4 Lasting Impacts Of The Hacking Team Leaks

Doxing attack against Italian surveillance company put some nasty tools in the hands of attackers and might be the final nail in the coffin for Adobe Flash.

Its a sprint between criminals and security researchers to see who can find vulnerabilities and attack tools hidden in the leaked Hacking Team files fastest. Adobe and Microsoft are scrambling to keep up, but these are just some of the immediate concerns.
So what will the long-term impacts be of the
doxing attack on the Italian surveillance company
?

1. The Death of Flash?
Tuesday, Adobe was forced to patch two more critical zero-day vulnerabilities discovered in the leaked Hacking Team files, CVE-2015-5122 and CVE-2015-5123. Both (like CVE-2015-5119 last week) are use-after-free vulnerabilities that allow for remote code execution. The 5122 bug was being exploited in the Angler exploit kit within a matter of hours,
according to security researcher Kafeine,
and has since
shown up in the Neutrino, RIG, and Magnitude exploit kits
.
Adobe Flash has been riddled with critical vulnerabilities in the past year, causing some to say its time for Flash to retire. However, the Flash vulnerabilities revealed in the Hacking Team breach have pushed from commentary to action.
Mozilla on Monday began preventing Flash from running by default in Firefox. Then on Tuesday,
Mozilla temporarily blocked Flash
altogether while waiting for Adobe to release
patches
for the latest vulnerabilities to come out of the leaked Hacking Team files.
US-CERT today updated
an advisory
(originally released Tuesday) about these vulnerabilities. Not only does the advisory say to prioritize security updates for the affected software, it also says to limit Flash content and that updating is not sufficient, and it is important to use exploit mitigation and other defensive techniques.
And on Sunday,
Facebooks security chief Alex Stamos tweeted
: It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day.
2.

More Sophisticated Tools In Hands Of More Attackers
The CVE-2015-5119 Flash vulnerability was used by the APT3 (a.k.a. UPS) advanced persistent threat actor in a targeted attack against the US government last week,
according to Palo Alto Networks.
It isnt just the vulnerabilities that are the problem, though; its the surveillance software Hacking Team sold to its customers -- which is,
as Adam McNeil of Malwarebytes wrote
, basically nothing more than a Remote Access Trojan, like Zeus or
AlienSpy
.
The source code for Hacking Teams flagship product, Remote Control System (RCS), was leaked in the attack, and Malwarebytes researchers took a closer look at it. RCS is feature-rich with surveillance capabilities and can collect or monitor most components on a personal computer or cell phone, wrote McNeil. The software has the ability to exploit systems, execute code, destroy files, and monitor an array of peripherals, applications, and communications.
Meanwhile, Hacking Team CEO David Vincenzetti
told reporters today
that Only a part of the source code has been stolen, softening his initial, much more dire account of the attack.
RCS works on Windows, OSX, Linux, Android, Blackberry, iOS, Symbian, and Windows Phones and comes with all the typical RAT tools, like keyloggers and screenshot grabbers. It also uses anti-analysis methods. And according to McNeil, its management software is hidden behind a chain of anonymizers.
The cloaking and persistence mechanisms are impressive. According to
Trend Micro Labs
, RCS comes equipped with a UEFI BIOS rootkit -- and even reformatting the infected machine or replacing the disk wouldnt remove the infection.
Further, according to Malwarebytes, Hacking Team claimed that the exploit portal would always contain at least three zero-days at any time.
On the black market, any of these tools would come at a very high price and require a base level of technical knowledge to operate (except, perhaps, for the
Blackshades RAT, which was ultimately undone by its own user-friendliness
). However, the Hacking Team breach has not only brought the masses this tradecraft for free, it also
provided extensive documentation
and how-to manuals to make it easier for their customers to use the tools Hacking Team sold.
3. Secret Bitcoin Transactions Not So Secret
In the RCS 9.2 upgrade, Hacking Team
added its Money Module,
which could track cryptocurrencies like Bitcoin, and according to leaked emails is able to collect various information: list of contacts and local accounts, wallet (i.e., the money) and the history of transactions.
Money Module has been available since January 2014.
4.

Greater Concern About Government Interference With Privacy Controls
Numbered among Hacking Teams customers was the FBI. Today,
it was revealed
that the Bureau had enlisted the Italian companys aid in uncovering the true identity of a user of the TOR anonymization service.
Not only has the breach shown that the government is using a tool being equated to a malicious RAT, but that governments of countries with histories of significant human rights abuses -- including Egypt, Sudan, Russia, and Ethiopia -- have been sold the very same tools.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
4 Lasting Impacts Of The Hacking Team Leaks