Hacking Team malware

Video in TIB AV-Portal: Hacking Team malware

Formal Metadata

Hacking Team malware
Alternative Title
A Hacking Team rosszindulatú programjai
Title of Series
Part Number
Number of Parts
CC Attribution 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Nem kell hosszan bemutatni a mára már közismert Remote Control System (RCS) rendszert, amely az olasz Hacking Team cég állami nyomozati szervek (rendorség, titkosszolgálatok stb.) számára fejlesztett terméke. Az a 400 GB adat, amelyet a gyártócégtol elloptak és a netre kitettek, sok gondolkodnivalót ad szakmabelieknek, politikusoknak és a szélesebb közönségnek. Eloadásom három részbol áll: az elso a termék muködésének rövid bemutatása. Milyen rendszer fejlesztettek ki az exploitok célbajuttatására (Exploit Delivery Network - Android, Fake App Store) és a már megfertozött eszközök megfigyelésére (proxy chain). A második rész az Android eszközök megfertozésére használt exploitok részletes elemzése. Bemutatom a bonyolult, meglehetosen összetett, sok lépésbol álló fertozési folyamatot. Ehhez több, vadonatúj 0 day sebezhetoséget használtak fel. Ezeket ugyancsak ismertetem. Az eloadás harmadik részében a „feltunésmentes” muködést szolgáló, az ido elotti felfedezést akadályozó technikákról lesz szó (Virtual Machine és Cuckoo elkerülés, antivirus termékek monitorozása stb.).

Related Material

Group action Service (economics) Link (knot theory) Set (mathematics) Similarity (geometry) Food energy Field (computer science) Metadata Twitter Inclusion map Causality Internetworking Natural number Different (Kate Ryan album) Authorization Position operator Computing platform Physical system Gamma function Moment (mathematics) Bit Cartesian coordinate system Word Software Personal digital assistant Internet service provider Order (biology) Statement (computer science) Gravitation Smartphone Right angle
Statistics State of matter Length Variety (linguistics) Correspondence (mathematics) Patch (Unix) Set (mathematics) Water vapor Parameter (computer programming) Goodness of fit Internetworking Divergence Descriptive statistics Vulnerability (computing) Condition number Physical system Email Focus (optics) Information Surface Electronic mailing list Fitness function Sound effect Cartesian coordinate system Arithmetic mean Word
Android (robot) State of matter Multiplication sign View (database) Source code Set (mathematics) Data analysis Client (computing) Function (mathematics) Replication (computing) Web 2.0 Lattice (group) Different (Kate Ryan album) Hypermedia Single-precision floating-point format Encryption Endliche Modelltheorie Position operator Descriptive statistics Vulnerability (computing) Physical system Scripting language Email Structural load Sound effect Bit Instance (computer science) Sequence Telecommunication Order (biology) Website Right angle Quicksort Point (geometry) Game controller Implementation Server (computing) Service (economics) Link (knot theory) Computer file Streaming media Rule of inference Event horizon Number Goodness of fit Root Gastropod shell Computing platform Addition Stapeldatei Dependent and independent variables Dialect Copyright infringement Information Projective plane Expert system Line (geometry) Cartesian coordinate system Software Logic Personal digital assistant Universe (mathematics) Window
Computer program Android (robot) Group action State of matter Length Multiplication sign System administrator View (database) Source code ACID Set (mathematics) Water vapor Shape (magazine) Mereology Food energy Web 2.0 Medical imaging Semiconductor memory Endliche Modelltheorie Vulnerability (computing) Physical system Scripting language Area Bit Chain Buffer solution Order (biology) Right angle Quicksort Writing Resultant Asynchronous Transfer Mode Point (geometry) Ocean current Statistics Server (computing) Computer file Sequel Real number Rule of inference Number Revision control Goodness of fit Root Analytic continuation Computing platform Module (mathematics) Installation art Focus (optics) Information Projective plane Expert system Content (media) Cartesian coordinate system Exploit (computer security) Radius Integrated development environment Object (grammar) Routing Library (computing)
Touchscreen Proxy server
Server (computing) Service (economics) Variety (linguistics) Code Multiplication sign Water vapor Branch (computer science) Web browser Rule of inference Formal language Revision control Different (Kate Ryan album) Proxy server Area Dependent and independent variables Content (media) Instance (computer science) Line (geometry) Subject indexing Type theory Uniform resource locator Arithmetic mean Process (computing) Software Internet service provider Right angle Whiteboard
Information Link (knot theory) Multiplication sign Connectivity (graph theory) Tap (transformer) Content (media) Mereology Connected space Revision control Web 2.0 Strategy game Software framework Operating system
Slide rule Presentation of a group Confidence interval Civil engineering Multiplication sign Website Cartesian coordinate system Information security Information technology consulting Physical system
Medical imaging Process (computing) Multiplication sign Insertion loss Limit (category theory) Cartesian coordinate system Measurement Metropolitan area network Machine vision
Windows Registry Computer program Game controller Group action Modal logic Source code Virtual machine Gene cluster Online help Semantics (computer science) Dimensional analysis Software bug Goodness of fit Causality Hacker (term) Square number Computing platform Form (programming) God Moment (mathematics) Projective plane Expression Keyboard shortcut Electronic mailing list Virtualization Total S.A. Cartesian coordinate system Entire function Type theory Word Arithmetic mean Software Personal digital assistant Query language Information retrieval Order (biology) Configuration space Summierbarkeit Resultant
Presentation of a group Group action State of matter View (database) Content (media) Set (mathematics) Sound effect Total S.A. Cartesian coordinate system Leak Power (physics) Product (business) Web 2.0 Inclusion map Word Integrated development environment
the dual stimulation accessible so all the words on the agenda we without Accutane just out of the
