Unveiled network of surveillance based on RCS of Hacking Team

Pierluigi Paganini February 26, 2014

Citizen Lab published detailed information on the surveillance network based on RCS spyware designed by the Italian firm Hacking Team.

The nonprofit research team Citizen Lab has discovered the presence of a spyware developed by the Italian Hacking Team in 21 countries. The news doesn’t surprise security community, despite Hacking Team firm always denies any involvement in cyber espionage and surveillance campaigns conducted by authoritarist governments.

The list of countries includes Azerbaijan, Colombia, Egypt, Ethiopia, Hungary, Italy, Kazakhstan, Korea, Malaysia, Mexico, Morocco, Nigeria, Oman, Panama, Poland, Saudi Arabia, Sudan, Thailand, Turkey, UAE, and Uzbekistan. In many places, human life has no value and where regimes persecute any opponents.

Hacking Team designed a powerful surveillance malware known as Remote Code System (RCS) that is officially sold to Governments and law enforcement agencies.

Nonprofit organizations sustain that there is a sensible increase in the use of surveillance tools operated by governments, another problem that must be seriously considered is that in many cases, these tools could be used for illicit purposes by private companies that intend to spy on employees and competitors.

Hacking Team company sustains that its RCS malware is “untraceable”, it is the ideal choice for government and intelligence entities. They say that it can scale up to monitor “hundreds of thousands of targets” and is capable of being deployed to Apple, Android, Symbian, and Blackberry mobile devices.

“Hacking Team has made a number of statements that seem intended to reassure the public, as well as potential regulators, that they conduct effective due diligence and self-regulation regarding their clients, and the human rights impact of their products,” the Citizen Lab researchers report on Monday. “They also market their RCS product as untraceable. Our research suggests that both of these claims ring hollow.”

The researchers Bill Marczak, Claudio Guarnieri, Morgan Marquis-Boire, and John Scott-Railton published a very interesting post to provide evidence for the presence of RCS spyware in the above countries, Citizen Lab mapped the network of proxy servers used by the software produced by the Hacking Team. Believe me, it is an impressive effort spent by the researchers, that motivated by their passion produced so interesting results.

“Our research reveals that the RCS collection infrastructure uses a proxy-chaining technique, roughly analogous to that used by general-purpose anonymity solutions like Tor, in that multiple hops are used to anonymize the destination of information,” reads the report. “Despite this technique, we are still able to map out many of these chains and their endpoints using a specialized analysis.” Citizen Lab researchers explained.

RCS spyware was used also to target journalists, researchers at Citizen Lab revealed in fact, that the Ethiopian Government used it to spy on Ethiopian journalists in the United States and Europe. 

The activist at the Electronic Frontier Foundation (EFF) and an expert in surveillance technology, Eva Galperin commented the Ethiopian case with the following statement: