Biz & IT —

Massive leak reveals Hacking Team’s most private moments in messy detail

Imagine "explaining the evilest technology on earth," company CEO joked last month.

Massive leak reveals Hacking Team’s most private moments in messy detail

Privacy and human rights advocates are having a field day picking through a massive leak purporting to show spyware developer Hacking Team's most candid moments, including documents that appear to contradict the company's carefully scripted PR campaign.

"Imagine this: a leak on WikiLeaks showing YOU explaining the evilest technology on earth! :-)," Hacking Team CEO David Vincenzetti wrote in a June 8 e-mail to company employees including Walter Furlan, whose LinkedIn profile lists him as the international sales engineer of the spyware developer. "You would be demonized by our dearest friends the activists, and normal people would point their fingers at you."

Other documents suggested the US FBI was among the customers paying for software that allowed targets to be surreptitiously surveilled as they used computers or smartphones. According to one spreadsheet first reported by Wired, the FBI paid Hacking Team more than $773,226.64 since 2011 for services related to the Hacking Team product known as "Remote Control Service," which is also marketed under the name "Galileo." One spreadsheet column listed simply as "Exploit" is marked "yes" for a sale in 2012, an indication Hacking Group may have bundled some sort of attack code that remotely hijacked targets' computers or phones. Previously, the FBI has been known to have wielded a Firefox exploit to decloak child pornography suspects using Tor.

Security researchers have also scoured leaked Hacking Team source code for suspicious behavior. Among the findings, the embedding of references to child porn in code related to the Galileo.

Still another document boasts of Hacking Team's ability to bypass certificate pinning and the HTTP strict transport security mechanisms that are designed to make HTTPS website encryption more reliable and secure. "Our solution is the only way to intercept TOR traffic at the moment," the undated PowerPoint presentation went on to say.

Elsewhere, the document stated: "HTTPS Everywhere enforces https and could send rogue certificates to the EFF SSL Observatory." HTTPS Everywhere is a browser extension developed by the Electronic Frontier Foundation that ensures end users use HTTPS when connecting to a preset list of websites. The statement appears to be a warning that any fraudulent certificates Galileo relies on could become public if used against HTTPS Everywhere users when they have selected an option to send anonymous copies of HTTPS certificates to EFF's SSL Observatory database.

Yet another document airing Hacking Team's private dealings is one purportedly prepared by private investigation firm Kroll. It details Hacking Team's dealings with a US-based contractor suspected of secretly working for a company that competes with Hacking Team in the market for active interception products. The arrangement appeared to be a violation of non-compete clauses signed by the contractor.

The spoils of the Hacking Team compromise go on an on, and also purportedly include the now-compromised GPG key Hacking Team engineer Christian Pozzi. The document dump—said to be 400 gigabytes in size by the person who made them public—originally came in the form of a BitTorrent download. Since then, the leak has been mirrored on sites here and here. The privacy consultant who set up the latter site has reported receiving a legal notice demanding he remove the leaked documents. Even if the mirror sites remove the content, there's little chance of containing the damage to the reputation of Hacking Team and its many customers. Expect this story to stick around for at least the next week or two and possibly much, much longer.

Channel Ars Technica