history of the Internet acting which is much more interesting they actually wants and when you explored for drawing from the know this is what we shall do it because it very quickly and efficiently from full of I agree with the example of how this is acceptable and that is that and then we shall turn to more interesting techniques which is used by that contains a lot of work in order to stay under the radar and then when we shall natural inclusion you what is high contain was is the flagship of this that there was this suppose remote control systems that RCS in the set and which was sold to from you authorize agencies launched insurgencies moments of Inc. intelligence services and police services depending on who has authorization to use such that the devices in the given country they prepared agent every device which can be installed reverberations and the reason for that is that very many opportunities will talk about on the news was that when there was a little bit more you wouldn't know this the you always sex and practically all platforms that whatever the smartphones in the democratization many different fields which enable them to make use all these they actually started on you you find him on the back as well so there go buyers repeats as well and what is especially interesting thing was that the user agencies state-funded and therefore will they have a good position the system that as a service providers they can police devices through which they can conduct attacks that would be very difficult for the metadata and the energy is also sometimes and they were also given by the reject is that with the and the case why were they always in the foreground and the year that the gravity ammunition and war was hesitation there were generated by the dates up that was the human rights activists attacked the company and the 1st such gamma group was hacked into you to believe a very similar fashion and data is leading to move the problem and it was found that that allegedly they sold the the software to countries and that's were not democratic all all you you you you you can get up and they were not used to gain so we shall murderers and criminals investigators journalists and the 2 of them and yet people considered as innocent and democratic coming to the end of the month of of this is what the cause the downfall of regional and and here we we have a lot of research and that this was not used in the 1st statement provided by the company was provided by the competition because of the reactants to work on the and this was actually stated in the law on on their on Twitter nature was a link to was a tolerant society from which they could download all that applications which itself is quite fun and this was followed by landslides all of the articles on the
internet and which statistics in the states of the world to gigabytes the meaning of the pollutants as a lot of work and make it interesting information from people were not so having the focus on e-mail water which have parameter treatment effectiveness have before the technical solutions is
usually the vulnerability is such a thing to have this article all manufacturers of responded include speeds of the world to try and patch up with various tools and this was to show that they can perform a tax on the larger and larger and large surface they had a good set of tools and shall elaborates on the fact that this was not all due to them uh divergence from as well on July the fit between the nations of the year with the total length of the list of 490 which was available data was available in the which included the full capabilities history was withholding of those descriptions of 6 exports were identified including numerous and you'll be tourists you me and I'm very many of the things that required attention and repair using words which can be considered as this could be a good thing to use for a variety of the 2 and the total documentation of the application was made public after which will could be evaluated how they work but also on the other side of the conditions work now and decreases ammunition and not for interested in this topic was the issue of females and the entire in correspondence of the company was made available you can so see what they discussed and systems of installed is what I know just which has been seen in such
a way with that of the available source of what associated to markets looks like that that you can have a rule which you find the vulnerabilities site and so the region agreement with them I have a vulnerability and that's where you are aware of the of disease so that the receiver to monitor on different just so you know that you don't have guarantee of bad falters in batch data and the again is worth nothing that information I would actually quite attention to news article it's it's very interesting and includes who they correspond to all of these systems to guide the infrastructure itself and it is very simple there was an agent of evil and different infringement of the platform formerly with the president told where they would think control you know all of the information this this interesting bit if we can infect something that really depleted position to control things and this is things way this in gives to existing you know what they often multiple tools in that they had sort of melting projects the assessment of logic is that of you in the melt legal applications with the original and the is from Android to all about from the native Windows applications in December and iteratively where you you get said and the of the line to high-speed that applies also to correct on fly line if they don't know if it wasn't sent properly to make would be injected and it works fine with it and additional feature was added to the application that you download it from the so we have to work together to get things on the walls of the device has been an effective proxy and but approximate must be provided that they offered more of these all these services with the 2 of you sitting on and on and on and on my mizing is the replication which helped them hide the traffic and the person behind the whole thing together and you could control everything from a single dashboard panel all collects all proofs and monitor the devices
