On July of 2015, Italian cybersecurity solutions vendor "HackingTeam" was breached and more than 400 gigabytes of HackingTeam's most sensitive data leaked to the internet. Security researchers Amit Serper and Alex Frazer from Cybereason were one of the first to study the datadump and to publish information about. The research was quoted in several tech news sites such as Ars Technica. The research was also published in Hebrew in the DigitalWhisper e-zine, On the cybereason blog as an e-book (in english) and on public free lectures in Tel-aviv by the researchers themselves. The following slide deck is from that lecture.

1. © 2015 Cybereason Inc. All rights reserved.
The ]HackingTeam[ incident
Alex Frazer & Amit Serper
with

2. © 2015 Cybereason Inc. All rights reserved.
Amit Serper
• Senior security researcher @ Cybereason
• Malware research
• Researching attack methodologies on Windows, Linux
and OSX (which is garbage)
• Writing ugly yet functional POC code that does evil stuff
and sometimes work
• ~9 Years @ Israeli govt.
• Security Research 
• Musician, Drummer @ Long day
(facebook.com/longdayofficial)
• Contact: amit@cybereason.com, @0xamit

3. © 2015 Cybereason Inc. All rights reserved.
• Security researcher @ Cybereason
• Malware simulation development
• Advanced windows security research
• Metasploit development/customization
• ~ 12 Years IT Consulting & Project Management
• Network Architecture & Design
• App Dev
• Database Design & Management
• System Architecture
• American (tomorrow will be an Israeli) 
• Contact: alex@cybereason.com, @awfrazer
Alex Frazer

4. © 2015 Cybereason Inc. All rights reserved.
Our goals for this evening:
1. Who/what are the hacking team?
2. The leak - What happened there?
3. Interesting stuff we found
4. How were the HackingTeam tools used for an attack operation
5. Demo
6. Beer (which you can actually drink right now…)

5. © 2015 Cybereason Inc. All rights reserved.
Background
• Alberto Ornaghi and Marco Valleri created some tools, the most
noticeable of them was EtterCap (MITM tool).
• Italian police used EtterCap to monitor and record skype calls.
• Italian police Asked Ornaghi and Valleri to develop the software further –
HackingTeam was born!

6. © 2015 Cybereason Inc. All rights reserved.
Background
• Alberto Ornaghi and Marco Valleri created some tools, the most
noticeable of them was EtterCap (MITM tool).
• Italian police used EtterCap to monitor and record skype calls.
• Italian police Asked Ornaghi and Valleri to develop the software further –
HackingTeam was born!

7. © 2015 Cybereason Inc. All rights reserved.
Exploits – what are they?
An exploit is a way of manipulating a program to run a piece of
code it wasn’t supposed to run in the first place.

8. © 2015 Cybereason Inc. All rights reserved.
Background (continued)
Hacking team:
• Italian “cyber” solution vendor
• Offensive & Defensive (pen-testing) solutions
• Wrote exploits and purchased them from third parties
• Provided services to a lot of agencies, governments,
regimes and even private corporations – Some of them
are conspicuous
• Created the RCS (Remote Control System) which we are
going to discuss today

9. © 2015 Cybereason Inc. All rights reserved.
The Hacking Team story…
• HackingTeam is breached in the beginning of July
• Website hacked and defaced
• HackingTeam’s own twitter account (@hackingteam) is
hacked and used to post a link to a 400+ GB torrent file
with all of their data!

10. © 2015 Cybereason Inc. All rights reserved.

11. © 2015 Cybereason Inc. All rights reserved.
• Inside that torrent file was a treasure:
• All of the exchange server data
• All of the RCS installers + manuals + source code
• Important and private documents
• Screenshots from employees machines
• All of the GIT repository
• Pirated software and pirated versions of Operating
systems
• 3 full server images! (Windows Attack server,
Android attack server and the helpdesk support
server)
The story continues…

12. © 2015 Cybereason Inc. All rights reserved.
The story continues…

13. © 2015 Cybereason Inc. All rights reserved.
Around 21:00 on July 5th we realized that
this is a disaster for the HackingTeam
The story continues…

