Big Brother Gulen?
A recent article written by Kim Zetter and published on June 4, 2013, in the business tech magazine Wired, details how a critic of Gulen, an American woman who publishes a blog website chronicling the Gulen cult’s infiltration into the United States, was a victim of an attempted phishing attempt by a highly sophisticated spy tool.
According to Wired, the fictitious website and sender was linked to a website in Turkey, and is a tool that was developed and sold to government agencies by the company Hacking Team and is used for the purpose of cyber-spying. Apparently, forensic investigators were able to trace the malicious file to the Remote Control System (RCS) spyware made by the Italian company Hacking, and used by some of the worlds’ intelligence agencies.
The woman whose website was the target of the attempted attack, has been and continues to be an outspoken critic of the Gulen movement, and in particular, its extensive involvement in the Gulen-inspired -- Turkish managed -- and American tax funded -- charter schools. (Note to readers, it was not this website that was phished, much to the chagrin of the Gulenists).
It is a forgone conclusion that the Gulenists have infiltrated the Turkish police force and other government agencies and are actively spying on Turkish citizens who are opponents of the movement, so it would not be a stretch to imagine that they are also employing similar tactics here in the United States. However, if in fact it can be proven that the Turkish authorities are engaged in cyber-spying on American citizens it would an international violation that could not only jeopardize Turkey’s standing with its allies, but likewise tarnish their ability to continue their ongoing quest to join the European Union.
The Gulenists have pretty much taken over any legitimate media outlet in Turkey in order to further their invasive propaganda agenda, so it must be like a festering boil to them that they cannot control the media or freedom of speech in the United States like they can in Turkey. They cannot sue, intimidate, harass, or jail Americans --- methods that they employ against the Gulen critics in Turkey, but are useless in a country (the US) that values the rights of individuals and freedom of speech.
Keep phishing boys –because sooner or later someone will take the bait and the fisherman holding the pole will be caught gripping a whopper on the end of the line – the United States government.
Below is the article by Zetter and another one published in The International Times by David Gilbert on June 5, 2013:
http://www.wired.com/threatlevel/2013/06/spy-tool-sold-to-governments/
The email appeared to come from a trusted colleague at a renowned academic institution and referenced a subject that was a hot-button issue for the recipient, including a link to a website where she could obtain more information about it.
But when the recipient looked closely at the sender’s email address, a tell-tale misspelling gave the phishing attempt away — the email purported to come from a professor at Harvard University, but instead of harvard.edu, the email address read “hardward.edu”.
Not exactly a professional con-job from nation-state hackers, but that’s exactly who may have sent the email to an American woman, who believes she was targeted by forces in Turkey connected to or sympathetic to the powerful Gülen Movement, which has infiltrated parts of the Turkish government.
The email contained a link to a web site in Turkey, where a malicious downloader file was waiting to install on her computer — a downloader that has been connected in the past to a spy tool purportedly sold exclusively to law enforcement and intelligence agencies around the world.
The woman, who asked to remain anonymous because she’s concerned about retaliation, sensed the email was a fraud and did not follow the link. Instead, the email was passed to researchers at digital forensics firm Arsenal Consulting, who set up a honeypot to visit the Turkish web site and obtained the downloader.
Though investigators didn’t obtain the file that the downloader was supposed to install, analysis of it showed that it was the same downloader that has been used in the past to install Remote Control System (RCS), a spy tool made by the Italian company Hacking Team and sold to governments. A digital certificate used to sign the downloader has also been used in the past with Hacking Team’s tool.
“It was the first hint that this was connected to Hacking Team and RCS,” Mark. G. Spencer, president of Arsenal, told Wired.
Hacking Team asserts that it sells the RCS tool only to law enforcement and government security agencies for lawful intercept purposes, but it has reportedly been used against activists and political dissidents in Morocco and the United Arab Emirates and possibly elsewhere, an issue for which Hacking Team has been severely criticized.
The company touts in marketing literature that the tool evades encryption and bypasses antivirus and other security protections to operate completely invisibly on a target’s machine.
The RCS tool, also known as DaVinci, records text and audio conversations from Skype, Yahoo Messenger, Google Talk and MSN Messenger, among other communication applications. It also steals Web browsing history and can turn on a computer’s microphone and webcam to record conversations in a room and take photos. The tool relies on an extensive infrastructure to operate and therefore is not easily copied and passed to non-government actors outside that infrastructure to use for their own personal spy purposes, according to a Hacking Team spokesman.
