Surveillance Firm Hack Exposes 400gb Of Data

The Italian Internet surveillance firm Hacking Team was the target of a massive hack, resulting in 400GB of source code, exploits, emails and documents dumped on to the BitTorrent network for anyone to download.

Since the breach, researchers and journalists have been poring over the cache to reveal lists of clients, details of contracts, and methods of exploitation. This includes publishing details of zero-day exploits that vendors are now rushing to patch.

Initially, no one took responsibility for the breach and there are no details about how the breach occurred. However, a cyber criminal under the alias “Phineas Fisher” has taken credit via Twitter. Fisher’s claim has credibility since a hack on a similar surveillance company called Gamma Group was widely attributed to him.

“Phineas Fisher” has promised to release information of how he gained access “once they’ve had some time to fail at figuring out what happened and go out of business.”

This story underlines the case for continuous network monitoring. With companies having access to sophisticated intelligence-gathering techniques and zero-day exploits, even fully patched systems are not immune to exploitation. With companies having access to sophisticated intelligence-gathering techniques and zero-day exploits, even fully patched systems are not immune to exploitation.

Reference: ZD Net

A Trojan called Kovter is distributed by exploit kits and generates fraudulent revenue from pay-per-click schemes by simulating users clicking on ads.

A French researcher named Kafeine analyzed a new version of Kovter that attempts to apply updates after it has infected its host. For example, after being delivered by an Adobe Flash exploit and targeting an outdated version of the software, it attempts to run the Flash auto-updater in order to patch the system against further exploitation.

The motivation for this new behavior is unclear but the most popular theory is that the exploit wants “exclusivity” on target, meaning no other malware can coexist and potentially disrupt its operations.

This highlights the importance of continuous log review to detect unsanctioned software installations as well as network monitoring to detect known command and control traffic.

Reference: Malware – Don’t Need Coffee