SoylentNews is people
SoylentNews
It is just now being reported on Twitter and by CSO Online that Italian security firm Hacking Team has been compromised by parties unknown.
The attack, which took place during the Women's World Cup, resulted in a Torrent file with over 400GB of of internal documents, source code, and email communications being made available to the public. Meanwhile, the attackers have also seized control of Hacking Team's Twitter, defacing it and posting images of the stolen data.
Christopher Soghoian, principal technologist of the ACLU, says that a preliminary analyst of the Torrent's contents suggests that Hacking Team included among their customers nations such as South Korea, Kazakhstan, Saudi Arabia, Oman, Lebanon, and Mongolia. Hacking Team, which specializes in intrusion and surveillance, has always maintained that they do not do business with oppressive governments.
The tools developed by Hacking Team have been linked to several cases of privacy invasion in the past, by researches and the media.
n1 writes:
Among the more potentially damaging documents made public are invoices showing that Hacking Team has sold its intrusion software to government agencies in countries known to have oppressive regimes, including Sudan, Ethiopia, and Egypt.
[...] Hacking Team officials have not released any official public statements about the attack yet.
As researchers and others have begun to look through the documents, they have found a number of significant things, aside from the invoices. Among the discoveries is the fact that Hacking Team has a legitimate Apple iOS developer certificate that expires next year. Another researcher found a handful of files that listed the VPS (virtual private server) servers used by Hacking Team, and published a list of the IP addresses for the servers.
Original Submission 1
Original Submission 2
(Score: 0) by Anonymous Coward on Monday July 06 2015, @05:29PM
Anybody here taking up this torrent?
(Score: 5, Informative) by _NSAKEY on Monday July 06 2015, @05:42PM
You don't need to get it all if you don't want. Mirrors of the data can be found here [thecthulhu.com] and here [musalbas.com]. HackingTeam's Twitter timeline [archive.is] from just after the breach announcement is packed full of comedy for those of you who are into that sort of thing.
(Score: 5, Informative) by Marneus68 on Monday July 06 2015, @05:52PM
https://github.com/hackedteam [github.com]
(Score: 2, Touché) by Anonymous Coward on Monday July 06 2015, @05:42PM
I guess they didn't use their own products, which is bad, or they did use their products and got hacked anyway, which is worse. Based on their client list of oppressive regimes they got what they deserved.
(Score: 5, Insightful) by MrGuy on Monday July 06 2015, @05:59PM
You misunderstand their products.
Hacking Team sells intrusion products - products that exploit weaknesses and introduce backdoors on targeted machines to enable surveillance. This is materially different from selling products/being experts in the field of PREVENTING companies from hacking your OWN machines. The fields are related, but they differ significantly - one is offense and the other is defense.
To have a successful hacking product, you need knowledge of only a small number (as little as one) exploitable problems as a way in. Your main expertise needs to be in making benign-looking exploit tools that can run on the target machine and enable surveillance without alerting the user, so that you can stay undetected for a long time. To protect a company, you need to know ALL the possible exploits that can be used to find a way in to your machines.
(Score: 5, Funny) by The Archon V2.0 on Monday July 06 2015, @06:53PM
And for further proof that you don't need to have good security to build intrusion tools, the managing director thinks "passw0rd" is a password that should be used.
Repeatedly.
Across multiple systems.
http://www.computing.co.uk/ctg/news/2416369/hacking-team-md-used-passw0rd-as-password-for-every-system [computing.co.uk]
(Score: 2) by edIII on Tuesday July 07 2015, @12:01AM
I've always thought the best password was just a single space. I mean seriously, who would ever think you would be that stupid right? ;)
Technically, lunchtime is at any moment. It's just a wave function.
(Score: 0) by Anonymous Coward on Tuesday July 07 2015, @12:24AM
I do understand their products. And if they did they would have patched or otherwise mitigated those know (to them) vulnerabilities. If they can penetrate their own networks with their own products then they are foolish.
(Score: 2) by JNCF on Monday July 06 2015, @07:45PM
Based on their client list of oppressive regimes they got what they deserved.
'Chickens coming home to roost,' as The Man said.
(Score: 3, Touché) by Runaway1956 on Monday July 06 2015, @06:02PM
They need something more to their name, like Federal.
http://krebsonsecurity.com/2011/02/hbgary-federal-hacked-by-anonymous/ [krebsonsecurity.com]
We're gonna be able to vacation in Gaza, Cuba, Venezuela, Iran and maybe Minnesota soon. Incredible times.
(Score: 4, Funny) by MrGuy on Monday July 06 2015, @06:15PM
Or maybe something about Equations. [wikipedia.org]
(Score: 0) by Anonymous Coward on Monday July 06 2015, @11:54PM
How about Karma?
(Score: 3, Funny) by Runaway1956 on Tuesday July 07 2015, @01:28AM
Karma? That's when a script kiddie is reincarnated as a Game Boy, and a real hacker gets reincarnated as a data center.
We're gonna be able to vacation in Gaza, Cuba, Venezuela, Iran and maybe Minnesota soon. Incredible times.
(Score: 0) by Anonymous Coward on Tuesday July 07 2015, @02:15AM
I prefer to reincarnate into a Gameboy
(Score: 3, Touché) by MrGuy on Monday July 06 2015, @06:12PM
I am particularly amused by the wording of their denial.
According to Salted Hash, [csoonline.com] Christian Pozzi of Hacking Group responded to the hack as follows:
Given the apparent smoking gun of his company's ties to oppressive regimes and defiance of UN embargoes, one wonders if he realizes the irony in his claim that "The people responsible for this will be arrested."
Note: per the article I quote, the statement attributed to Christian Pozzi was apparently posted on his personal twitter account, which was subsequently hacked and later taken down. Given a reputable news source attributes the quote to Pozzi, I am doing the same, but apply your own amount of salt.
(Score: 2) by Marneus68 on Monday July 06 2015, @06:26PM
I saw the quote when his twitter was still live bfore it was hacked this morning. I know this doesn't mean anything but I can confirm it was real.
As for the threat itself I don't think there's any weight to it yet, it's more like a "you dun goofed, you've been reported to the state police and the cyber police" kind of threat.
(Score: 3, Funny) by Dunbal on Monday July 06 2015, @06:32PM
Because Italians have been at the forefront of security since Julius Caesar.
(Score: 2) by aristarchus on Monday July 06 2015, @10:26PM
Gallic Wars! "Veni, visi, hacked!"
(Score: 0) by Anonymous Coward on Monday July 06 2015, @11:57PM
Blame it on the French.
(Score: 2) by aristarchus on Tuesday July 07 2015, @12:14AM
But the Franks would not even be there for six or seven centuries. Gauls! Celtic people. On the other hand, the Lombards would not migrate into Italia till about the same time. So what have the Romans ever done for us?