Spencer says there’s no definitive proof pointing to who is behind the attempted hack of the American woman, but notes there is circumstantial evidence that warrants further attention.
“We have an email, a purported sender, and a target all critical of the Gülen movement. We have professional malware launched from a server in Turkey. You can take it from there,” Spencer said.
Turkey is a member of the North Atlantic Treaty Organization alliance. If authorities there were behind the hack attack, it would mean that a NATO ally had attempted to spy on a U.S. citizen on U.S. soil, presumably without the knowledge or approval of U.S. authorities, and for reasons that don’t appear to be related to a criminal or counter-terrorism investigation.
Mustafa Kemal Sungur, a spokesman for the Turkish Embassy in Washington, DC, said he had no comment on the allegations.
Hacking Team spokesman Eric Rabe would not say if Turkey is a customer of its software, only that Hacking Team sells to “several dozen countries.”
Speaking generally, he said the company will investigate cases where it believes clients may have used its software in an illegal manner or in a manner that violates the terms of service, and that if a customer is found to be using its software in an illegitimate manner, Hacking Team has ways to render the software useless by halting updates to it.
“If we don’t update the software pretty regularly, antivirus programs will detect the software and it will be useless to the agencies,” he said, referring to tweaks and obfuscations the company adds to the program to thwart detection.
The woman believes she was targeted because she’s an outspoken critic of Turkish charter schools in the U.S. that are run by supporters of the Gülen Movement, a secretive organization led by charismatic Turkish imam and scholar Fethullah Gülen, who resides in exile in Pennsylvania. She believes the email was sent to an anonymous email address she uses in an attempt to identify her and gain access to her private data and communications in order to try to discredit her.
The Gülen Movement has millions of supporters around the world and is behind a network of schools operated in more than 100 countries, including a string of charter schools in the U.S. But critics say that members of the movement have heavily infiltrated the Turkish judicial system and the police intelligence services with the aim of increasing Islamic influences in Turkey and pushing the country in a more conservative direction. Members of the movement are accused of using government and media connections to retaliate against and discredit opponents, including using trumped-up charges to get them jailed.
“We are troubled by the secretive nature of the Gülen movement, all the smoke and mirrors,” an anonymous U.S. official told the New York Times last year. “It is clear they want influence and power. We are concerned there is a hidden agenda to challenge secular Turkey and guide the country in a more Islamic direction.”
The woman who received the phishing attempt says she’s been warned against traveling to Turkey due to her outspoken criticism of the movement’s charter schools.
“I’ve been told by a U.S. official that I should never travel to Turkey, that it would be dangerous for me,” she told Wired.
The body of the email she received read, “Hi, There is a new site about Gülen movement. It is http://www.hizmetesorulanlar.org/homepage.html. Also you should read an essay which I sent. (passwprd:12345).”
The email was signed by a Harvard professor who has written and spoken publicly about the Gülen movement in the past, but the URL in the email actually went to a different web site than the one cited — a poorly designed GeoCities-type page in Turkey with the URL www.mypagex.com/fileshare/questions/main.html.
When Spencer’s team visited the latter web site with a test machine, a malicious Flash component called Anim.swf that appeared to be part of a multi-stage attack got installed on their machine.
“It’s really nice and impressive code,” Spencer told Wired.
This component gathered intelligence about the infected machine’s operating system and browser and was programmed to then download a second-stage Flash attack. Spencer’s team didn’t get a look at the second part, however, because the file was removed from the site before they could grab it. They were, however, able to grab half-a-dozen other components that were stored in folders on the site before being removed. These included the downloader file, an executable program that was designed to grab screenshots from targeted systems and send them to a command-and-control server in Turkey. It was also designed to download another tool, which Spencer believes may have been the main RCS spykit, though he can’t say for certain since the attack wasn’t completed.
The downloader file was digitally signed with a certificate issued to an individual named Kamel Abed. GlobalSign, the certificate authority that issued the certificate, told Wired that the company issued the certificate last November after receiving a legitimate application. The certificate was revoked February 12 after GlobalSign learned of its misuse, following a report by Kaspersky Lab that tied the certificate to Hacking Team’s spy tool.
“The certificate was revoked as soon as our community contacts made us aware of the usage of the key for reasons we do not permit,” GlobalSign CEO Steve Waite said in an email. “We conduct revocation investigations 24/7, and in this case the revocation happened quickly.”
