The Hacking Team Hack (2015): Difference between revisions

From International cyber law: interactive toolkit
Jump to navigation Jump to search
Content added Content deleted
VisualWikitext
m (Fixed for fluency, lexical, syntactic and grammatical errors.)
 
Line 4: Line 4:
|-
|-
! scope="row"|Suspected actor
! scope="row"|Suspected actor
|Unknown. However, the hacker asserts to be a lone wolf under the nickname of Phineas Fisher. Further investigations did not clarify whether the attack has been conducted by a single hacker or an organization.
|Unknown. However, the hacker claimed to be a lone wolf under the nickname of Phineas Fisher. Further investigations did not clarify whether the attack has been conducted by a single hacker or an organization.
|-
|-
! scope="row"|Target
! scope="row"|Target
Line 13: Line 13:
|-
|-
! scope="row"|Method
! scope="row"|Method
|The hacker managed to exploit a vulnerability on one of the embedded devices of the company´s network.<ref>J M Porup, [https://arstechnica.com/information-technology/2016/04/how-hacking-team-got-hacked-phineas-phisher/ “How Hacking Team got hacked”], (19 April 2016), Ars Technica. </ref> Once obtained a remote root exploit, the malicious actor has been able to gain administrative privileges inside the company’s main Windows network. From there, the hacker has been able to navigate within the network and steal a considerable amount of data.<ref>L Franceschi-Bicchierai, [https://motherboard.vice.com/en_us/article/3dad3n/the-vigilante-who-hacked-hacking-team-explains-how-he-did-it “The Vigilante Who Hacked Hacking Team Explains How He Did It”], (16 April 2016), Motherboard. </ref>
|The hacker managed to exploit a vulnerability on one of the embedded devices of the company´s network.<ref>J M Porup, [https://arstechnica.com/information-technology/2016/04/how-hacking-team-got-hacked-phineas-phisher/ “How Hacking Team got hacked”], (19 April 2016), Ars Technica. </ref> After obtaining a remote root exploit, the malicious actor was able to gain administrative privileges inside the company’s main Windows network. From there, the hacker was able to navigate within the network and steal a considerable amount of data.<ref>L Franceschi-Bicchierai, [https://motherboard.vice.com/en_us/article/3dad3n/the-vigilante-who-hacked-hacking-team-explains-how-he-did-it “The Vigilante Who Hacked Hacking Team Explains How He Did It”], (16 April 2016), Motherboard. </ref>
|-
|-
! scope="row"|Purpose
! scope="row"|Purpose
|The hacker claimed that the attack was conducted to punish the Hacking Team company for selling digital surveillance products considered as human rights enabler . The attack also highlighted that many of the company’s customers have been authoritarian regimes.<ref>E Auchard, J Menn, [https://www.reuters.com/article/us-cybersecurity-hacking-team/surveillance-software-maker-hacking-team-gets-taste-of-its-own-medicine-idUSKCN0PG16720150706 “Surveillance software maker Hacking Team gets taste of its own medicine”], (6 July 2015), Reuters. </ref>
|The hacker claimed that the attack was conducted to punish the Hacking Team company for selling digital surveillance products considered to be enablers of human rights violations . The attack also highlighted that many of the company’s customers had been authoritarian regimes.<ref>E Auchard, J Menn, [https://www.reuters.com/article/us-cybersecurity-hacking-team/surveillance-software-maker-hacking-team-gets-taste-of-its-own-medicine-idUSKCN0PG16720150706 “Surveillance software maker Hacking Team gets taste of its own medicine”], (6 July 2015), Reuters. </ref>
|-
|-
! scope="row"|Result
! scope="row"|Result
|Theft and leak of more than 400 Gigabytes including internal emails, files and their Remote Control System (RCS) source code.<ref>A Hern, [https://www.theguardian.com/technology/2015/jul/11/hacking-team-hack-state-surveillance-human-rights “Hacking Team hack casts spotlight on murky world of state surveillance”], (11 July 2015), The Guardian.</ref> The malicious actor hacked the Twitter account of the company and posted a message containing a link to the torrent file containing the files. Around 80% of the company’s spyware source code has been put visible online.<ref>D Kushner, [https://foreignpolicy.com/2016/04/26/fear-this-man-cyber-warfare-hacking-team-david-vincenzetti/ “Fear This Man”], (26 April 2016), Foreign Policy.</ref>
