Preliminary analysis of Hacking Team's slides

One of the best technical reviews of Hacking Team's malware system RCS is:

http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-h…
Government Grade Malware: a Look at HackingTeam’s RAT
Nick Cano
10 Jul 2015

"HackingTeam’s RCS is a fully-featured RAT with the ability to intercept large amounts of personal information, record conversations, access cameras, propagate to peripheral devices, and do it all without triggering any alarms. The source-code shows that the malware was developed by a very ambitious team, and the repository logs make it clear that it was under active development. The implications this carries are huge, especially considering HackingTeam’s customer list."

Cano answers the question: How does RCS work? In this post I want to answer two further questions:

1. Who are Hacking Team's customers"

2. How are they using (or rather abusing) HT's RAT?

A recent financial spreadsheet leaked from Hacking Team shows that since its founding in 2004, the company has taken in about 41.3 million Euros. The regional breakdown is

Europe 29%
Middle East 28%
Latin America 24%
Asia 15%
North America 4%

The breakdown by the nature of HT's customers is

Intel agencies 41%
LEAs 36%
Other 17%
Unknown 6%

Intriguingly, the US DEA (Drug Enforcement Agency) is listed as "Other", perhaps because its monitoring of the entire national internet of countries like Colombia, which is known to HT, makes it a foreign intel agency as much as an international law enforcement agency.

The document lists 64 current or former customers, located in 34 countries, and was trying to sell to another 4 customers at the time of the leak. The countries which have provided the most revenue to HT are

Mexico 11 2010 5.81
Italy 7 2004 4.02
Morocco 2 2009 3.17
Saudi Arabia 3 2010 2.91
Hungary 2 2008 1.90
Malaysia 4 2009 1.86
UAE 2 2011 1.83
USA 3 2011 1.46
Kazakhstan 1 2012 1.01
Sudan 1 2012 0.96
Uzbekistan 1 2011 0.92
Vietnam 2 2014 0.83

Many customers (including FBI and DEA) appear to have briefly tried RCS only to decide not to enter into a long-term contract.

The leaked documents include email addresses for about 40 HT employees over the years (including Administrative Support). Often one person uses several different addresses. Sometimes both HT employees and their customers appear to use pseudonyms.

The evolution of HT's customer base over the years is illuminating.

HT's first customer (acquired 2004) was an Italian LEA. Spanish intelligence became a customer in 2006. This should have been somewhat alarming given Spain's long history of fascistic government (and anyone who has followed recent legislation there knows that Spain has taken a decisive and tragic turn back towards fascism with its Vomit Law). The alarm bells definitely should have sounded when HT acquired a third customer, in Singapore, in 2008. Singapore is run with an iron hand by an unabashedly authoritarian government. The city state is the only nation in the entire world which immediately and enthusiastically adopted Poindexter's TIA (Total Information Awareness), and its human rights record gives cause for alarm.

Also in 2008, Hungary became a customer, then Morocco and Malaysia in 2009. Malaysia's human rights record was already deteriorating when it became an HT customer, and Morocco soon followed. There are also questions about the actions of Hungary (like Spain, another nation which was formerly governed by fascists) against Roma people ("gypsies"), a group numbered among the first victims of the original European fascists.

Vincenzetti argues that a country which becomes a customer when its government is democratic (Morocco was one of the first nations to throw off strongman rule in the recent round of revolutions in North Africa) might later take a turn down a dark road, as has happened in Morocco. Which begs the question: why didn't HT boot Morocco and disable its "collectors" as its human rights record deteriorated? The answer is obvious: HT needed the money.

In 2010, Saudi Arabia became an HT customer, and since then has provided the largest annual revenue to HT. Then Turkey, Egypt, and Uzbekistan became customers in 2011. The human rights records of each of these countries shows very clearly that by 2011 Vincenzetti had abandoned all pretense of refusing to sell APT malware to the most abusive governments on Earth.

