Difference between revisions of "Hacking Team"

From The iPhone Wiki
Jump to: navigation, search
(noting chronic's opinions from twitter)
m
 
(7 intermediate revisions by one other user not shown)
Line 1: Line 1:
 
'''Hacking Team''' is a company that [https://en.wikipedia.org/wiki/Hacking_Team "sells offensive intrusion and surveillance capabilities to governments and law enforcement agencies"], including iOS spyware tools. The iOS spyware tools appear designed for targeting/attacking specific people, not for broad surveillance of the public.
 
'''Hacking Team''' is a company that [https://en.wikipedia.org/wiki/Hacking_Team "sells offensive intrusion and surveillance capabilities to governments and law enforcement agencies"], including iOS spyware tools. The iOS spyware tools appear designed for targeting/attacking specific people, not for broad surveillance of the public.
  +
  +
See [[malware for iOS]] for context and a list of similar tools.
   
 
== Remote Control System tool (requires jailbreak) ==
 
== Remote Control System tool (requires jailbreak) ==
   
In June 2015, security researchers [http://www.wired.com/2014/06/remote-control-system-phone-surveillance/ published details about Hacking Team's iOS tool], discovered via reverse engineering it. This research [http://www.macworld.com/article/2944712/hacking-team-hack-reveals-why-you-shouldnt-jailbreak-your-iphone.html got confirmed in July 2015 by a data breach] that revealed Hacking Team's internal documentation and pricing for this tool and related tools.
+
In {{date|2014|06}}, security researchers [http://www.wired.com/2014/06/remote-control-system-phone-surveillance/ published details about Hacking Team's iOS spyware tool], discovered via reverse engineering it. This research [http://www.macworld.com/article/2944712/hacking-team-hack-reveals-why-you-shouldnt-jailbreak-your-iphone.html got confirmed in {{date|2015|07}} by a data breach] that revealed Hacking Team's internal documentation and pricing for this tool and related tools. (This was big news because the documents also had evidence that Hacking Team [http://www.theguardian.com/technology/2015/jul/06/hacking-team-hacked-firm-sold-spying-tools-to-repressive-regimes-documents-claim sold these tools to repressive governments].)
   
[https://drive.google.com/file/d/0B2q69Ncu9Fp_TF9XeFF3VFUwa2s/view The leaked "Remote Control System" documentation] includes on page 7 a description of the iOS tool: it requires a jailbreak, it's compatible with iOS 4-8.1, and it provides monitoring of chat (Skype, WhatsApp, and Viber), location, contacts, and list of calls. It costs about $55,000, purchased in conjunction with supporting tools and services.
+
[https://drive.google.com/file/d/0B2q69Ncu9Fp_TF9XeFF3VFUwa2s/view The revealed "Remote Control System" documentation] includes on page 7 a description of the iOS tool: it requires a jailbreak, it's compatible with iOS 4-8.1, and it provides monitoring of chat (Skype, WhatsApp, and Viber), location, contacts, and list of calls. It costs about $55,000, purchased in conjunction with supporting tools and services.
   
Other spyware tools for iOS also exist - for example, there is a MSpy spyware tool distributed via the BigBoss repository, which consumers can buy for $10-15 dollars a month. But with MSpy and other consumer-level spyware tools (there are several for iOS), you have to physically arrange for your target's phone to be jailbroken and then somebody has to manually install the tool.
+
Context for that tool is that other spyware tools for jailbroken iOS also exist - for example, there is a MSpy spyware tool distributed via the BigBoss repository, which consumers can buy for $10-15 dollars a month. With MSpy and other consumer-level spyware tools (there are several for iOS), you have to physically arrange for your target's phone to be jailbroken and then somebody has to manually install the tool.
   
 
=== Hacking Team tools for jailbreaking devices ===
 
=== Hacking Team tools for jailbreaking devices ===
   
  +
Hacking Team's spyware tool also relies on a device being jailbroken with a publicly-available jailbreak tool (or perhaps a custom tool built on top of a publicly-available jailbreak). Using public tools means that they have some of the same limitations as consumers: jailbreaking iOS 6-8 requires that the device passcode is disabled during the jailbreaking process, and recent jailbreaks also require that Find My iPhone is turned off.
Hacking Team has other pieces of malware for OS X and iOS that they can combine to ease the process of jailbreaking the device and installing the spyware, probably with the help of [https://en.wikipedia.org/wiki/Phishing#List_of_phishing_types spearphishing] attacks and other kinds of social engineering attacks.
 