on the human of what fights highlight here which I like to read and think it's a good solution well in this industry it's it's good solution this is the exploit delivery network and the thing where the interesting bit is that of a solid for Windows and Android to attack is still using the same 1 abilities on both platforms you and what they were all in agreement that was the reason to do is that the 1 and when the mailings showed that there something to the correct something then they cited operating with another vulnerability to make these Avon really any affection question that it was also a one-shot event on so you it's not like you're when you have a link in the campaign and then they help doing something you want to guarantee you couldn't do is doing more than once the work in this case it can be delivered in a integrated MMS or in the summer and you can you go with 2 of the SP side and in some some make someone on the client side open it up so that it was limited kinds had to be open to that of an expert on war it so what does not normally contain all you're well these 2 called multiple sources and here this was a fixed sequence which also guaranteed by the lattice if the exploit rich normally you then there is it you can just do study it in any order if you do it in the right order model right otherwise we won't implementation was a simple we use HDP service those developed BH you back controlled everything in each of the 5 that they wanted to serve had a you randomly names not any file containing what things look like and when and for how long it can open another was circumstances and this guarantee that exploit was executed very controlled manner in this case for instance this is the crafted you're well on that is the client somehow opens up then the only that is in the file is used to check on the you whether the universe is the it can be served use regions of appropriate and if yes then of the region and the fight to with resources exploited and it also serves refreshes the exploit files uh and that makes to the other fires accessible in the next 5 minutes and not and the on was the person is looking at the files and sees this fire as this in the file containing the description so this is a a rumble of Python scripts you you need to do in States 40 severe on and then into the outputs this is just this is how they controlled the and that the exploit can only be run in the in the time and manner of you see the number of kids that and and how many times the data sets can be accessed at conceived the end time by which you must exercise if you want to sell them something like that it could be argued that the appropriate person opens the or could it could be it they could do prohibited to make data analysis the user agent is the associated 5 34 this was the web is that the effect on Android and it also shows how the value at the receive responses so we have more than would be agent look like you'll also be a point in order to execute all of this is the same screenshots to collect data that you that you honestly on the hood and we can't do that with view to you normally employed to use a rise the addition arise due to exploit we already get root of root user rights we could even install and get in the habit so what we have ruled out of the here and then use them only of the didn't to use to assure you said they developed their own customer service on a helper application that had very nice features that I show you and this is what they should have this additional load rights of the obligations was installed in a didn't but he did not only on on on the dev rights but it's Ganymede itself permissions and releases it was to and then if you want to have any additional permissions and you can assign it yourself as as the services of the events as media service which meant that regardless of will what obligation and how it was used to help communication was done some must come into the there was some kind of model some must come out of the device you know what obligations to develop doesn't matter so I listened to the news that I cases of between it the media server who myself into it and but there again controlled voice or sound in and output regardless of what they are using for encryption and whatever because of value you from the outside all and all those all the stream of the application databases to the forest and so they could extract all the data that I wanted to this is the obligation itself is not money you used to be called RELcat expect the same thing to and how they they stated in slash 2 moves systems such men and when you call with the appropriate which then they you can access the appropriate the users of you wanted for instance of the history of user just started the root shell awaken interactively and uh on like uh do what you
wanted to with the already ordered to register of application as an admin and so on and and off and you can also search for any content regardless of Europe privileges and that all also you see them you could link being true you can mount such systems that you have the right was the mound and you can modify this and you want to to about the web view that they used to do and then to use all the agents Android platform is a pretty well posed exploit it to use is the common it combines 3 vulnerabilities to be able to do execute think that exploit and installation the consists of 2 steps and we need to be able to run called this is something you wouldn't review for and also the water that they needed to locally route the emissions and this year they didn't use any 0 they exploit in US they simply use the already available colds copy together from the source code there only 1 of actually the the associated because Android and she here in the in community and with no more all of this other to frequent so you can achieve good results even with older exports you these up 3 chains of vulnerabilities of the combined and you know which 1 is information related can to their with which can you get undressed for you you can do the news and you can to make use of it and also to write sequel focus on before overall before this point onwards they know what they want right you can be because the thing you want to see how they did not want to tackle the the vulnerability itself all this statistic is from the set September's this all that old and the even the soul that if identified a set of all the the devices currently used are still vulnerable to this part of our ability and you can see here that means that have on the side of the the the version number is of and all Edward version number this still are honorable and so the items in the recent idea the vulnerability by summing the use of the things that but that's not really good move than on projections with you see how this would work so there is devices to remote to local and local to the root work you can run hold on to get permission to use the that's substance