A new low point occurred in 2012, when via its shady partner in cyberespionage-as-a-service, NICE, HT acquired a new customer, the notoriously corrupt government of the state of Bayelsa in Nigeria. According to Nigerian papers reacting to the publication at Wikileaks of the leaked HT emails, soon after the Bayelsa account became active, then governor Seriake Dickson distributed free smart phones to politicians and journalists. These smart phones had allegedly been infected with HT's APT malware. It seems that HT spied on Bayelsa state "collector" servers to verify that Dickson was misusing their RCS system, but apparently the money was too good for HT to use its "kill switch" to shut down the Nigerian collectors. The Bayelsa account eventually resulted in about a half million Euros revenue for HT.

Many of HT's customers are poorly known to HT, since they deal with HT through its partner NICE, the Israeli cyberwar-for-hire company. In such cases, HT appears to accept without question assurances from NICE that a given customer is "respectful of human rights". As pointed out in the comments above, this claim is hardly credible since CEO David Vincenzetti was following human rights issues involving such customers as Egypt, Nigeria, Saudi Arabia, Sudan, Uzbekistan, and Vietnam, whose governments are notorious for their human rights abuses. Indeed, almost all of HT's most enthusiastic customers, for example Malaysia, could be described as "sketchy at best" when it comes to respecting the civil rights of citizens.

The emails show that the poorer nations often try to get as much as they can for free. One gets the impression that when pressed, they often cite an urgent "national security need" [sic] to shut down a particular blog or to spy on a particular political opponent, and surveillance-as-a-service customers raise few if any objections to such short-term goals.

Some of HT's customers appear anxious to hide as much information as possible about their activity, and even their identity. Others seemed to seek to get around NICE to deal directly with HT, but generally speaking, most customers seem to prefer to set up front companies to run their RCS accounts.

One example is particularly interesting because it appears to show HT colluding in an attempt to evade EU law. Russian secret agents appears to have set up a front company in Moscow called

JSC Advanced Monitoring
+7 495 737-61-97
advancedmonitoring.ru

This company partners with a "research institute" at Moscow State University called Kvant ("quantum"), but it appears to be a rather transparent front for FSB (Federal Security Service), the successor agency to the KGB. From a blurb for an "academic research" conference apparently sponsored by KVANT:

> Vulnerabilities of Android Cryptographic Applications
> Author: Pyotr Khenkin
> The report will cover the most well-known mobile applications for Android (with the focus on the USA market), which deal with user information — text encoders, user credentials storages, messengers. The results of the performed research show that none of the considered applications complies with the stated characteristics. They include both indirect and direct security threats, which allow accessing confidential data.
>
> Pyotr Khenkin
> System analyst at JSC Advanced Monitoring. Graduated from the Academy of Federal Security Service of Russia, has a wide experience in the cryptographic research of algorithms and their implementation in various operating systems. His area of interest also includes information system security analysis and software research in terms of information security.

I suggest these rough analogies:

NSA:FSB
IARPA: Kvant
Leidos: JSC Advanced Monitoring

The Russian account was still active in August 2014, which apparently is a violation of EU law. See

http://arstechnica.com/tech-policy/2015/07/hacking-teams-surveillance-s…
Hacking Team apparently violated EU rules in sale of spyware to Russian agency
Cyrus Farivar
17 Jul 2015

The emails confirm that HT is one of dozens of major international cyberwar-as-a-service corporations which compete for the same customers. Many of them are based in Israel, for example Elbit (which also sells surveillance drones and missiles) vied with HT to acquire Kazakhstan as a customer. The emails also confirm that these companies often form uneasy partnerships (e.g. HT and NICE), and then proceed to try to cheat each other by violating non-competition agreements. Further, the emails show that several HT employees left to found competing companies, which led to many (many!) emails between DV and his lawyers.

These communications are almost entirely unencrypted. And we must always bear in mind that one of the functions of NSA's XKEYSCORE system is to collect and funnel to NSA's long term storage intercepts of private data being stolen by criminal or espionage actors. In particular, NSA has considerable viability into networks in Italy, Nigeria, etc.

