As first reported SO SOG recommended using BGP hijacking and Hacking Team helped with the setup of new RAT CnC servers. In this post we’ll take a closer look at the exact details of this incident and support the Wikileaks findings with BGP data.

SO Special Operations Group and Hacking Team

The SO SOG is the Special Operations Group of the SO National Military police. The group focuses on investigating organized crime and terrorism. Hacking Team sells its RAT software known as Remote Control System (RCS) to law enforcement and intelligence agencies, SO SOG included.

SO SOG infected and installed the RCS client on the machines of persons of interest (referred to in the emails as targets). These Remote Access Tools can provide SO SOG with all kinds of information and typically provide the tool’s operator with full access over a victim’s machine. The RCS clients normally need to check in with a server, which is a machine the clients can get their commands (orders) from and then upload stored data, recorded communications, logged keystrokes, etc., to. The Wikileaks emails uncovered how after SO SOG abruptly lost access to one of its RCS servers and worked together with Hacking Team to recover the loss.

Initially, SO SOG used machines from a provider called SOMTEL, a well known bulletproof hoster. Brian Krebs dedicated an article about them in Oct 2013.

Obviously the RCS clients (also referred to as agents in the Wikileaks emails) only work well if they can communicate with the server. If the server becomes unreachable the client essentially becomes an orphan and loses most of its value. This is exactly what happened on July 3rd, 2013 when after nine earlier outages that year, the one of SOMTEL's IPv4 prefix became permanently unreachable. The Wikileaks document described how the SO SOG reached out to Hacking Team to work together on recovering the VPS server that ran on AS37563. In SO SOG terminology, the server was called "Anonymizer”. The emails also revealed that this server relays updates to another back end server called "Collector” from which SO SOG presumably recovers the targets’ data.

Hacking Team first proposed that SO SOG work with SOMTEL in order to bring the VPS back online, so they could subsequently help reconfigure the RCS server to receive updates from the RCS clients (installed on targets’ devices) but that plan did not materialize.

A plan then was devised to make the AS37563's prefix reachable again by announcing it in BGP. Since the prefix wasn’t announced by SOMTEL anymore, originating it from a different AS should make the network reachable again. The Wikileaks documents show how SO SOG worked with another network operator to get the prefix announced in BGP and bring up a new "Anonymizer” server with the appropriate IP address. SO SOG also was hoping that other ISPs wouldn’t filter that hijacked announcement.

When we look at historical BGP data we can confirm that SOMTEL indeed started to announce the prefix. The Wikileaks emails outline how SO SOG complained to Hacking Team that the IP was reachable only via several SO providers but not yet through SO, concluding not all RCS clients were able to connect back to the server immediately, since the prefix was not seen globally. BGP data further confirms this per the visualization below.

Historical BGP data shows how AS37563 (SOMTEL) started to announce the prefix to its peers via the Internet Exchange Point and how it became reachable via the peers that then accepted this BGP announcement. The peers below were some of the networks that accepted the announcement and would have had a path to the new ‘fake’ RCS server.

AS12874 Fastweb
AS6939 Hurricane Electric, Inc.
AS49605 Reteivo.IT
AS4589 Easynet
AS5396 MC-link Spa

After some frustration on SO SOG’s part due to summer vacation delays, eventually the IP address of the server became reachable again, at least for many SO networks and the new server was up and running with the same IP address. Hacking Team then stepped in to reinstall and setup a new RCS server on that IP.

Consequently, the RCS clients were able to "sync” back in with the server. On Aug 20th the SO SOG confirms with Hacking Team that it had indeed recovered contact with 3 of the 4 RAT clients.

Finally on August 22 at 13:35 UTC the prefix is withdrawn again, which would indicate that the operation was successful and the RAT clients were likely configured to use a different server IP.

Conclusion

As the supporting evidence from historical BGP data concludes, the information revealed in the Wikileaks documents is factual and the SO SOG and Hacking Team did work with the network (SOMTEL), to announce various prefix between Aug 16 and Aug 22. in order to regain access to their RAT clients.

Source:http://www.cloudtacker.com/docs/AS37563