but it's not something we have this sort of 40 % of Android devices so if you want a big big by then you should have the right to tax of movements what they did and what is the tag itself like all the water that knowledge and the emergence of the 1st of which is we immediately checks whether the 1st on the ability of the of this information leakage working on a lot if not it immediately stops and doesn't continue the objective here is this applies to each serviceable you tackle it only that proceeds if they assure that it makes sense so they don't have anything in the in thing they were only central and do anything they the current stage warrants the continuation of the real estate good protection of the expert at the end and so in the 1st step in the middle the and then create a 4 megabyte area of the all of this is the acidity the shape of this new script so they can move around in this model and the use the of use crafted XML files of the download from that you AUC this is that have been leaked to all these are used to move from 1 created some of environments that will then we used to call creating buffer overall here they download the module but model which is sort of a very low order this is a shared library which will then download for the parts of the exploits of them but they don't teach you know of course for images delegates 1st many states this module is loaded into memory at the time program to use and protect is used to be able to make it run of them being compiled put together and called that candidate drink and then the region memory area and even the thing which is expected of the is director of the mood of the an appropriate value there is is sort of a return to the server and everything is OK so is the end of the rules for the current and the correct a radius key otherwise it would say garbage also this also protects the content and then there all is the exploited solar is downloaded by this is done by the what is available already on here we have the court rounded out these 2 back the traversal procurement-related mode useful given the corrupted and the exploits of contains the steering group exploits that tried to get to the root permissions if this succeeds that it immediately with CDF into the room which of these varying all that in mind for the situation where you can do acts as a root immediately and installers stars and business so this is this scouts and agents and this is how the company operated everywhere if the source of the entities and created multiple agencies and on the sea thought into a little bit looked around to see what we have here is anything that can recognize if there was nothing that the
the the next little little so the about starting cautiously step by step number leading energy beyond what was necessary and I think this crafted URL centered it in the length and the user will like
it and click on it I won't because it's probably boring or let's to see
something more sophisticated 1st every tried to
share splits the screen limited the the the guy showed our gesticulate
no OK you can see is that the something here because this is my server on when I have it can crafted language and I'm listening and the board according hundreds of men and I get the appropriate things that I started exploiting this what we need to for this to work well with we be able to access the different layers of the of the where the devices operating on the ice we other service providers so it was a simple to dissolve about if we think a bit further and only the most of the time in which was that in the water so well where we can use this 1 of the places on on arrival of books for instance we connect we ourselves can then and the things like this you will be in so I used to be and to log on I also over and the old graphic now Travis is my server here I have a mean of proxy to the mighty proxy uh idea proxy is very useful and I am listening without going in front of the interstellar matter and I haven't injected them by the secret and analyze created with you and what it does is it checks yeah you GET requests passing through the network of all children in them and where everything is OK if the browser requests it into a content that is of the type of text processing HTML version of the the code of the right to the variety of location and the agent is on the world and I select from my own available to our internal to this regressors so I or modify the traffic in line and you and those of branch what I just this without injecting but I don't run this so I'm expecting I'm waiting for the traffic here and listen to traffic I open and the old browser and and and index of the issue and you can see that this is the whole crew of rules that are out there and it has set of a European areas so it's like different from the built in which said that the the 2 43 has this means that it's not vulnerable and I leave it alone in the world but run something will happen that will allow me to to actually do the exact just to to see what is happening in the background of this session has think about with that I'm I open
here and here an or I'll do is just to you know I don't know whether you've seen connectivity has a small out very cute out with lots of things on it and I like it so that it's actually framework on his strategy and you can see some more about it and if you think we are more interested about it any of them we can link this link to get some more information on the out of background and I think that what you can see that all it's more to do with is taps stuff that is all being loaded here that we know of that uses a version of the Web you component which is part of the operating system which is vulnerable and then and then I saw from the age this is my like my my my time to to attack I placed the content and sentences of the exploit itself into indeed it in the draft come on are kind of analogous to what it seems like there's a couple of days
you that the and all of this is where we know that should see that this actively is fortunately I missed the the the the the of the relevant as civilization a consulting time during the of because of the lack of confidence that this was perhaps the most secure passive presentation is in a minute this is this it was always and the this is a book is used to work now out so I will do
it again because I actually the idea that doesn't matter if skip a couple of slides make note of so we can't expect that the system in the mind and the following so among others a given his application is really very good and true the web site is equally good again uh and then