He would not say whether Abed himself had misused the certificate or if someone had stolen it from him to sign the malicious downloader, but he said that GlobalSign revoked the certificate after trying to contact the subscriber to discuss it with him and was unable to reach him.
Asked if Hacking Team had ever been issued a certificate in the name of Kamel Abed or used such a certificate to sign its spy tools, spokesman Rabe said only, “Kamel Abed is a common Arab name, and I‘m not going to comment further than that.”
Arsenal contacted Nicolas Brulez, principal security researcher at Kaspersky Lab, to examine the downloader file and certificate. Kaspersky has written extensively about Hacking Team’s tools in the past, and Brulez found that the downloader code and Kamel Abed certificate were identical to another downloader known to have been
used with the RCS spykit in the past. He also found test code in the downloader file that matched exactly test code found in a component of the RCS spykit, and the two files used the same encryption algorithm to communicate with the command-and-control server. There were other similarities and exact matches as well, all of which led Brulez to conclude, “The guy who made the downloader that Arsenal found also made the RCS.”
Brulez believes the downloader is used by the attackers to first gather intelligence about a victim before determining if they want to send the entire RCS package to the machine. He also believes the RCS tool would have been installed on the U.S. victim’s machine through a zero-day Flash exploit that was used against other RCS victims around the same time she was targeted, before Adobe patched it.
Kaspersky has detected at least 50 incidents of RCS infections on computers in Italy, Mexico, Kazakhstan, Saudi Arabia, Turkey, Argentina, Algeria, Mali, Iran, India and Ethiopia.
Hacking Team came under fire last year after a number of security researchers linked the company’s spy kit to hacks that targeted political activists in Morocco and the United Arab Emirates for purposes of spying on and silencing dissenters.
In Morocco, an activist group known as Mamfakinch was reportedly a target of government spying in that country through use of Hacking Team’s software. And Ahmed Mansoor, an activist from the United Arab Emirate who was jailed for seven months in 2011 with four other activists on charges that they insulted the country’s vice president and threatened state security, was also reportedly targeted with the software.
Rabe called the claims “largely circumstantial,” but wouldn’t elaborate.
The company did investigate the claims, he said, but he wouldn’t disclose the outcome of the investigation.
“There are circumstances where we have refused to work with clients based on our examination of what they were doing or what we thought they were doing,” he said, but he would not say if Morocco and the UAE had been dropped as clients as a result of the allegations.
He said the company is careful about who it sells its software to, and won’t sell it to every country.
“We do our best to know who the agencies are and who the governments are who we’re selling to. There are certain governments we do not sell our software to,” he said, though he wouldn’t identify any countries that had been rejected.
Situations in which someone might abuse the software to spy on innocent people is something that “concerns” the company, he said, though he admits there is little Hacking Team can do to prevent it.
“We know how powerful is the tool that we’ve developed, so we’re doing our best to make sure it doesn’t get abused,” he said.”[B]ut there is a limit to how we can control what someone does with the software.”
Kim Zetter is a senior reporter at Wired covering cybercrime, privacy, security and civil liberties.
http://www.ibtimes.co.uk/articles/474945/20130605/turkey-gulen-movement-implicated-cyber-attack-citizen.htm
The US woman believes she was the target of this cyber-attack because of her outspoken criticism of the Gülen movement, which has infiltrated parts of the Turkish government. The woman, who doesn't want to be identified over fears of retaliation and who spoke anonymously to Wired, received a highly-tailored spear-phishing email purporting to be from a Harvard professor who has previously written about the Gülen movement.
The email contained a link to a website in Turkey which hosted malicious software which would be downloaded to your PC if you simply clicked on the link. The woman sensed a problem with the email and on closer inspection of the email address saw it was sent from an @hawhard.edu address rather than the expected @harvard.edu.
The email was passed to researchers at Arsenal Consulting who analysed the website and found it contained malicious software which it was able to link to governmental spyware sold by the controversial US-based Hacking Team.
While the researchers were unable to get hold of the file which the site was intending to install, as it was removed quickly by those behind the attack, it was able to analyse the downloader and this showed it was the same downloader which has been used in the past to download Hacking Team's Remote Control System (RCS) - also known as DaVinci.
