Hacker's Account of How He Took Down Hacking Team's Servers (softpedia.com)

An anonymous reader writes: FinFisher, the hacker that broke into Italian firm Hacking Team, has published a step-by-step account of how he carried out the attacks, what tools he used, and what he learned from scouting HackingTeam's network. Published on PasteBin, the attack's timeline reveals he entered their network through a zero-day exploit in an (unnamed) embedded device, accessed a MongoDB database that had no password, discovered backups in the database, found a BES admin password in the backups, and eventually got admin access to the Windows Domain Server. From here, it was easy to reach into their email server and steal all the company's emails, and later access Git repos and steal the source code of their surveillance software.

Comments

MongoDBs

[Anonymous Coward]

FYI MongoDB databases with no passwords have exposed details of 191 million US voters. But those were probably set up by unskilled admins. A mistake like this from a company called "Hacking Team" is irony at its finest

Re:MongoDBs

[Anonymous Coward]

sigh, MongoDB.
On install
1. no authentication, no passwords
2. default read access to everything for any user
3. no granularity.
4. data sent in the clear
5. no encryption
6. binds to all available interfaces

It's like we've learned nothing

Re:MongoDBs

[JustAnotherOldGuy]

sigh, MongoDB.
On install
1. no authentication, no passwords
2. default read access to everything for any user
3. no granularity.
4. data sent in the clear
5. no encryption
6. binds to all available interfaces

If I didn't know better (and I don't) it would seem that one of MongoDB's design goals was "easy to hack right out of the box".

Re:MongoDBs

[golgotha007]

MongoDB was designed to be configured and used out of the box by developers, not security minded folks like sysadmins or system architects (devops).

Re:MongoDBs

[Viol8]

7. Unholy mash up of Javascript and bespoke query language to operate on the data and administer the DB.

8. Max size limit of data in a key-value that can be indexed

9. Replica set or sharding , which is better? Who knows. Administering both at the same time requires a bottle of whisky and/or prozac on standby.

Re:MongoDBs

[golgotha007]

>> 8. Max size limit of data in a key-value that can be indexed,

If you're wanting to store large blobs over 16MB in size, then use something like GridFS, which breaks up large blobs into smaller ones for easy storage.

>> 9. Replica set or sharding , which is better? Who knows. Administering both at the same time requires a bottle of whisky and/or prozac on standby.

It depends on what you're wanting to do. Replica Sets are good for redundancy while sharding is ideal for large amounts of data that should be partitioned across many servers. Using a combination of the two does require some architect work, however.

Re:MongoDBs

[AlphaBro]

If you perceive developers as not being security minded, the ones you've encountered aren't very good. Developers are the first line of defense as their actions dictate what vulnerabilities are present in the software they're developing. A good software developer knows far, far more about software security than most sys admins because sys admins generally don't need to understand the nuances of vulnerabilities. In short, they only need to understand the threat, not the technical details about the vuln.

Think about it this way: developers are making the security patches you apply.

Re:MongoDBs

[AlphaBro]

And to expand on this, some developers that are especially skilled at security develop specialized software known as exploits. ;)

Re:MongoDBs

[golgotha007]

It really depends on what exactly we're talking about. In this case, the parent is speaking specifically around the configuration and deployment of MongoDB, and my response is that a SecDevOps architect is going to a much better job in the design, configuration and security than your standard developer with such a product. Keep in mind that security doesn't just focus on keeping the baddies away, it also includes high availability for services and ensuring data integrity.

It's true that many devs are security minded, however in my experience, many are not. As a SecDevOps architect, security comes first in every design and configuration. This includes pentesting, static code analysis and much more.

Devs are typically focused on function and deliverables, which generally means that security takes a backseat. In cases where a startup is rushing a product to market, security is often never considered at all.

Re:MongoDBs

[Viol8]

If only it were 16MB. Apparently the max size that can be indexed is 8K!

Re:MongoDBs

[shuying]

sigh, MongoDB. On install 1. no authentication, no passwords 2. default read access to everything for any user 3. no granularity. 4. data sent in the clear 5. no encryption 6. binds to all available interfaces

It's like we've learned nothing

MongoDB forces you to think about security issues from the outset and add those protections via various packages. It is much better than someone assuming their database is secure due to their own ignorance of reality. No technology can protect a developer / administrator from their own incompetence.

You must be kidding, right?

Re:MongoDBs

[JustAnotherOldGuy]

So your idea of "hacking" is "do what it lets you do out of the box".

No. Perhaps I should clarify; I probably should have said, "easy to be hacked right out of the box", or "dreadfully insecure right out of the box".

If you think that "no authentication, no passwords" and "default read access to everything for any user" as the default state upon installation is a good thing, then you might want to learn a little bit about web security.