The fact that sensitive emails are so often encrypted poorly or not at all shows that as long as NSA can keep its clunky XKEYSCORE clandestine servers operating in target nations, it can rather easily keep tabs on all the worlds spies, LEAs, and criminals. It clearly doesn't use that information for good purposes, however. NSA never even considering warning Nigerian activists that their emails were being read, their phone calls overheard by the Nigerian government. It never even considered warning human rights activists in the US that their computers had been trojaned by the Syrian government. Clearly, NSA's only interest is in grabbing ever more power and influence by spying on an ever expanding fraction of all the world's people. It cares not one jot for the human rights of anyone, anywhere.

The cybersecurity of HT's key partner, NICE, is astonishingly lax, and this company's collection servers are apparently easily spied upon by various other actors, not just NSA. See

http://www.theregister.co.uk/2014/05/29/spy_platform_zero_day_exposes_c…
Spy platform zero day exposes cops' wiretapped calls
Darren Pauli
29 May 2014

The leaked documents also show much evidence of amazingly lax security standards at HT.

For example, at least six HT employees were regularly taking English lessons, apparently paid for by HT, and to judge from the regularity with which they broke their appointments, this was among their least enjoyable job-related activities.

In Sep 2014, the language teacher explains to a new student

> Morning! As we discussed in the last lesson, let's do a role play of a scenario that you do at work. So bring anything you need to the lesson. See you this afternoon! Peter

The language teacher regularly exchanged Evernote powered emails correcting his students' language exercises, which reveal substantial hints about employee experience as Hacking Team. Snippets suggest that essential skills at Hacking Team include:
> You have to be able to speak using layman terms
> to give demos of the product
> to automatize something
> to smooth something out = fix it, make it better
> to tweak something (to make a small change)
> To deal with the questions / problems

The employee email disparaging comments:

> They eat too much meat in Mexico.
> He didn’t know how to use the software.
> They never look in your eyes when they use the phone.
> Barack Obama: short greying hair, athletic build,
> Dresses professionally in a suit, Good social skills, No
> substance (just a media guy).

They discuss personal details and events at work:

> How did you learn to do these things?
> I started studying computer science when I was 13 years old.
> They ask us about the level of privacy in the system.
> a government agency.
> Eavesdropping.
> Sensitive information.
> To bust = to arrest
> Sketchy = suspicious and dangerous
> There is no trace of the operation.
> You can follow the target’s movements.
> The media don’t speak about it.
> Activists entered in our office.
> Security removed them.
> They published an old manual of ours.
> the media are all over it.

They discuss job-related difficulties:

> This problem has existed forever.
> It’s still not fixed by all the internet companies
> It’s an example of my abilities. A marketing project / Self promotion
> My rapport with him is very complicated.
> People get too big for their boots.
> He is lost and confused. He is anti-social because of
> psychological problems. He’s an alcoholic.

They make confessions which might be inappropriate in company email:

> I might create my own company.

So how has HT responded to vocal criticism from human rights organizations around the world? Has it cleaned up its act? Not exactly.

Here is Emad Shehata, Key Account Manager for Africa, writing to a potential customer in Kenya on 27 Apr 2015 with the standard HT "pitch":

> Dear Sir, I’m Emad Shehata, Key Account Manager in charge of your country.

> Since you have showed interest in our product, I take the occasion to send you some information related to the latest version of Remote Control System, codenamed Galileo. Galileo is designed to attack, infect and monitor target PCs and Smartphones, in a stealth way. It allows you to covertly collect data from the most common desktop operating systems, such as:
> * Windows
> * OS X
> * Linux
>
> Furthermore, Remote Control System can monitor all the modern smartphones:
> * Android
> * iOS
> * Blackberry
> * Windows Phone
>
> Once a target is infected, you can access all the information, including:
>
> * Skype calls
> * Facebook, Twitter, WhatsApp, Line, Viber and many more
> * device location
> * files
> * screenshots
> * microphone
>
> and much more. To protect your operations, resistance and invisibility to the major endpoint protection systems is integral to the solution. Galileo also introduces Intelligence, a module designed to correlate the collected information, to speed up your investigation and highlight relevant connections.
>
> There is more to show you than this. If you are interested, please get in touch: we would be more than happy to schedule a presentation and live demonstration at your premises.

