Can Hacking Team plant Child Porn on your computer? Voat

Disambiguation · Jul 10, 2015

https://voat.co/v/technology/comments/237783/758760

[–] Mr_Quagmire 1 points (+1|-0) 8 hours ago (last edited 7 hours ago)
I would love to see a smoking gun as much as anyone, but the code snippet that was posted simply does not have the capability to write anything to disk. That being said, I do not have the time nor expertise to go through the rest of the code to see what it does. If anyone can find actual evidence of this software planting files, please post it up!

edit: Here's the rest of that repository: https://github.com/hackedteam/rcs-common/
and here's all of the repositories: https://github.com/hackedteam

permalink parent

https://cdn.arstechnica.net/wp-content/uploads/2015/07/hacking-team-code.png
https://voat.co/v/technology/comments/242573

Disambiguation · Jul 10, 2015

Hacking Team pdf
https://wikileaks.org/spyfiles/files/0/31_200810-ISS-PRG-HACKINGTEAM.pdf
Starts on page 16
Page 23- "possibly modify HD contents"

Anonymous · Jul 14, 2015

Amongst the menagerie of monstrous products hawked by the outfit, it was this very suggestive comment that drew my attention to it:

I think that the current and ongoing discussion on VOAT that was instigated by the post below has the questions in the best of perspectives for now:

Infosec hacker here... The author of the post is misunderstanding the purpose of this code.
The purpose of this code is to capture evidence. (In a typical way that would be used by law enforcement) The particular line of code uses a conditional or statement to insert .sample if the path is null. What this means is that when they run whatever this software is to test it against a null file or directory it will produce a sample evidence file [with no actual evidence file in the package]. The line of code appends .sample to the end of the sample file path.

If the path is not null, then it uses whatever filepath it was pointed at and adds it to a header along with timestamps then combines it with the file itself. It appears to hash various steps in the process and include these in the evidence header.

So you end up with evidence packages which are files that have been hashed and packed with a header including the full file path of the machine is was found on as well as time stamps.

However it should be noted that if someone has exploited a machine such that they could run this code remotely, they would already have enough access to plant whatever they want. However, in a law enforcement scenario where they would be running this code, presumably on a machine that came to one of their honeypots, it's very likely that they would not need to plant such evidence. (Or bother to)

Noble cause corruption is commonplace in a variety of police actions; everything from planting evidence - firearms, drugs, etc., - to lying on witness stands in order to obtain convictions.

But I think the above post has given the current evidence a fair assessment and it resides in the circumstantial box on my desktop.

Log in or Sign up

Can Hacking Team plant Child Porn on your computer? Voat

Disambiguation Global Moderator

Disambiguation Global Moderator

Anonymous Member

Share This Page

Customize Theme Colors

Predefined Skins