excellent that uses light-sensitive missing in the the enter the intersection actually actually worked reasonably well known and accepted many this of which you can see here that the because the savages have exploited assignment with the image that's what we usually play the cool actually if you have a loss that of coolant so what it's actually they couldn't downloadable explodes and and this sort of around the world with hostile to the well-being of all the negative and this is something that you seem to think that may be the when you that actually limit also would you like any of them and then I lose my visions River redirects which usually happens that the man I actually was successful with against his best itself is 1 measure the 100 while the then you wait for a long time as well also with this and this is the process is fortunate original application the that the title of the work of side and the perhaps is have been made so faster you and that in what I know I
was successful with the log of the sum of the 2 and then in Masson soldiers who was to become inconspicuous tremendously just making it up from only all of that this very serious application of the ideas you want this which increases in 100 studio this is actually my application that exploits the control of the government and installs the this was successful through the network and I don't know what it's going to stop you know that we have this move
along quickly all of the along how did they remain under the maiden name of the community in case of interest that there is a very pertinent to the quality of the used to live in the encrypted recorded and everything in order to ensure that that that cause become fragmented anomalies in the data so that you have access to a single parts and of it and it will be very expensive and difficult to get access to everything even the source contends that can be done with the square of expression was done and actually come back at the hacker that and then we have nothing to do other things that used to be improved the you words many things to envisage both lot there were some people actually were actually tried to administer them they were somewhat successful for the entire infrastructure expression all that forms was unsuccessful in investigating completely made with with you have an interesting good idea that they only center as much of the growth semantics necessary with the given means that that's all and they also blacklisted application with the help of that community rerunning visual was dangerous than they retreat since they do not wish to affects everything at all costs to you that you want to virtualization in the middle of the word in my queries were used in order to find out what what was the only 1 on whether they have given the words running on that platform and and distributed free to move the the program proved to people they have trick efficient and the top there was 44 registry that to try assess the and the top 1 of the the all of Leave always starts at which the forward and it works in the cuckoo from the 2 of them and that is this that and the trapped in that and and the moment and the company could actually check to see if there was a problem here and this is the collection of retrieves the the land of the result there was a lot of works and the cooling of the application was actually wants to in the beginning because it is also the courts and I were made from the like the day of they appeared in the and the what and this what you could megabytes is assumed to have fun with these goods but also because journals as was also used the problem and what was going on and that's the kind of thing and you know that on the news that the media and assume that develops is now and treatment about because it's available to you in this dimension of the monument to the actually monitored certain Android platform whether that would really so as well and they used these tricks usually 100 from God and in order to be able to cooperate well over a hundred antibiotics programs and they think of the reason for cluster the and then if you at the end where for the handling cases of virtual machine clusters which has involved the same type of thing about the hands of I puppets and they monitor what's happened to you before there were any actions taken by the way you thought that that was actually considered by vendors to be hospitalized this was a Ecuadorians essentially and this is how they guarantee guarantees that what they did how that was inconspicuous so as you can see that you perform their self-interest medical project dedicated to that the case of in order to engage in these virtual machines on that and they have room to play about reduce configurations say what's if you download the total e-mail list price starts monitoring the keyboard will dissolve so that
you know what you know and we have reached the inclusion of presentation of the things that matter and the movement of the of the layers of beliefs and I believe the from the leaks the last words of oxygen that that was trying to think that if you get what 1 which show the effects were not really capable of unlabeled examples of and products of the whole thing was very well planned effect morning not decoder which is going to happen in which means that all of us who like to highlight that web view of the think people in more thinking which is the problem of finding the present and environment and devices and as you saw was that does it does not require clicking on unintelligible if I did it I don't know if you want to know which 1 you want hazardous and which 1 is long because I consider going to let you know than we got to the actors and was stupid and the dominant sets in this chart on because this application and every other state in the colonies and so we it can use its powers to on HTTP as political and actually observed this at all so it's actually a good solution for it to be protected and that's what will explore this was not analyzes and all that it actually injectors instantly from the outside decides that you just have to wait and inject the adequate content is and this is where some links and thank you very much for your attention to the questions and you had to apologize for being such a rapid action in the era of total satisfied no and was that no questions


  497 ms - page object


AV-Portal 3.20.2 (36f6df173ce4850b467c9cb7af359cf1cdaed247)