The Kenyan customer replies with an urgent special request:

> Dear Emad, Hope this email finds you well. We have seen your proposal on the Galileo product and all looks great and would wish to move forward. Meanwhile, there is a quick task we have for you:
>
> 1) There is a website we would wish you urgently bring down, either by defacement or by making it completely inaccessible. The website url is http://www.kahawatungu.com. If you can bring this site down, it would serve as a great proof of concept for your capabilities and also provide a means of immediate engagement.
>
> Please let me know if this is possible, and how soon you can have it done. Best regards, Support team.

HT Operations Manager Danielle Milan then sends a worried email to Shehata warning that "the url (http://www.kahawatungu.com) they asked us to tear down is a news website that is highlighting corruption and other wrongdoings in the Kenya government. I don’t think we want to be involved with this". Initially, Vincenzetti appeared to agree, but as of June 2015, it seems that instead of declining the Kenyan account, HT was trying to "educate" this potential customer to be a little less direct in expressing its eagerness to use RCS attack anti-corruption bloggers.

The well-known anti-cybercrime blogger Brian Krebs is generally approving of "darknet take downs" by entities such as FBI, but he too appears to recoil from HT's abuse of the internet:

https://krebsonsecurity.com/2015/07/hacking-team-used-spammer-tricks-to…
Hacking Team Used Spammer Tricks to Resurrect Spy Network
Brian Krebs
7 Jul 2015

> New analysis of the leaked Hacking Team emails suggests that in 2013 the company used techniques perfected by spammers to hijack Internet address space from a spammer-friendly Internet service provider in a bid to regain control over a spy network it apparently had set up for the Italian National Military Police.

Krebs is referring to the fact that HT colluded with an Italian agency and a telecom to subvert a critical internet protocol, BGP:

http://arstechnica.com/security/2015/07/hacking-team-orchestrated-braze…
Hacking Team orchestrated brazen BGP hack to hijack IPs it didn’t own
Hijacking was initiated after Italian Police lost control of infected machines.
Dan Goodin
12 Jul 2015

"Over a six day period in August 2013, Italian Web host Aruba S.p.A. fraudulently announced its ownership of 256 IP addresses into the global routing system known as border gateway protocol, the messages document. Aruba's move came under the direction of Hacking Team and the Special Operations Group of the Italian National Military Police, which was using Hacking Team's Remote Control System malware to monitor the computers of unidentified targets. The hijacking came after the IP addresses became unreachable under its rightful owner Santrex, the "bullet-proof" Web hosting provider that catered to criminals and went out of business in October 2013, according to KrebsOnSecurity."

Of course, this is precisely the kind of naked abuse of governmental powers which flourishes in the atmosphere of "dark governance" introduced and energetically promoted around the world by USG.

Bloggers with a wide range of political perspectives have called for prosecution of Hacking Team. But predictably, "the authorities" are so far focusing on investigating suspected leakers:

http://gadgets.ndtv.com/internet/news/ex-employees-probed-for-attack-on…
Ex-Employees Probed for Attack on Surveillance Software Maker Hacking Team
Reuters, 18 July 2015

"Milan prosecutors are investigating six former employees of surveillance software maker Hacking Team in connection with a massive attack on the data system of the Italian cyber-security firm, sources familiar with the case said on Friday."