Re:Pastebin! For realzs!!1

[Anonymous Coward]

Pasting to PasteBin with Tor is the same thing as pasting to GhostBin. Also, it was on GhostBin initially, but in Spanish. Apparently the hacker is from a Spanish-speaking country. Someone translated his text, and then the hacker corrected the translation, and repasted it to PasteBin.

Re:Pastebin! For realzs!!1

[K. S. Kyosuke]

"Exit node"? Is that how young people call it today? We used to say "watch your ass".

Fascinating

[JustAnotherOldGuy]

I read the whole account, and although I by no means understood everything, it was a fascinating read.

It appears that almost any route into a system will lead to more exploitable routes, and those lead to even more, and so on, until you're basically free to roam at will, read and change key files, install all the backdoors you like, and so on. He basically ended up with an embarrassment of riches, so to speak, with as much (or likely more) access than all of the legit admins combined.

  It would appear that truly locking down a large, complex network is next to impossible- there are so many moving parts and so many places to prod and poke that sooner or later, someone will find that one little vulnerability that opens the door.

It's hard not to admire someone with skills and the persistence it took to do this.

Re:Fascinating

[E-Rock]

Seems like this was a hard shell, gooey center setup. So once he got in, he found the mis-configured iSCSI, and then the game was over.

Really drives home that you need layers in place to block/detect lateral movement.

Re:Fascinating

[Anonymous Coward]

>How do you stop a person like this apart from going offline completely?

Don't be a shit-heel and make yourself a target for hacktivists

Re:Fascinating

[sumdumass]

This anonymous coward you speak of must have some worth and a plan. I see him all the time either adding maddening insight to conversations or what seems to be intentionally derailing them with idiocy that is almost unbelievable.

So the question should be, with that much power in play, why wouldn't someone want to hack the anonymous coward and discover the secrets to his fortune.

Re:Fascinating

[Qzukk]

Setting aside this particular hack, *most* "hacks" are simply scattershot: if it costs $X of effort to break into a computer, as long as one out of every N computers gets you something worth N*X, the question is why not?

Re: Fascinating

[E-Rock]

You may want to read the write up. Windows had nothing to do with this hack. He created his own 0day against an internet facing appliance. He doesn't name it, but that his follow-up step was to install some additional Unix utilities, we know it was a *nix box. Then he found that their iSCSI network wasn't properly segmented away from the user network, and there was no authentication configured. That's a human error.

Re:Fascinating

[stealth_finger]

And why would a shit-heel pay a black hat for access into the infrastructure of an anonymous coward?

I want to find who this AC is. There will be a substantial reward, any takers?

FinFisher

[Anonymous Coward]

FinFisher, the hacker that broke into Italian firm Hacking Team

I'm pretty sure FinFisher is the name of a competitor of Hacking Team, not the name of the hacker who broke into Hacking Team's network.

Re:FinFisher

[radicimo]

It's likely that the same person who took down FinFisher took down HT. Maybe he adopted the name FinFisher as a badge of honor? Here's an example of his previous writing. http://0x27.me/HackBack/0x00.t...

Re:FinFisher

[zedaroca]

FinFisher is an old moniker, he changed to PhineasFisher.
Indeed, he is the hacker that did the FinFisher hack. Here is an "interview" about the HT hack that confirms his identity.

Here's the breakdown of vulnerabilities:

[golgotha007]

The main weaknesses found are: unpatched network appliance exposed to public, services on deep network layers exposed to less secure subnets, using mongo with no authentication, passwords in plaintext found in backups, weak, bruteforcable passwords across the board, no password rotation in place and unpatched windows boxes.

Also, unauthenticated iSCSI

[Lev_Arris]

The linked article doesn't mention this but the way FinFisher got into the Backup server was by simply mounting its iSCSI volumes which required no authentication at all. (Technically, the iSCSI targets were supposed to be on a separate network, but it turns out you could still get at them from the main network.)

The lesson there: It doesn't matter which network the service is in, turn on authentication!

And he had to go and ruin it right at the end...

[Viol8]

... by getting on his cross, polishing his halo and talk about "stopping their human rights abuses". Oh get over yourself son. The world isn't black and white, its shades of grey. The quicker you learn that fact the sooner you can pull that rod out of your arse. These guys just sell the software, they don't use it. If you really want to sort out human rights abuses there are plenty of governments and islamic terrorist networks you can try and hack. Though the latter might actually involve real personal danger, which is where most keyboard warriors draw the line.

Re:What's with the "steal"?

[Anonymous Coward]

Stealing something from someone requires that it be in that victim's possession.

