Slashdot Mirror
Hacker's Account of How He Took Down Hacking Team's Servers (softpedia.com)
An anonymous reader writes: FinFisher, the hacker that broke into Italian firm Hacking Team, has published a step-by-step account of how he carried out the attacks, what tools he used, and what he learned from scouting HackingTeam's network. Published on PasteBin, the attack's timeline reveals he entered their network through a zero-day exploit in an (unnamed) embedded device, accessed a MongoDB database that had no password, discovered backups in the database, found a BES admin password in the backups, and eventually got admin access to the Windows Domain Server. From here, it was easy to reach into their email server and steal all the company's emails, and later access Git repos and steal the source code of their surveillance software.
sigh, MongoDB.
On install
1. no authentication, no passwords
2. default read access to everything for any user
3. no granularity.
4. data sent in the clear
5. no encryption
6. binds to all available interfaces
It's like we've learned nothing
"Exit node"? Is that how young people call it today? We used to say "watch your ass".
Ezekiel 23:20
I read the whole account, and although I by no means understood everything, it was a fascinating read.
It appears that almost any route into a system will lead to more exploitable routes, and those lead to even more, and so on, until you're basically free to roam at will, read and change key files, install all the backdoors you like, and so on. He basically ended up with an embarrassment of riches, so to speak, with as much (or likely more) access than all of the legit admins combined.
It would appear that truly locking down a large, complex network is next to impossible- there are so many moving parts and so many places to prod and poke that sooner or later, someone will find that one little vulnerability that opens the door.
It's hard not to admire someone with skills and the persistence it took to do this.
Just cruising through this digital world at 33 1/3 rpm...
sigh, MongoDB.
On install
1. no authentication, no passwords
2. default read access to everything for any user
3. no granularity.
4. data sent in the clear
5. no encryption
6. binds to all available interfaces
If I didn't know better (and I don't) it would seem that one of MongoDB's design goals was "easy to hack right out of the box".
Just cruising through this digital world at 33 1/3 rpm...
FinFisher, the hacker that broke into Italian firm Hacking Team
I'm pretty sure FinFisher is the name of a competitor of Hacking Team, not the name of the hacker who broke into Hacking Team's network.
The main weaknesses found are: unpatched network appliance exposed to public, services on deep network layers exposed to less secure subnets, using mongo with no authentication, passwords in plaintext found in backups, weak, bruteforcable passwords across the board, no password rotation in place and unpatched windows boxes.
7. Unholy mash up of Javascript and bespoke query language to operate on the data and administer the DB.
8. Max size limit of data in a key-value that can be indexed
9. Replica set or sharding , which is better? Who knows. Administering both at the same time requires a bottle of whisky and/or prozac on standby.
The linked article doesn't mention this but the way FinFisher got into the Backup server was by simply mounting its iSCSI volumes which required no authentication at all. (Technically, the iSCSI targets were supposed to be on a separate network, but it turns out you could still get at them from the main network.)
The lesson there: It doesn't matter which network the service is in, turn on authentication!
>> 8. Max size limit of data in a key-value that can be indexed,
If you're wanting to store large blobs over 16MB in size, then use something like GridFS, which breaks up large blobs into smaller ones for easy storage.
>> 9. Replica set or sharding , which is better? Who knows. Administering both at the same time requires a bottle of whisky and/or prozac on standby.
It depends on what you're wanting to do. Replica Sets are good for redundancy while sharding is ideal for large amounts of data that should be partitioned across many servers. Using a combination of the two does require some architect work, however.
When you client list is oriented towards repressive regimes that suppress dissent using tactics like torture and murder, it's not just "These guys just sell the software, they don't use it". It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing.
They are in the same category as drug cartels or the pirates of West Africa. The only difference is that Hacking Team has a veneer of legitimacy, and they also sell to first world countries like the US and Germany. Frankly I expect that "legitimate" governments abuse this software to engage in illegal acts both at home and all over the world.
Pulling the "shades of grey" argument in this case is utter bullshit. We know who they are, we know what they do, and we know who they work for. They have chosen to work for some of the worst governments on the planet. They have no excuse.
And if you had any doubts about the political motivation of Hacking Team, the emails revealed
Vincenzetti, the CEO, liked to end his emails with the fascist slogan "boia chi molla".
That translates as "death to traitors".
Why is Snark Required?
If you perceive developers as not being security minded, the ones you've encountered aren't very good. Developers are the first line of defense as their actions dictate what vulnerabilities are present in the software they're developing. A good software developer knows far, far more about software security than most sys admins because sys admins generally don't need to understand the nuances of vulnerabilities. In short, they only need to understand the threat, not the technical details about the vuln.
Think about it this way: developers are making the security patches you apply.
And to expand on this, some developers that are especially skilled at security develop specialized software known as exploits. ;)
"pull your head out of your ass before you lay into someone else. "
I don't own a donkey and if I did I wouldn't put my head up its arse.
"It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing. "
Bollocks - its based on money. Its no different to selling weapons. I'm sure this company would have no problem selling to you if you stump up the cash. I'm not going to pretend they're saints, but they're not the cartoon evil people would love these sorts of companies to be either.
"It's like knowingly selling blood diamonds. There is no plausible deniability. The business model is based on violence and killing. "
Bollocks - its based on money. Its no different to selling weapons. I'm sure this company would have no problem selling to you if you stump up the cash. I'm not going to pretend they're saints, but they're not the cartoon evil people would love these sorts of companies to be either.
Say you're an arms dealer, selling to the national army of Bulgaria is one thing, selling to Boko Haram, completely different.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u