14. © 2015 Cybereason Inc. All rights reserved.
But for us…
The story continues…

15. © 2015 Cybereason Inc. All rights reserved.
The story continues…

16. © 2015 Cybereason Inc. All rights reserved.
HT had some
“interesting” clients
The story continues…

17. © 2015 Cybereason Inc. All rights reserved.
The story continues…

18. © 2015 Cybereason Inc. All rights reserved.
The story continues…

19. © 2015 Cybereason Inc. All rights reserved.
The story continues…

20. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

21. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

22. © 2015 Cybereason Inc. All rights reserved.
Wait… 400 Gigabytes?!
The story continues…

23. © 2015 Cybereason Inc. All rights reserved.
How did it happen?
The story continues…

24. © 2015 Cybereason Inc. All rights reserved.
Don’t they have security people?
The story continues…

25. © 2015 Cybereason Inc. All rights reserved.
Meet mr Christian Pozzi

26. © 2015 Cybereason Inc. All rights reserved.
Damage control…

27. © 2015 Cybereason Inc. All rights reserved.
The story continues…

28. © 2015 Cybereason Inc. All rights reserved.
The story continues…
With courtesy of Hacking Team

29. © 2015 Cybereason Inc. All rights reserved.
The story continues…
With courtesy of Hacking Team

30. © 2015 Cybereason Inc. All rights reserved.
The story continues…
With courtesy of Hacking Team

31. © 2015 Cybereason Inc. All rights reserved.
The story continues…

32. © 2015 Cybereason Inc. All rights reserved.
The story continues…

33. © 2015 Cybereason Inc. All rights reserved.
The story continues…

34. © 2015 Cybereason Inc. All rights reserved.
What is RCS ?

35. © 2015 Cybereason Inc. All rights reserved.
Remote Control System

36. © 2015 Cybereason Inc. All rights reserved.
Powerful spying tool

37. © 2015 Cybereason Inc. All rights reserved.
It allows the attacker to have TOTAL control

38. © 2015 Cybereason Inc. All rights reserved.
Cross-Platform

39. © 2015 Cybereason Inc. All rights reserved.

40. © 2015 Cybereason Inc. All rights reserved.
Agent Modules
• Screenshots
• Collection of skype calls
• File transfer
• Bitcoin data exfiltration
With courtesy of Hacking Team

41. © 2015 Cybereason Inc. All rights reserved.
Agent Modules
With courtesy of Hacking Team

42. © 2015 Cybereason Inc. All rights reserved.
Agent Modules
With courtesy of Hacking Team

43. © 2015 Cybereason Inc. All rights reserved.
Agent Modules
With courtesy of Hacking Team

44. © 2015 Cybereason Inc. All rights reserved.
Building An Agent
With courtesy of Hacking Team

45. © 2015 Cybereason Inc. All rights reserved.
Building An Agent
With courtesy of Hacking Team

46. © 2015 Cybereason Inc. All rights reserved.
Anonymization
With courtesy of Hacking Team

47. © 2015 Cybereason Inc. All rights reserved.
System Information
With courtesy of Hacking Team

48. © 2015 Cybereason Inc. All rights reserved.
Scalable Architecture
With courtesy of Hacking Team

49. © 2015 Cybereason Inc. All rights reserved.
Campaign Flow
RCS User Decides to
Create New
Campaign
RCS User creates RCS
Agent for Campaign
RCS User Opens Support
Ticket with Hacking Team
To GenerateCampaign
Payload
RCS User Decides Infection
Vector
Web/Network Injection Vector
Write Agent to UEFI
Firmware
Physical Vector
Target Device
DeviceType
Persistence Vector
Desktop
Deploy APK on Device
Mobile Device
Write Agent Installer
to U3 Device
U3 USB
Bootable USB/CD/
DVD
Offline Install
Hosted Exploit?
No
Deploy To Customer
VPS
No
HackingTeam Deploys
to own VPS
Yes
Targeting Method
QR Code
Use Network Injector?
HTML
Yes
Network
Injection Type
Binary
Spearfishing E-mail

50. © 2015 Cybereason Inc. All rights reserved.
VPS to own VPS
Targeting Method
QR Code Accessed by
Target
QR Code
Link Presented as
SMS to Target
SMS
Exploit Page
Delivered to Target
Modified [Melted]
Binary Delivered to
Target
Link Presented to
Target through E-mail
Spearfishing E-mail
Scout Agent Installed
on Target
Scout Communicates
with C2 Server via
Anonymizer
Machine Analysis
Uninstall
Virtualization/Blacklisted Program
Indications Present
Upgrade to Soldier
Unsafe Environment
(Analysis Tools, A/V, etc)
Upgrade to Elite
Safe to Install

51. © 2015 Cybereason Inc. All rights reserved.
Let’s talk about the Network Injector

52. © 2015 Cybereason Inc. All rights reserved.

53. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

54. © 2015 Cybereason Inc. All rights reserved.
Meet RCS
Every infection target (customer) has an ID.

55. © 2015 Cybereason Inc. All rights reserved.
This is what a hosted infection link looks like:
http://46.38.63.194/docs/iAj3Ip/qieex.html
Meet RCS

56. © 2015 Cybereason Inc. All rights reserved.
This is where the fun starts…
Meet RCS

57. © 2015 Cybereason Inc. All rights reserved.
Meet RCS
With courtesy of Hacking Team

58. © 2015 Cybereason Inc. All rights reserved.
Adwords?
With courtesy of Hacking Team

59. © 2015 Cybereason Inc. All rights reserved.
HackingTeam delivered 2 exploits.

60. © 2015 Cybereason Inc. All rights reserved.
CVE-2015-5119 – Flash use-after-free vulnerability
in the ByteArray class in the AS3 implementation of
FlashPlayer
For code execution

61. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

62. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

63. © 2015 Cybereason Inc. All rights reserved.

64. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

65. © 2015 Cybereason Inc. All rights reserved.

66. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

67. © 2015 Cybereason Inc. All rights reserved.
Let’s look at some of the files

68. © 2015 Cybereason Inc. All rights reserved.
PHP is used for Browscap and for the rest of the
webserver related stuff (target fingerprinting)
With courtesy of Hacking Team

69. © 2015 Cybereason Inc. All rights reserved.
Python is used for all of the ‘heavy lifting’
Xp_filter.py
With courtesy of Hacking Team

70. © 2015 Cybereason Inc. All rights reserved.
Chrome_non_chrome_filter.py
With courtesy of Hacking Team

71. © 2015 Cybereason Inc. All rights reserved.
But wait… privesc_filter.py?
With courtesy of Hacking Team

72. © 2015 Cybereason Inc. All rights reserved.
Again, news buzzwords.
‘news’ is the priv_esc exploit + the RCS agent
With courtesy of Hacking Team

73. © 2015 Cybereason Inc. All rights reserved.
News file descrambled and decrypted

74. © 2015 Cybereason Inc. All rights reserved.
CVE-2015-2426 – Buffer underflow in atmfd.dll,
Windows Adobe Type Manager Library.
For privilege escalation

75. © 2015 Cybereason Inc. All rights reserved.
mynewsfeeds.info
With courtesy of Hacking Team

76. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

77. © 2015 Cybereason Inc. All rights reserved.
112 Jerusalem St., Tel Aviv

78. © 2015 Cybereason Inc. All rights reserved.

79. © 2015 Cybereason Inc. All rights reserved.

80. © 2015 Cybereason Inc. All rights reserved.
There is a logic here

81. © 2015 Cybereason Inc. All rights reserved. With courtesy of Hacking Team

82. © 2015 Cybereason Inc. All rights reserved.
Mod ReWrite RegEx Match
/docs/[a-zA-Z0-9]{6}/
Infections Left = 0
Return 404
Is Campaign Expired?
Process Invalid
No
Yes
Yes
Yes
No
UserAgent Filter Match
No
No
Log Valid
Yes
Log Invalid
Infect
Potential Victim

83. © 2015 Cybereason Inc. All rights reserved.

84. © 2015 Cybereason Inc. All rights reserved.
Android 4.x Remote Infection

85. © 2015 Cybereason Inc. All rights reserved.
Demo

86. © 2015 Cybereason Inc. All rights reserved.
Questions

87. www.cybereason.com
© 2015 Cybereason Inc. All rights reserved.
you.
Thank
Amit Serper:
amit@cybereason.com
@0xamit
Alex Frazer:
alex@cybereason.com
@awfrazer
Contact Us