Before you go all NUH UH!!1!11!one on me, please do keep in mind that the federal government's standard excuse for nearly all of its metadata collection as well as their other, more flagrant, violations of the 4th Amendment basically boils down to a belief if its not in your personal possession it's not yours.

Re:And he had to go and ruin it right at the end..

[Required Snark]

I have a counter proposal: pull your head out of your ass before you lay into someone else.

When you client list is oriented towards repressive regimes that suppress dissent using tactics like torture and murder, it's not just "These guys just sell the software, they don't use it". It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing.

They are in the same category as drug cartels or the pirates of West Africa. The only difference is that Hacking Team has a veneer of legitimacy, and they also sell to first world countries like the US and Germany. Frankly I expect that "legitimate" governments abuse this software to engage in illegal acts both at home and all over the world.

Pulling the "shades of grey" argument in this case is utter bullshit. We know who they are, we know what they do, and we know who they work for. They have chosen to work for some of the worst governments on the planet. They have no excuse.

And if you had any doubts about the political motivation of Hacking Team, the emails revealed

Vincenzetti, the CEO, liked to end his emails with the fascist slogan "boia chi molla".

That translates as "death to traitors".

So, what to do about it.

[aberglas]

That is a deep observation.

How do we build secure systems? Patching up all the thousands of holes one by one is not a solution.

Certainly, penetration testing needs to be carried out from inside the fire wall.

But beyond that, the only solution I see is a focus on simplicity. That means less features, but implemented with a view that the code can be understood.

Not using the C/++ programming language would remove about half the vulnerabilities, fat chance of that happening though.

What is not the solution is a Windows operating system that is riddled with hundreds of deamons that nobody really understands and takes minutes to shut down (let alone fully boot).

So how do we go beyond patch Tuesday and arrive at something that is secure by design?

Re:So, what to do about it.

[JustAnotherOldGuy]

How do we build secure systems? Patching up all the thousands of holes one by one is not a solution.

To be frank, I'm not sure there is a solution. Complex systems are, well, complex...and complexity almost invariably leads to mistakes. (Heh, ask me how I know...)

But I don't see how something like a network can ever be reliably secured....too many different bits of this and that to keep track of, patch, upgrade, etc etc. Things can be secured to a point, sure, but in real life all that stuff changes over time and it seems impossible to me to ever keep up with it 100%.

You may have a team of 20 top-notch sysadmins locking stuff down, but there may be 10,000 hackers trying to break in...at some point one of them is going to find a flaw. The sysadmins have to on top of their game 100% of the time, but the bad guys only have to get lucky once. The game seems to be heavily weighted towards the hackers, especially in the long run.

The idea of keeping things simple is a good one, but probably not a practical approach. For example, how simple can you make an enterprise network? My guess is that the answer is "not very".

Windows is definitely a problem, but I think these problems are inherent in any OS, any network, any complex system. There may not actually be a good solution.

Re:And he had to go and ruin it right at the end..

[zedaroca]

By publishing their source code he protected journalists and activists that were being targeted by the governments you talked about, at least temporarily with the AV updates, and further by exposing the fact that they were selling to sanctioned countries.

Your "shades of gray" BS doesn't apply here. One thing is to sell a weapon, another is to sell a weapon to a known murderer. Do you think there should be no problems on selling uranium to NK? It's just selling, not using...

It makes much more sense to cut the weapons used by the governments and terrorists than to let them weaponize themselves. That's why sanctions exist.

You are completely clueless if you think hacking criminal corporations that do business with governments doesn't involve real personal danger.

Re:And he had to go and ruin it right at the end..

[Viol8]

"pull your head out of your ass before you lay into someone else. "

I don't own a donkey and if I did I wouldn't put my head up its arse.

"It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing. "

Bollocks - its based on money. Its no different to selling weapons. I'm sure this company would have no problem selling to you if you stump up the cash. I'm not going to pretend they're saints, but they're not the cartoon evil people would love these sorts of companies to be either.

Re:And he had to go and ruin it right at the end..

[stealth_finger]

"It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing. "

Bollocks - its based on money. Its no different to selling weapons. I'm sure this company would have no problem selling to you if you stump up the cash. I'm not going to pretend they're saints, but they're not the cartoon evil people would love these sorts of companies to be either.

Say you're an arms dealer, selling to the national army of Bulgaria is one thing, selling to Boko Haram, completely different.

Re:And he had to go and ruin it right at the end..

[Viol8]

So do you have any evidence this company has told to terrorist organisations then? If so please share, i'm sure many law enforcement agencies would love to know.

Re:And he had to go and ruin it right at the end..

[stealth_finger]

No, I was just making the point that the morality of selling something is just as much who you sell to as what you sell. These people sold to despotic governments for spying on their own people. The guy in TFA provided the evidence of that. Please try to keep up instead of moving goalposts.