Hacking Team, the cybersecurity firm which saw 400GB of private data published on Sunday night in a humiliating hack, has been forced to advise customers to stop using its software while it assesses the damage caused by the leak.
A spokesman for the company recommended that clients, who are largely law enforcement and national security agencies who use Hacking Team to provide surveillance capabilities, suspend their operations while the company determines what has been exposed.
“We would expect this to be a relatively short suspension of service,” the spokesman told Reuters. He also confirmed the breach, saying: “Law enforcement will investigate the illegal taking of proprietary company property.”
The massive data dump obtained a number of awkward files for the firm, apparently showing that Hacking Team sold its hacking tools to repressive regimes such as Sudan and Bahrain – despite denials from the firm that it dealt with such nations.
But the data dump also contained the source code of a number of the company’s tools. Those tools, which take advantage of vulnerabilities to let users to hack into smartphones and desktop computers in order to spy on their targets, are now available for all to dissect, and researchers have already found some security flaws that could allow the hackers to be hacked.
Wow. #HackingTeam "backdoored" their own product to let them do arbitrary SQL, itself vulnerable to #SQLinjection pic.twitter.com/qyPKANMbLH
— Pwn All The Things (@pwnallthethings) July 6, 2015
The source code dumps have also allowed researchers to discover which vulnerabilities were being exploited by the company to enable its spying tools, and software companies are racing to fix the newly uncovered holes. Mozilla’s security team has promised it will pay out its standard bounties to the first person to file a report with them on such a vulnerability.
The company was named as one of the five “corporate enemies of the internet” in a Reporters Without Borders report three years ago, for its position as a “digital mercenary”.
