On Friday, the self-described black hat hacker who claimed responsibility for the Hacking Team dump last year, and who goes by the handle "Phineas Phisher," published the technical details of how he pulled off the caper—and encouraged others to follow his example.
The apparently bilingual hacker originally published the details in Spanish—"just having some fun trolling the English speaking internet," he posted on Reddit—but subsequently translated the document into English.
Private intelligence contractor Hacking Team develops and sells hacking tools to governments around the world, a practice many have questioned as enabling human rights violations.
"Hacking Team was a company that helped governments hack and spy on journalists, activists, political opposition, and other threats to their power," Phisher wrote, accusing Hacking Team CEO David Vincenzetti of being a "fascist."
"Companies like Hacking Team doing the state's dirty work deserve to get owned and exposed," he posted on Reddit.
Phisher is no script kiddie, whoever he is. The attack he describes goes well beyond exploiting OWASP Top 10 vulnerabilities.
"The guy is kind of a ninja," Dan Tentler, CEO of Phobos Group, which does attack simulation as a service, told Ars. "It's pretty rare you find exploitation, reverse engineering, exploit development, lateral movement, networking/routing, and exfiltration all in the same person."
How the hack went down
The hacker says that he discarded the idea of spear-phishing Hacking Team, writing that even though the technique is "responsible for the majority of hacks these days... I didn't want to try to spear phish Hacking Team, as their whole business is helping governments spear phish their opponents, so they'd be much more likely to recognise and investigate a spear phishing attempt."
To make things more challenging, Hacking Team appears to have secured their networks quite well. Unlike Gamma Group International, which the black hat also targeted (hence his Twitter handle @GammaGroupPR), Hacking Team did not expose much of an attack surface—only an up-to-date version of Joomla, "a mail server, a couple routers, two VPN appliances, and a spam filtering appliance."
So, the hacker explains, three options presented themselves: "look for a zero-day in Joomla, look for a zero-day in postfix, or look for a zero-day in one of the embedded devices."
"A zero-day in an embedded device seemed like the easiest option," the hacker added, "and after two weeks of work reverse engineering, I got a remote root exploit."
The hacker claims that he wrote backdoored firmware for the (unnamed) embedded device, and spent considerable time testing the backdoor to ensure that it would not cause system instability and prompt an employee to look more closely at the device.
Once inside, the hacker says he took a slow look around, and discovered an insecure MongoDB install, which he took the time to slag off in his pastebin post, writing "NoSQL, or rather NoAuthentication, has been a huge gift to the hacker community. Just when I was worried that they'd finally patched all of the authentication bypass bugs in MySQL, new databases came into style that lack authentication by design."
But, according to the hacker, it was Hacking Team's backups that proved the company's undoing. Their iSCSI devices were available on the local subnet, which the hacker mounted remotely on an external VPS he controlled.
reader comments
113