Gülen movement
The Gülen movement is a transnational religious and social movement led by Turkish Islamic scholar Fethullah Gülen. The movement's main focus seems to be education and estimates suggest it has 1,000 schools established around the globe, a number of which are said to be in the US. Gülen himself is currently living in self-imposed exile in Pennsylvania.
The woman targeted by this attack said it was her outspoken criticism of these charter schools in the US which led to her being targeted. The email was sent to an anonymous email address the woman uses in an attempt to identify her, gain access to her private data and communications and ultimately attempt to discredit her.
While there is no concrete evidence of who is behind the attack, there is significant circumstantial evidence which gives an indication of who is behind the attack. Mark Spencer from Arsenal Consulting said: "We have an email, a purported sender, and a target all critical of the Gülen movement. We have professional malware launched from a server in Turkey. You can take it from there."
Spying
Hacking Team is one of a growing number of companies who sell hugely powerful cyber-weapons which can monitor the phone calls, emails and online activity of those they are deployed against. While Hacking Team has told IBTimes UK in the past that it won't sell to companies or countries on NATO, US or EU blacklists, this latest revelation suggests that Turkey, which is a member of NATO, could be using these tools to spy on American citizens.
Hacking Team spokesman Eric Rabe would not confirm or deny whether Turkey was one of its customers.
RCS is just one of a number of powerful tools available to governments, intelligence agencies and police forces around the world. One of the best known is FinFisher which is sold by UK-based Gamma International which was labeled as one of five "Corporate Enemies of the Internet" and "digital era mercenaries" by Reporters Without Borders in March of this year, for selling products that have been or are being used by governments to violate human rights and freedom of information.
Reticent
Like all such companies Gamma International and Hacking Team are reticent to speak too much about what it is their cyber-weapons can do, who uses them or how much they get paid.
Critics of the use of these tools have claimed they have led to the torture and in some cases the deaths of those being monitored. Hacking Team in particular has come in for a lot of criticism as its software has been linked to oppressive regimes in Morocco and the United Arab Emirates who use it to illegally monitor activists.
The escalation of cyber-espionage in recent months has become front page news, with the US government taking big steps to address what it believes is a major threat from outside forces, primarily China, who the White House has accused of breaching the security of critical infrastructure in the US.
An attack on an American citizen by a NATO member would mark a new milestone in cyber warfare, as it is an attack on a US citizen on US soil, without the knowledge of the government and without a link to criminal behaviour or terrorism.
According to Wired, the fictitious website and sender was linked to a website in Turkey, and is a tool that was developed and sold to government agencies by the company Hacking Team and is used for the purpose of cyber-spying. Apparently, forensic investigators were able to trace the malicious file to the Remote Control System (RCS) spyware made by the Italian company Hacking, and used by some of the worlds’ intelligence agencies.
The woman whose website was the target of the attempted attack, has been and continues to be an outspoken critic of the Gulen movement, and in particular, its extensive involvement in the Gulen-inspired -- Turkish managed -- and American tax funded -- charter schools. (Note to readers, it was not this website that was phished, much to the chagrin of the Gulenists).
It is a forgone conclusion that the Gulenists have infiltrated the Turkish police force and other government agencies and are actively spying on Turkish citizens who are opponents of the movement, so it would not be a stretch to imagine that they are also employing similar tactics here in the United States. However, if in fact it can be proven that the Turkish authorities are engaged in cyber-spying on American citizens it would an international violation that could not only jeopardize Turkey’s standing with its allies, but likewise tarnish their ability to continue their ongoing quest to join the European Union.
The Gulenists have pretty much taken over any legitimate media outlet in Turkey in order to further their invasive propaganda agenda, so it must be like a festering boil to them that they cannot control the media or freedom of speech in the United States like they can in Turkey. They cannot sue, intimidate, harass, or jail Americans --- methods that they employ against the Gulen critics in Turkey, but are useless in a country (the US) that values the rights of individuals and freedom of speech.
Keep phishing boys –because sooner or later someone will take the bait and the fisherman holding the pole will be caught gripping a whopper on the end of the line – the United States government.
Below is the article by Zetter and another one published in The International Times by David Gilbert on June 5, 2013:
http://www.wired.com/threatlevel/2013/06/spy-tool-sold-to-governments/
The email appeared to come from a trusted colleague at a renowned academic institution and referenced a subject that was a hot-button issue for the recipient, including a link to a website where she could obtain more information about it.
