They have no excuse.
And if you had any doubts about the political motivation of Hacking Team, the emails revealed
Vincenzetti, the CEO, liked to end his emails with the fascist slogan "boia chi molla".
That translates as "death to traitors".
Why is Snark Required?
That is a deep observation.
How do we build secure systems? Patching up all the thousands of holes one by one is not a solution.
Certainly, penetration testing needs to be carried out from inside the fire wall.
But beyond that, the only solution I see is a focus on simplicity. That means less features, but implemented with a view that the code can be understood.
Not using the C/++ programming language would remove about half the vulnerabilities, fat chance of that happening though.
What is not the solution is a Windows operating system that is riddled with hundreds of deamons that nobody really understands and takes minutes to shut down (let alone fully boot).
So how do we go beyond patch Tuesday and arrive at something that is secure by design?
By publishing their source code he protected journalists and activists that were being targeted by the governments you talked about, at least temporarily with the AV updates, and further by exposing the fact that they were selling to sanctioned countries.
Your "shades of gray" BS doesn't apply here. One thing is to sell a weapon, another is to sell a weapon to a known murderer. Do you think there should be no problems on selling uranium to NK? It's just selling, not using...
It makes much more sense to cut the weapons used by the governments and terrorists than to let them weaponize themselves. That's why sanctions exist.
You are completely clueless if you think hacking criminal corporations that do business with governments doesn't involve real personal danger.
"pull your head out of your ass before you lay into someone else. "
I don't own a donkey and if I did I wouldn't put my head up its arse.
"It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing. "
Bollocks - its based on money. Its no different to selling weapons. I'm sure this company would have no problem selling to you if you stump up the cash. I'm not going to pretend they're saints, but they're not the cartoon evil people would love these sorts of companies to be either.
> If you really want to sort out human rights abuses there are plenty of governments and islamic terrorist networks you can try and hack
Like Israel and Saudi Arabia. :)
"It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing. "
Bollocks - its based on money. Its no different to selling weapons. I'm sure this company would have no problem selling to you if you stump up the cash. I'm not going to pretend they're saints, but they're not the cartoon evil people would love these sorts of companies to be either.
Say you're an arms dealer, selling to the national army of Bulgaria is one thing, selling to Boko Haram, completely different.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
So do you have any evidence this company has told to terrorist organisations then? If so please share, i'm sure many law enforcement agencies would love to know.
No, I was just making the point that the morality of selling something is just as much who you sell to as what you sell. These people sold to despotic governments for spying on their own people. The guy in TFA provided the evidence of that. Please try to keep up instead of moving goalposts.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
This is exactly why the FBI (or CIA or NSA) should not be allowed to hide 0-day exploits from manufacturers. Everyone's security is at risk, even the FBI/CIA/NSA who could get stung by the very 0-days they don't report...
Do you require the services of an unethical/ethical hacker?..contact leehacks92@gmail.com.They specialize in all sorts of hacking,he helped me hack into my Gf's phone.He's very discreet and reliable,tell him Jason sent you..