   
[http://www.wired.com/2014/06/remote-control-system-phone-surveillance/ This Wired article about last year's security research] explains a little more:
+
Hacking Team has other pieces of malware for OS X and iOS that they may be able to combine to ease the process of jailbreaking the device and installing the spyware, probably with the help of their expertise in [https://en.wikipedia.org/wiki/Phishing#List_of_phishing_types spearphishing] attacks and other kinds of [https://en.wikipedia.org/wiki/Social_engineering_(security) social engineering] attacks. [http://www.wired.com/2014/06/remote-control-system-phone-surveillance/ This Wired article about last year's security research] explains a way that could happen:
   
 
<blockquote>"The iOS spy module works only on jailbroken iPhones, but agents can simply run a jailbreaking tool and then install the spyware. The only thing protecting a user from a surreptitious jailbreak is enabling a password on the device. But if the device is connected to a computer infected with Da Vinci or Galileo software and the user unlocks the device with a password, the malware on the computer can surreptitiously jailbreak the phone to install the spy tool."</blockquote>
 
<blockquote>"The iOS spy module works only on jailbroken iPhones, but agents can simply run a jailbreaking tool and then install the spyware. The only thing protecting a user from a surreptitious jailbreak is enabling a password on the device. But if the device is connected to a computer infected with Da Vinci or Galileo software and the user unlocks the device with a password, the malware on the computer can surreptitiously jailbreak the phone to install the spy tool."</blockquote>
   
  +
Will Strafach ([[User:ChronicDev]]) said on Twitter that there is no evidence for Hacking Team being able to jailbreak without physical access:
Hacking Team may also have tools that help crack passcodes on iOS devices, since security researchers have done some research on that.
 
 
Will Strafach ([[User:ChronicDev]]) said on Twitter:
 
 
* [https://twitter.com/chronic/status/618402672580927488 "condensed summary of avoiding HackingTeam malware: 1. always use latest iOS version 2. if you jailbreak, don't use AFC2, set strong SSH pw"]
 
* [https://twitter.com/chronic/status/618402672580927488 "condensed summary of avoiding HackingTeam malware: 1. always use latest iOS version 2. if you jailbreak, don't use AFC2, set strong SSH pw"]
 
* [https://twitter.com/chronic/status/618403092489445376 "the funny part is, jailbreaking neuters other aspects of security that someone like HackingTeam could take advantage of. but they do not."]
 
* [https://twitter.com/chronic/status/618403092489445376 "the funny part is, jailbreaking neuters other aspects of security that someone like HackingTeam could take advantage of. but they do not."]
Line 26: Line 26:
 
* [https://twitter.com/chronic/status/618403857383718912 "they are very clear that their client is meant to jailbreak the device of the victim. meaning they need physical access to your iOS device."]
 
* [https://twitter.com/chronic/status/618403857383718912 "they are very clear that their client is meant to jailbreak the device of the victim. meaning they need physical access to your iOS device."]
 
* [https://twitter.com/chronic/status/618404128834912257 "some say HackingTeam could use malware to infect your computer to silently deploy the jailbreak, but there is zero proof of that in dump."]
 
* [https://twitter.com/chronic/status/618404128834912257 "some say HackingTeam could use malware to infect your computer to silently deploy the jailbreak, but there is zero proof of that in dump."]
  +
  +
[[i0n1c]] also said on Twitter that physical access seems required:
  +
* [https://twitter.com/i0n1c/status/618106184952881152 "Every time a HT / FF leak is in the press people "re-discover" that their iOS implants require physical access to apply a jailbreak first."]
  +
* [https://twitter.com/i0n1c/status/618040048064331777 "yes it is long known that public jailbreaks get used to infect iOS devices instead of 0-day jailbreaks by HT and friends."]
  +
* [https://twitter.com/i0n1c/status/618109788883451904 "it seems iOS 0-day is too expensive (or unreachable) so they repurpose public JB. e.g. patch to install other packages."]
   