But when the recipient looked closely at the sender’s email address, a tell-tale misspelling gave the phishing attempt away — the email purported to come from a professor at Harvard University, but instead of harvard.edu, the email address read “hardward.edu”.
Not exactly a professional con-job from nation-state hackers, but that’s exactly who may have sent the email to an American woman, who believes she was targeted by forces in Turkey connected to or sympathetic to the powerful Gülen Movement, which has infiltrated parts of the Turkish government.
The email contained a link to a web site in Turkey, where a malicious downloader file was waiting to install on her computer — a downloader that has been connected in the past to a spy tool purportedly sold exclusively to law enforcement and intelligence agencies around the world.
The woman, who asked to remain anonymous because she’s concerned about retaliation, sensed the email was a fraud and did not follow the link. Instead, the email was passed to researchers at digital forensics firm Arsenal Consulting, who set up a honeypot to visit the Turkish web site and obtained the downloader.
Though investigators didn’t obtain the file that the downloader was supposed to install, analysis of it showed that it was the same downloader that has been used in the past to install Remote Control System (RCS), a spy tool made by the Italian company Hacking Team and sold to governments. A digital certificate used to sign the downloader has also been used in the past with Hacking Team’s tool.
“It was the first hint that this was connected to Hacking Team and RCS,” Mark. G. Spencer, president of Arsenal, told Wired.
Hacking Team asserts that it sells the RCS tool only to law enforcement and government security agencies for lawful intercept purposes, but it has reportedly been used against activists and political dissidents in Morocco and the United Arab Emirates and possibly elsewhere, an issue for which Hacking Team has been severely criticized.
The company touts in marketing literature that the tool evades encryption and bypasses antivirus and other security protections to operate completely invisibly on a target’s machine.
The RCS tool, also known as DaVinci, records text and audio conversations from Skype, Yahoo Messenger, Google Talk and MSN Messenger, among other communication applications. It also steals Web browsing history and can turn on a computer’s microphone and webcam to record conversations in a room and take photos. The tool relies on an extensive infrastructure to operate and therefore is not easily copied and passed to non-government actors outside that infrastructure to use for their own personal spy purposes, according to a Hacking Team spokesman.
Spencer says there’s no definitive proof pointing to who is behind the attempted hack of the American woman, but notes there is circumstantial evidence that warrants further attention.
“We have an email, a purported sender, and a target all critical of the Gülen movement. We have professional malware launched from a server in Turkey. You can take it from there,” Spencer said.
Turkey is a member of the North Atlantic Treaty Organization alliance. If authorities there were behind the hack attack, it would mean that a NATO ally had attempted to spy on a U.S. citizen on U.S. soil, presumably without the knowledge or approval of U.S. authorities, and for reasons that don’t appear to be related to a criminal or counter-terrorism investigation.
Mustafa Kemal Sungur, a spokesman for the Turkish Embassy in Washington, DC, said he had no comment on the allegations.
Hacking Team spokesman Eric Rabe would not say if Turkey is a customer of its software, only that Hacking Team sells to “several dozen countries.”
Speaking generally, he said the company will investigate cases where it believes clients may have used its software in an illegal manner or in a manner that violates the terms of service, and that if a customer is found to be using its software in an illegitimate manner, Hacking Team has ways to render the software useless by halting updates to it.
“If we don’t update the software pretty regularly, antivirus programs will detect the software and it will be useless to the agencies,” he said, referring to tweaks and obfuscations the company adds to the program to thwart detection.
The woman believes she was targeted because she’s an outspoken critic of Turkish charter schools in the U.S. that are run by supporters of the Gülen Movement, a secretive organization led by charismatic Turkish imam and scholar Fethullah Gülen, who resides in exile in Pennsylvania. She believes the email was sent to an anonymous email address she uses in an attempt to identify her and gain access to her private data and communications in order to try to discredit her.
The Gülen Movement has millions of supporters around the world and is behind a network of schools operated in more than 100 countries, including a string of charter schools in the U.S. But critics say that members of the movement have heavily infiltrated the Turkish judicial system and the police intelligence services with the aim of increasing Islamic influences in Turkey and pushing the country in a more conservative direction. Members of the movement are accused of using government and media connections to retaliate against and discredit opponents, including using trumped-up charges to get them jailed.
“We are troubled by the secretive nature of the Gülen movement, all the smoke and mirrors,” an anonymous U.S. official told the New York Times last year. “It is clear they want influence and power. We are concerned there is a hidden agenda to challenge secular Turkey and guide the country in a more Islamic direction.”