There has already been some major political "fallout" from the leaked emails:

http://in-cyprus.com/intelligence-service-chief-steps-down/
Intelligence Service chief steps down
incyprus — 11/07/2015
KYP-PENTARAS

"The head of the Cyprus Intelligence Service (KYP), Andreas Pentaras, has resigned following revelations that the island’s secret service department had purchased spy-hacking software. Last week, leak documents revealed that KYP had paid €50,000 for what appeared to be remote attack vectors from Italian company ‘The Hacking Team’ in order to spy on persons of interest by either hacking their mobile telephones or other electronic devices like laptops and Ipads."

http://radiobiafra.co/index.php?option=com_k2&view=item&id=102987:in-su…
In Suicide Note, South Korea Hacking Expert Denies Domestic Spying
19 July 2015

"A hacking specialist at South Korea’s National Intelligence Service who was found dead left a suicide note denying that his team spied on South Korean citizens’ cellphone or other online communications, the police said on Sunday. The 45-year-old agent, who was identified only by his last name, Lim, was found dead in his car near Seoul on Saturday. His apparent suicide came as the political opposition demanded an investigation into suspicions that the spy agency had been intercepting the cellphone and computer communications of South Korean citizens, including government critics, using software it purchased from the Italian firm Hacking Team."

"Last week, the agency admitted buying hacking programs from the Italian company in 2012. But it said the purchase was for research purposes as it tried to bolster its spying on North Korea. South Korean bloggers, news outlets and opposition parties have cited Hacking Team’s leaked data to suggest that the agency may have spied on the country’s own citizens... South Korea held a presidential election in 2012, and a former spy chief is on trial on charges of leading a secret online smear campaign against the rivals of the eventual winner, President Park Geun-hye."

The agent left a note denying that his agency had used RCS to spy on political opponents of President Park.

Given the widespread interest from newspapers all around the world, as well as human rights groups, it seems undeniable that leaking the information from HT was clearly in the public interest. Examples:

Kenya's abuse of RCS:

http://tuko.co.ke/19859-wikileaks-how-kenyan-government-tried-to-tear-d…
WIKILEAKS: How Government Wanted To Spy On Kenyans
Dickens Kasami
14 Jul 2015

http://mobile.english.rfi.fr/africa/20150717-kenyan-government-asked-ha…
Kenya : Kenyan government asked Hacking Team to attack dissident website
Daniel Finnan
17 July 2015

Nigeria's abuse of RCS:

http://www.metronaija.com/2015/07/bayelsa-governor-hires-worlds-most.ht…
Bayelsa Governor Hires World’s Most Ruthless Hackers To Hack Computers
9 Jul 2015

Vietnam's abuse of RCS:

http://www.theregister.co.uk/2015/07/13/hacking_team_vietnam_apt/
Hacking Team's snoopware 'spied on anti-communist activists in Vietnam'
John Leyden
13 Jul 2015

HT hawking its RAT to Bangladeshi death squads:

http://motherboard.vice.com/read/leaked-emails-show-hacking-team-lied-t…
Leaked Emails Show Hacking Team Lied to Its ‘Rascal’ Customers
Lorenzo Franceschi-Bicchierai
July 14, 2015 // 02:50 PM EST

"Contrary to its public claims of vetting customers to make sure its software wouldn’t be abused, leaked documents and emails showed that Hacking Team, sold its spyware to authoritarian countries with poor human rights records such as Ethiopia or Sudan, and even considered selling to Bangladesh’s “death squad,” and Rwanda."

So what's next? Recent email exchanges between HT and Insitu, a Boeing subsidiary which makes surveillance drones to militaries, intelligence agencies, and LEAs confirm warnings from privacy advocates that drone makers are seeking to provide US LEAs with the ability to insert malware into the devices of targeted citizens from overflying drones (a technique which has been extensively used by NSA to attack all WiFi-enabled devices of all citizens in certain nations):

https://firstlook.org/theintercept/2015/07/18/hacking-team-wanted-infec…
Hacking Team and Boeing Subsidiary Envisioned Drones Deploying Spyware
Cora Currier
2015-07-18

"There are lots of ways that government spies can attack your computer, but a U.S. drone company is scheming to offer them one more. Boeing subsidiary Insitu would like to be able to deliver spyware via drone. The plan is described in internal emails from the Italian company Hacking Team, which makes off-the-shelf software that can remotely infect a suspect’s computer or smartphone, accessing files and recording calls, chats, emails and more."

This, evidently, is how companies like HT intend to "leverage" the Internet of Things (IoT) to harm even more citizens, if they are not eliminated from the international marketplace.