 
== Newsstand keylogger tool (doesn't require jailbreak) ==
 
== Newsstand keylogger tool (doesn't require jailbreak) ==
Line 32: Line 37:
   
 
<blockquote>"Researchers have also found so far that Hacking Team has a legitimate Apple enterprise signing certificate, which is used to create software that can be installed by employees of a company who also accept or have installed a profile that allows use of apps signed by the certificate. It was shown last November that an enterprise certificate combined with a jailbroken iOS device could be used to bypass iOS protections on installing apps. Further, Hacking Team had developed a malicious Newsstand app that could capture keystrokes and install its monitoring software."</blockquote>
 
<blockquote>"Researchers have also found so far that Hacking Team has a legitimate Apple enterprise signing certificate, which is used to create software that can be installed by employees of a company who also accept or have installed a profile that allows use of apps signed by the certificate. It was shown last November that an enterprise certificate combined with a jailbroken iOS device could be used to bypass iOS protections on installing apps. Further, Hacking Team had developed a malicious Newsstand app that could capture keystrokes and install its monitoring software."</blockquote>
  +
  +
== Discussion ==
  +
  +
More commentary from Will Strafach ([[User:ChronicDev]]):
  +
* [https://twitter.com/chronic/status/618860492224921600 "the HackingTeam iOS malware is far more lame than it could have been. they don't even seem to know they could bypass Location permissions."]
  +
* [https://twitter.com/chronic/status/618901783843311616 "I am not sure why people are laughing at HackingTeam statement of bad actors now being able to use their spy malware. they are not wrong."]
  +
* [https://twitter.com/chronic/status/619317034862706688 infecting an already jail broken device silently is apparently worth $18mm. wow. https://wikileaks.org/hackingteam/emails/emailid/21089"]
  +
* [https://twitter.com/chronic/status/619374025291075584 "apparently HackingTeam brought up using greenpois0n to infect devices when we open sourced it. looks like they couldn't even implement it."]
  +
  +
[[Category:Malware research]]

Latest revision as of 13:22, 17 September 2021

Hacking Team is a company that "sells offensive intrusion and surveillance capabilities to governments and law enforcement agencies", including iOS spyware tools. The iOS spyware tools appear designed for targeting/attacking specific people, not for broad surveillance of the public.

See malware for iOS for context and a list of similar tools.

Remote Control System tool (requires jailbreak)

In June 2014, security researchers published details about Hacking Team's iOS spyware tool, discovered via reverse engineering it. This research got confirmed in July 2015 by a data breach that revealed Hacking Team's internal documentation and pricing for this tool and related tools. (This was big news because the documents also had evidence that Hacking Team sold these tools to repressive governments.)

The revealed "Remote Control System" documentation includes on page 7 a description of the iOS tool: it requires a jailbreak, it's compatible with iOS 4-8.1, and it provides monitoring of chat (Skype, WhatsApp, and Viber), location, contacts, and list of calls. It costs about $55,000, purchased in conjunction with supporting tools and services.

Context for that tool is that other spyware tools for jailbroken iOS also exist - for example, there is a MSpy spyware tool distributed via the BigBoss repository, which consumers can buy for $10-15 dollars a month. With MSpy and other consumer-level spyware tools (there are several for iOS), you have to physically arrange for your target's phone to be jailbroken and then somebody has to manually install the tool.

Hacking Team tools for jailbreaking devices

Hacking Team's spyware tool also relies on a device being jailbroken with a publicly-available jailbreak tool (or perhaps a custom tool built on top of a publicly-available jailbreak). Using public tools means that they have some of the same limitations as consumers: jailbreaking iOS 6-8 requires that the device passcode is disabled during the jailbreaking process, and recent jailbreaks also require that Find My iPhone is turned off.

Hacking Team has other pieces of malware for OS X and iOS that they may be able to combine to ease the process of jailbreaking the device and installing the spyware, probably with the help of their expertise in spearphishing attacks and other kinds of social engineering attacks. This Wired article about last year's security research explains a way that could happen:

"The iOS spy module works only on jailbroken iPhones, but agents can simply run a jailbreaking tool and then install the spyware. The only thing protecting a user from a surreptitious jailbreak is enabling a password on the device. But if the device is connected to a computer infected with Da Vinci or Galileo software and the user unlocks the device with a password, the malware on the computer can surreptitiously jailbreak the phone to install the spy tool."

Will Strafach (User:ChronicDev) said on Twitter that there is no evidence for Hacking Team being able to jailbreak without physical access:

i0n1c also said on Twitter that physical access seems required:

Newsstand keylogger tool (doesn't require jailbreak)

This MacWorld article reports that Hacking Team also has spyware that doesn't require a jailbreak, via misuse of developer certificates:

"Researchers have also found so far that Hacking Team has a legitimate Apple enterprise signing certificate, which is used to create software that can be installed by employees of a company who also accept or have installed a profile that allows use of apps signed by the certificate. It was shown last November that an enterprise certificate combined with a jailbroken iOS device could be used to bypass iOS protections on installing apps. Further, Hacking Team had developed a malicious Newsstand app that could capture keystrokes and install its monitoring software."

Discussion

More commentary from Will Strafach (User:ChronicDev):