The woman who received the phishing attempt says she’s been warned against traveling to Turkey due to her outspoken criticism of the movement’s charter schools.
“I’ve been told by a U.S. official that I should never travel to Turkey, that it would be dangerous for me,” she told Wired.
The body of the email she received read, “Hi, There is a new site about Gülen movement. It is http://www.hizmetesorulanlar.org/homepage.html. Also you should read an essay which I sent. (passwprd:12345).”
The email was signed by a Harvard professor who has written and spoken publicly about the Gülen movement in the past, but the URL in the email actually went to a different web site than the one cited — a poorly designed GeoCities-type page in Turkey with the URL www.mypagex.com/fileshare/questions/main.html.
When Spencer’s team visited the latter web site with a test machine, a malicious Flash component called Anim.swf that appeared to be part of a multi-stage attack got installed on their machine.
“It’s really nice and impressive code,” Spencer told Wired.
This component gathered intelligence about the infected machine’s operating system and browser and was programmed to then download a second-stage Flash attack. Spencer’s team didn’t get a look at the second part, however, because the file was removed from the site before they could grab it. They were, however, able to grab half-a-dozen other components that were stored in folders on the site before being removed. These included the downloader file, an executable program that was designed to grab screenshots from targeted systems and send them to a command-and-control server in Turkey. It was also designed to download another tool, which Spencer believes may have been the main RCS spykit, though he can’t say for certain since the attack wasn’t completed.
The downloader file was digitally signed with a certificate issued to an individual named Kamel Abed. GlobalSign, the certificate authority that issued the certificate, told Wired that the company issued the certificate last November after receiving a legitimate application. The certificate was revoked February 12 after GlobalSign learned of its misuse, following a report by Kaspersky Lab that tied the certificate to Hacking Team’s spy tool.
“The certificate was revoked as soon as our community contacts made us aware of the usage of the key for reasons we do not permit,” GlobalSign CEO Steve Waite said in an email. “We conduct revocation investigations 24/7, and in this case the revocation happened quickly.”
He would not say whether Abed himself had misused the certificate or if someone had stolen it from him to sign the malicious downloader, but he said that GlobalSign revoked the certificate after trying to contact the subscriber to discuss it with him and was unable to reach him.
Asked if Hacking Team had ever been issued a certificate in the name of Kamel Abed or used such a certificate to sign its spy tools, spokesman Rabe said only, “Kamel Abed is a common Arab name, and I‘m not going to comment further than that.”
Arsenal contacted Nicolas Brulez, principal security researcher at Kaspersky Lab, to examine the downloader file and certificate. Kaspersky has written extensively about Hacking Team’s tools in the past, and Brulez found that the downloader code and Kamel Abed certificate were identical to another downloader known to have been
used with the RCS spykit in the past. He also found test code in the downloader file that matched exactly test code found in a component of the RCS spykit, and the two files used the same encryption algorithm to communicate with the command-and-control server. There were other similarities and exact matches as well, all of which led Brulez to conclude, “The guy who made the downloader that Arsenal found also made the RCS.”
Brulez believes the downloader is used by the attackers to first gather intelligence about a victim before determining if they want to send the entire RCS package to the machine. He also believes the RCS tool would have been installed on the U.S. victim’s machine through a zero-day Flash exploit that was used against other RCS victims around the same time she was targeted, before Adobe patched it.
Kaspersky has detected at least 50 incidents of RCS infections on computers in Italy, Mexico, Kazakhstan, Saudi Arabia, Turkey, Argentina, Algeria, Mali, Iran, India and Ethiopia.
Hacking Team came under fire last year after a number of security researchers linked the company’s spy kit to hacks that targeted political activists in Morocco and the United Arab Emirates for purposes of spying on and silencing dissenters.
In Morocco, an activist group known as Mamfakinch was reportedly a target of government spying in that country through use of Hacking Team’s software. And Ahmed Mansoor, an activist from the United Arab Emirate who was jailed for seven months in 2011 with four other activists on charges that they insulted the country’s vice president and threatened state security, was also reportedly targeted with the software.
Rabe called the claims “largely circumstantial,” but wouldn’t elaborate.
The company did investigate the claims, he said, but he wouldn’t disclose the outcome of the investigation.
“There are circumstances where we have refused to work with clients based on our examination of what they were doing or what we thought they were doing,” he said, but he would not say if Morocco and the UAE had been dropped as clients as a result of the allegations.
He said the company is careful about who it sells its software to, and won’t sell it to every country.
“We do our best to know who the agencies are and who the governments are who we’re selling to. There are certain governments we do not sell our software to,” he said, though he wouldn’t identify any countries that had been rejected.
Situations in which someone might abuse the software to spy on innocent people is something that “concerns” the company, he said, though he admits there is little Hacking Team can do to prevent it.
“We know how powerful is the tool that we’ve developed, so we’re doing our best to make sure it doesn’t get abused,” he said.”[B]ut there is a limit to how we can control what someone does with the software.”
Kim Zetter is a senior reporter at Wired covering cybercrime, privacy, security and civil liberties.
http://www.ibtimes.co.uk/articles/474945/20130605/turkey-gulen-movement-implicated-cyber-attack-citizen.htm
The US woman believes she was the target of this cyber-attack because of her outspoken criticism of the Gülen movement, which has infiltrated parts of the Turkish government. The woman, who doesn't want to be identified over fears of retaliation and who spoke anonymously to Wired, received a highly-tailored spear-phishing email purporting to be from a Harvard professor who has previously written about the Gülen movement.
The email contained a link to a website in Turkey which hosted malicious software which would be downloaded to your PC if you simply clicked on the link. The woman sensed a problem with the email and on closer inspection of the email address saw it was sent from an @hawhard.edu address rather than the expected @harvard.edu.
The email was passed to researchers at Arsenal Consulting who analysed the website and found it contained malicious software which it was able to link to governmental spyware sold by the controversial US-based Hacking Team.
While the researchers were unable to get hold of the file which the site was intending to install, as it was removed quickly by those behind the attack, it was able to analyse the downloader and this showed it was the same downloader which has been used in the past to download Hacking Team's Remote Control System (RCS) - also known as DaVinci.
Gülen movement
The Gülen movement is a transnational religious and social movement led by Turkish Islamic scholar Fethullah Gülen. The movement's main focus seems to be education and estimates suggest it has 1,000 schools established around the globe, a number of which are said to be in the US. Gülen himself is currently living in self-imposed exile in Pennsylvania.
The woman targeted by this attack said it was her outspoken criticism of these charter schools in the US which led to her being targeted. The email was sent to an anonymous email address the woman uses in an attempt to identify her, gain access to her private data and communications and ultimately attempt to discredit her.
While there is no concrete evidence of who is behind the attack, there is significant circumstantial evidence which gives an indication of who is behind the attack. Mark Spencer from Arsenal Consulting said: "We have an email, a purported sender, and a target all critical of the Gülen movement. We have professional malware launched from a server in Turkey. You can take it from there."
Spying
Hacking Team is one of a growing number of companies who sell hugely powerful cyber-weapons which can monitor the phone calls, emails and online activity of those they are deployed against. While Hacking Team has told IBTimes UK in the past that it won't sell to companies or countries on NATO, US or EU blacklists, this latest revelation suggests that Turkey, which is a member of NATO, could be using these tools to spy on American citizens.
Hacking Team spokesman Eric Rabe would not confirm or deny whether Turkey was one of its customers.
RCS is just one of a number of powerful tools available to governments, intelligence agencies and police forces around the world. One of the best known is FinFisher which is sold by UK-based Gamma International which was labeled as one of five "Corporate Enemies of the Internet" and "digital era mercenaries" by Reporters Without Borders in March of this year, for selling products that have been or are being used by governments to violate human rights and freedom of information.
Reticent
Like all such companies Gamma International and Hacking Team are reticent to speak too much about what it is their cyber-weapons can do, who uses them or how much they get paid.
Critics of the use of these tools have claimed they have led to the torture and in some cases the deaths of those being monitored. Hacking Team in particular has come in for a lot of criticism as its software has been linked to oppressive regimes in Morocco and the United Arab Emirates who use it to illegally monitor activists.
The escalation of cyber-espionage in recent months has become front page news, with the US government taking big steps to address what it believes is a major threat from outside forces, primarily China, who the White House has accused of breaching the security of critical infrastructure in the US.
An attack on an American citizen by a NATO member would mark a new milestone in cyber warfare, as it is an attack on a US citizen on US soil, without the knowledge of the government and without a link to criminal behaviour or terrorism.
