Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems

La pub de Hacking Team « passive monitoring is not enough » ▻https://www.youtube.com/watch?v=R63CRBNLE2o

D’autres documents, plus anciens, sur Hacking Team ▻https://privacyinternational.org/?q=node/561

D’autres articles ▻http://www.lemonde.fr/pixels/article/2015/07/06/le-vendeur-de-logiciels-espions-hacking-team-victime-d-un-piratage-massif_46 ▻http://rue89.nouvelobs.com/2015/07/06/cette-societe-aide-les-etats-a-surveiller-leurs-citoyens-fait-pirat

Le gouvernement français était très intéressé par ces produits d’espionnage : ►https://medium.com/@beyourownreason/revealed-the-true-extent-of-hacking-team-contacts-across-europe-dc04e5bdde2 (je sens que ça va être comme avec Snowden, on a des années d’articles à publier avec ça)

Big Banks Worked with Hacking Team, Which Also Sells Spy Tools to Dictators

►http://motherboard.vice.com/read/big-banks-worked-with-hacking-team-which-also-sells-spy-tools-to-d

(Deutsche Bank, ING Direct, AXA, Generali, ABN Amro, Barclays, CNP Assurances, ...)

Hacking Team’s Spyware Targeted Porn Sites’ Visitors

►http://motherboard.vice.com/read/hacking-teams-spyware-targeted-porn-sites-visitors

How a Russian hacker made $45,000 selling a 0-day Flash exploit to Hacking Team

▻http://arstechnica.com/security/2015/07/how-a-russian-hacker-made-45000-selling-a-zero-day-flash-exploit-to-hac

Hacking Team et ses liaisons en Algérie

▻https://dzleaks.wordpress.com/2015/07/10/hacking-team-et-ses-liaisons-en-algerie

A presentation on Hacking Team, by Hacking Team themselves...
▻http://ht.transparencytoolkit.org/FileServer/FileServer/Hackingteam/OLD/presentazioni%20e%20portfolio/old/Mission%20and%20Portfolio%20%2B%20EH.pdf

...and more...

#data_breach

Le communiqué officiel des vendeurs d’armes ▻http://www.hackingteam.it/index.php/about-us “Information related to the attacks on HackingTeam on July 6, 2015”

Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems

▻http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-uses-uefi-bios-rootkit-to-keep-rcs-9-agent-in-target-s

The dissection of the data from the Hacking Team leak has yielded another critical discovery: Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running.

[...]

To prevent being affected by this, we recommend users to:

– Make sure UEFI SecureFlash is enabled
– Update the BIOS whenever there is a security patch
– Set up a BIOS or UEFI password

Trend Micro

The FBI spent 698.000€ on Hacking Team’s spy tools Since 2011

▻http://www.wired.com/2015/07/fbi-spent-775k-hacking-teams-spy-tools-since-2011

#FBI

#HackingTeam

On FBI request, Hacking Team updated its software to monitor TOR browsers

▻https://firstlook.org/theintercept/2015/07/16/hackingteam-attacked-tor-browser

The FBI complained on Hacking Team’s customer website that the company’s “URL collector does not collect web traffic on TOR browser,” and suggested how to fix it:

download TOR browser bundle. Surf web through TOR browser. Infect the target with an agent with www collector enabled. WWW traffic is not collect when target surfs through TOR browser.

[...]

Less than two weeks later they told [the FBI] that [their] requested feature was in the works: “Dear Client, next RCS [Remote Control System] release (8.2.0) will capture URL from the TOR browser. Thank you.”

PS: interesting disclosure in the article:

(Disclosure: The Tor Project, which helps develop Tor and Tor Browser, has received money from the Freedom of the Press Foundation, where I sit on the board. It has also received money from the Omidyar Foundation, co-founded by Pierre Omidyar, who funds The Intercept‘s parent company First Look Media.)

#Tor #Tor_browser
#surveillance
#anonymity