|Theft and leak of more than 400 gigabytes of data including internal emails, files and their Remote Control System (RCS) source code.<ref>A Hern, [https://www.theguardian.com/technology/2015/jul/11/hacking-team-hack-state-surveillance-human-rights “Hacking Team hack casts spotlight on murky world of state surveillance”], (11 July 2015), The Guardian.</ref> The malicious actor hacked the Twitter account of the company and posted a message containing a link to the torrent file containing the files. Around 80% of the company’s spyware source code has been made visible online.<ref>D Kushner, [https://foreignpolicy.com/2016/04/26/fear-this-man-cyber-warfare-hacking-team-david-vincenzetti/ “Fear This Man”], (26 April 2016), Foreign Policy.</ref>
|-
|-
! scope="row"|Aftermath
! scope="row"|Aftermath
|The attack has been followed by the release of a “do it yourself guide” that explains how the attack has been conducted.<ref>Phineas Fisher, [http://pastebin.com/raw/0SNSvyjJ “Hack Back! A DIY Guide”], () [http://pastebin.com/raw/0SNSvyjJ http://pastebin.com/raw/0SNSvyjJ] </ref> This has to be considered as the Phineas’ Manifesto, including both its political motivations and technical details of the hack.<ref>Pierluigi Paganini, [https://securityaffairs.co/wordpress/46416/data-breach/how-phineasfisher-hacking-team.html “The hacker PhineasFisher published a detailed explanation of how he has hacked the Italian surveillance firm Hacking Team”], (18 April 2016), Security Affairs. </ref> The leaked material showed that the Hacking Team sold surveillance tools to repressive regimes such as Ethiopia, Sudan, Russia, or Saudi Arabia which have been used to spy on journalists and activists.<ref>A Hern, [https://www.theguardian.com/technology/2015/jul/06/hacking-team-hacked-firm-sold-spying-tools-to-repressive-regimes-documents-claim “Hacking Team hacked: firm sold spying tools to repressive regimes, documents claim”], (6 July 2015), The Guardian.</ref> The attack to the company and the leaking of documents rendered the surveillance tools public and available for everybody. In the DIY guide, Phineas defined the attack as ethical hacking. <ref>CSO Press, [https://www.csoonline.com/article/3057200/security/hacker-who-hacked-hacking-team-published-diy-how-to-guide.html “Hacker who hacked Hacking Team published DIY how-to guide”], (17 April 2016), CSO.</ref>
|The attack was followed by the release of a “do it yourself guide” that explains how the attack has been conducted.<ref>Phineas Fisher, [http://pastebin.com/raw/0SNSvyjJ “Hack Back! A DIY Guide”], () [http://pastebin.com/raw/0SNSvyjJ http://pastebin.com/raw/0SNSvyjJ] </ref> This is considered to be the Phineas’ Manifesto, which explains both its political motivations and technical details of the hack.<ref>Pierluigi Paganini, [https://securityaffairs.co/wordpress/46416/data-breach/how-phineasfisher-hacking-team.html “The hacker PhineasFisher published a detailed explanation of how he has hacked the Italian surveillance firm Hacking Team”], (18 April 2016), Security Affairs. </ref> The leaked material showed that the Hacking Team sold surveillance tools to repressive regimes such as Ethiopia, Sudan, Russia, or Saudi Arabia which were used to spy on journalists and activists.<ref>A Hern, [https://www.theguardian.com/technology/2015/jul/06/hacking-team-hacked-firm-sold-spying-tools-to-repressive-regimes-documents-claim “Hacking Team hacked: firm sold spying tools to repressive regimes, documents claim”], (6 July 2015), The Guardian.</ref> The attack to the company and the leaking of documents rendered the surveillance tools public and available for everybody. In the DIY guide, Phineas described the attack as ethical hacking. <ref>CSO Press, [https://www.csoonline.com/article/3057200/security/hacker-who-hacked-hacking-team-published-diy-how-to-guide.html “Hacker who hacked Hacking Team published DIY how-to guide”], (17 April 2016), CSO.</ref>
|-
|-
! scope="row"|Analysed in
! scope="row"|Analysed in

Latest revision as of 06:51, 4 June 2021

Date 22 May 2015. However, the attack was discovered on 5 July 2015. [1]
Suspected actor Unknown. However, the hacker claimed to be a lone wolf under the nickname of Phineas Fisher. Further investigations did not clarify whether the attack has been conducted by a single hacker or an organization.
Target The Hacking Team, an Italian security company offering surveillance tool software to governments, intelligence and law enforcement agencies.[2]
Target systems Microsoft Windows-based systems
Method The hacker managed to exploit a vulnerability on one of the embedded devices of the company´s network.[3] After obtaining a remote root exploit, the malicious actor was able to gain administrative privileges inside the company’s main Windows network. From there, the hacker was able to navigate within the network and steal a considerable amount of data.[4]
Purpose The hacker claimed that the attack was conducted to punish the Hacking Team company for selling digital surveillance products considered to be enablers of human rights violations . The attack also highlighted that many of the company’s customers had been authoritarian regimes.[5]
Result Theft and leak of more than 400 gigabytes of data including internal emails, files and their Remote Control System (RCS) source code.[6] The malicious actor hacked the Twitter account of the company and posted a message containing a link to the torrent file containing the files. Around 80% of the company’s spyware source code has been made visible online.[7]
Aftermath The attack was followed by the release of a “do it yourself guide” that explains how the attack has been conducted.[8] This is considered to be the Phineas’ Manifesto, which explains both its political motivations and technical details of the hack.[9] The leaked material showed that the Hacking Team sold surveillance tools to repressive regimes such as Ethiopia, Sudan, Russia, or Saudi Arabia which were used to spy on journalists and activists.[10] The attack to the company and the leaking of documents rendered the surveillance tools public and available for everybody. In the DIY guide, Phineas described the attack as ethical hacking. [11]
Analysed in Scenario 11: Sale of surveillance tools in defiance of international sanctions

Collected by: Samuele De Tomas Colatin

  1. ↑ L Franceschi-Bicchierai, “Hacking Team Hacker Phineas Fisher Has Gotten Away With It”, (12 November 2018), Motherboard.
  2. ↑ Z Zorz, “Hacking Team hacked, 400GB+ of company documents and emails leaked”, (6 July 2015), Help Net Security.
  3. ↑ J M Porup, “How Hacking Team got hacked”, (19 April 2016), Ars Technica.
  4. ↑ L Franceschi-Bicchierai, “The Vigilante Who Hacked Hacking Team Explains How He Did It”, (16 April 2016), Motherboard.
  5. ↑ E Auchard, J Menn, “Surveillance software maker Hacking Team gets taste of its own medicine”, (6 July 2015), Reuters.
  6. ↑ A Hern, “Hacking Team hack casts spotlight on murky world of state surveillance”, (11 July 2015), The Guardian.
  7. ↑ D Kushner, “Fear This Man”, (26 April 2016), Foreign Policy.
  8. ↑ Phineas Fisher, “Hack Back! A DIY Guide”, () http://pastebin.com/raw/0SNSvyjJ
  9. ↑ Pierluigi Paganini, “The hacker PhineasFisher published a detailed explanation of how he has hacked the Italian surveillance firm Hacking Team”, (18 April 2016), Security Affairs.
  10. ↑ A Hern, “Hacking Team hacked: firm sold spying tools to repressive regimes, documents claim”, (6 July 2015), The Guardian.
  11. ↑ CSO Press, “Hacker who hacked Hacking Team published DIY how-to guide”, (17 April 2016), CSO.
Retrieved from "https://cyberlaw.ccdcoe.org/wiki/The_Hacking_Team_Hack_(2015)?oldid=2414"