Hacking Team

» see hackingteam.com as it lived, on the wayback machine

~ the goodbye ~

Two Italians founded this in Milan in 2003, and for the first few years it was an ordinary security consultancy of the kind that audits a bank's network and writes a report. The pivot came when the Milan police asked for something nobody was selling: a way to read Skype calls, which were encrypted in transit and therefore useless to a wiretap on the line. The answer was to stop tapping the line and get inside the machine at either end. That product became Remote Control System, and within a decade the customer list ran to about seventy government agencies.

The company was unusually open about what it did. It exhibited at surveillance trade fairs and gave interviews, arguing in public that it sold only to legitimate law enforcement and vetted every customer against a human rights standard of its own devising. That confidence is the thing that made 5 July 2015 so complete. Somebody took the corporate Twitter account, renamed it Hacked Team, then published four hundred gigabytes off the internal network from that handle. The mail spool went back years.

What came out was the customer list, which included Sudan, Bahrain, Kazakhstan and Saudi Arabia, alongside internal discussion of how to keep selling to them. Citizen Lab at the University of Toronto had been reporting for three years that the software was turning up on the devices of journalists and activists in exactly these countries, and had been publicly disputed. The emails settled it. Italy revoked the company's global export license, then revoked it a second time in 2016 after an appeal had restored it.

It kept trading for four more years on a reputation that no longer existed. On 2 April 2019 InTheCyber Group absorbed what was left and renamed it Memento Labs. David Vincenzetti posted three words on LinkedIn on 26 May 2020: Hacking Team is dead.

~ the chronicle ~

~ the thing in the box ~

Remote Control System, sold later as Da Vinci and then Galileo, was a commercial product with a support contract and a training program. An agency bought a license for a number of concurrent targets and pushed an implant onto a phone or a laptop through an exploit or a fake update, driving the whole thing from a console. Once installed it read mail and messages, logged keystrokes, pulled the call history, took the files, and turned on the microphone and the camera on request. It survived a factory reset on some devices.

The engineering that made it sellable was everything around the intrusion, which is the part outsiders never assume is the hard one: an interface an inspector with no technical training could operate, and an update channel that kept the implants alive as phone operating systems patched. This was enterprise software with a repellent purpose, built to enterprise standards. Its documentation was better than most banking software.

The leak included the source for all of it, plus several working exploits, including a Flash zero day that was in criminal exploit kits within days of publication. That is the part security people still argue about, because the same publication that ended one vendor armed everybody who downloaded it.

~ four hundred gigabytes ~

Phineas Fisher had already done this once, to the British and German surveillance vendor Gamma Group in 2014, and published a how-to afterward explaining the method in plain language as an argument that anyone could do it. The Hacking Team job was the same operation at ten times the scale, and the writeup released later described getting in through an embedded device on the company's own network and then moving to the backup server, which held everything.

The irony was noticed at the time and it is worth stating plainly rather than dressing up. A company whose entire product was the proposition that no device can be trusted was itself compromised through a device it had not thought about, and the thing that destroyed it was not the intrusion but the publication. Nobody has been charged.

~ the turkish contract ~

The Turkish National Police were a customer. The General Directorate of Security held a Remote Control System license from June 2011 to November 2014 and paid €440,000 for it, and the 2014 client overview in the leak lists a named intelligence officer in the police IT department as the contact and records fifty targets in total. The correspondence in the dump runs from 2010 to 2015. This is the rare case where a dead foreign product left a documented local file rather than a story about who never got to buy it. The invoices are public and the contact is named. Four hundred gigabytes told the world what this company sold and to whom, and told the fifty targets nothing at all.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »