Hacking Team Write Up Contains Dicey Tricks and Possibly Useful Information
March 9, 2020
One of the problems DarkCyber encounters is figuring out what’s true, what’s shaped, and what’s off base. DarkCyber worked its way through a comparatively long write up about specialized service providers called “Cyberwar for Sale.” Be aware that the blog url may return a 404, display questionable links like a plea for the visitor to install wonky Flash or Microsoft support from an unidentified source, or display images some may find disturbing or illegal in some jurisdictions. The write up provides information on a range of subjects which may be of interest to those looking for content about some government activities.
The original article about Hacking Team was written by Mattathias Schwartz. The appeared in “mainstream media.” Examples include the Intercept. The recycling in AllyCanbeg blog flowed in our newsfeed on March 1, 2020.
DarkCyber worked through the Ally Canbeg version possibly modified by Ally Brake. One never knows when the factoids or alleged factoids will be useful. Another point of this write up is that looking for certain information can present challenges: Spam, scams, etc.
This is the Ally Canbeg blog on Blogspot. The story requires an explicit url. Be careful clicking within the story. Ally is wily in DarkCyber’s opinion. The site requires that the visitor’s ad blocker be disabled. The reason is that money is needed to create the content.
The DarkCyber team has extracted statements and information from the Ally Canbeg blog post. The goal is to make the assertions somewhat easier to follow. The factoids may be true or false, but taken as a whole, DarkCyber finds the write up interesting.
Despite the dicey nature of the blog, DarkCyber spotted a number of statements, possibly accurate, about the activities of Hacking Team, FinFisher, Trovicor, and NICE. Each of these firms is allegedly providing tools to compromise targets’ electronic communications and devices. Keep in mind that the AllyCanbeg blog is characterizing these companies. DarkCyber is summarizing information from the blog.
Let’s run through some of the statements in the blog post which DarkCyber found suggestive. DarkCyber has created some categories and group information in these. The source document is a bit scattered, and it is likely that the Ally Canbeg entity assembled the allegedly accurate information from a number of different sources. DarkCyber concludes that the write up itself is a polemic against Hacking Team, against “authorities” who use tools to act in a manner offensive to Ally Canbeg-type individuals, and the general state of surveillance systems and methods.
The Hacking Team Company
- Compared with conventional arms, surveillance software is subject to few trade controls. An effort by the US to regulate these types of software and systems under the Wassenaar Arrangement failed. Information about this agreement is available at this link.
- Hacking Team (founded in 2003) is based in Milan, Italy and has fewer than 50 employees. The founder is David Vincenzetti. Eric Rabe is identified as the company’s spokesperson in the US. Philippe Vinci is a company vice president. Alessandro Scarafile is an engineer with the company.
- The Hacking Team opened in 2015 a US subsidiary in Reston, Virginia. The idea was to sell the solution to the US military, the Department of Justice, and the Royal Canadian Mounted Police. Metro police departments were identified as prospects; for example, San Bernadino, CA, Washington, DC, New York, NY, Fort Lauderdale, FL, and Orlando, FL.
Government Failings
- The US government changed the rules of criminal procedure. The idea was to make it easier for federal agents to hack into multiple computers with a single warrant.
- The Electronic Frontier Foundation says about the Hacking Team technology: “This is much more intrusive than the interception of a phone call. They [presumably the authorities who purchased the Hacking Team solution] are not only listening; they are taking over your laptop.”
Business Practices
- Hacking Team customers sign contracts agreeing to comply with local laws. Ally Canberg writes, “Leaked documents suggest that employees have sometimes turned a blind eye.”
- Hacking Team marketed by sending emails to US military and intelligence community members. Government employees were on the list too.
The Hacking Team RCS Solution
- The company’s espionage tool is call RCS, shorthand for Remote Control System. The cost of the software is allegedly “as little as $200,000 a year.”
- RCS obtains information at the source before it can be encrypted. The unencrypted data is transferred to the designated capture point.
- The functions of RCS, once installed using techniques difficult for the target to identify, perform surveillance of text messages, emails, phone and Skype calls, location data.
- The methods for installing RCS include getting physical access to the device and then placing necessary software on the device. RCS can be installed over a WiFi network. An email containing malware in an attachment lures the target to open the attached file. Network injection may also be an option. Information about network injection can be found at this link. Social engineering can also be used.
- The Hacking Team was itself hacked in 2015. More than 400 gigabytes of information was made public. The RCS source code is allegedly “now public.”
- RCS captures images from built in cameras, sound from built in microphones, screenshots, detailed records of applications opened, information about bitcoins transferred, a continuous log of location with latitude and longitude data, address books, calendars, hone calls, Skype calls and passwords, and browser histories.
- Keyloggers record every key pressed.
- Data from a target’s device can be displayed on a time line.
- Data from a compromised device is routed through a series of dedicated servers scattered around the world.
Licensees
- The US FBI and the Drug Enforcement Administration have allegedly licensed the software. According to Ally Canbeg, the FBI’s licensing fees have been more than $700,000 paid since 2011.
- Hacking Team’s software has been licensed to Ecuador, Honduras, Ethiopia, Bahrain, Mexico (the company’s biggest export market), Morocco, Egypt, Singapore (the company’s first non-European customer),and Saudi Arabia, among others.
- Hacking Team has “a three year relationship” with Russia’s FSB, the equivalent of a national police force. Allegedly the Russian deal as intermediated by Kvant, a Russian entity.
Competitors
- SS8, a company “backed by Kleiner Perkins Caulfield Byers and the Harris Corporation” compete with the Hacking Team for customers.
Why Specialized Software Is a Big Seller
- Why vendors of specialized software have gained traction. The write up states: “Geopolitical winds have been blowing in favor of the Hacking Tem and other self described allies of law and order…As George Tenet famously said about pre-September 11 intelligence, blinking red: The imploding Middle East, a restive nuclear armed Russia, battalions of ISIS-trained jihadis roaming around Europe with their encrypted thumb drives and Dark Web expertise. Against this backdrop of ever-increasing danger, concerns about human rights are naive at best.” Hacking Team emails “exploit this sense of danger and alarm.” The theme of the sales and marketing, according to Ally Canbeg is “privacy is secrecy and secrecy is terrorism.”
DarkCyber Observations
- Ally Canbeg or Ally Brake present the information in a way likely to lead to unexpected behaviors on the site visitors computer. The blog runs on Blogspot, and DarkCyber thinks that Google, the owner of Blogspot, is not doing a very good job of monitoring code in the blogs on its service.
- Hacking Team is an example of a company behaving in a manner inappropriate to individuals with certain sensibilities.
- The information appears to be recycled from Mattathias Schwartz.
- Mentioning one competitor leaves the impression that a very small number of firms offer similar technology. Numerous firms offer similar capabilities.
Net Net
Wow. Dicey blog. Recycled information. Intent? Questionable.
Stephen E Arnold, March 9, 2020
Comments
-
- Subscribe to Beyond Search
Feature archive
News archive
-
