News for hackers. Stuff that matters.

A comment on Phineas Fisher's account of how he took down HackingTeam.

Re:Phineas Fisher's account of how he took down HackingTeam by mmaunder on Sunday April 17, 2016 @01:06AM (#11513560)
For anyone who doesn't follow infosec: This guy is responsible for two of the most impressive hacks recently and still hasn't been doxed or arrested. And so the linked doc is awesome if only for the opsec tips it provides. And it provides much more than that. It really gives you some perspective on how much work an attacker will put into breaking into your network and the kind of structured approach they're taking. Plus it's very hands on and is educational and current whether you're black or white hat. If you read nothing else in infosec this month, read this.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by nerdy on Sunday April 17, 2016 @03:03AM (#11513771)
He's likely to be identified as he gets more brazen. Even authoring this volume of text is risky, and there are other notes from the same author linked within. Spelling can be used to approximate region and phrases or errors such as "the hard of the business" ("heart of") and "passtime" ("pastime") are even stronger markers. Of course there's no way to tell if these are unintentional or planted errata.

I'm grateful for the information. It's incredibly interesting, but it might come at great expense to the author.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by espadrine on Sunday April 17, 2016 @05:02AM (#11513925)
This text is a translation. The original is in Spanish. It might have its own mistakes and traces, although I am not knowledgeable to detect country-specific patterns. http://pastebin.com/raw/GPSHF04A

Presumably, given that they talk about EU culture^W^W^W^W (see comment below) have a https://securityinabox.org/es/… link, the author is from Spain, which would make it easier to pinpoint an origin, as Spain has a wider spectrum of language differences than in most other Spanish-speaking countries.

Since there is a link to http://madrid.cnt.es/, they maybe live in the capital, which weighs 3 million inhabitants.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by zydeco on Sunday April 17, 2016 @05:22AM (#11513955)
That's an error on the translation, "EEUU" is the Spanish acronym for "Estados Unidos", referring to the United States of America, not the EU (in Spanish, "UE" for "Unión Europea")
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by josemrb on Sunday April 17, 2016 @06:01AM (#11514025)
After reading the original doc, by the style used and some slang (although it could be on purpose), I would say the author is from Chile.

I'm glad to find people that still fight the system in this side of the world.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by dazhbog on Sunday April 17, 2016 @06:33AM (#11514086)
"weones culiaos" sounds pretty Chilean indeed!
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by peeb on Sunday April 17, 2016 @09:13AM (#11514395)
I would be willing to bet they are from Italy. I am Italian and they wrote about some stuff that you would know only if you followed Italian news.

They could be dropping some contradictory clues, BTW. I could definitely see that.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by 21 on Sunday April 17, 2016 @09:54AM (#11514483)
Did you verify that the stuff you refereed to as only being known if you follows Italian news is not on the net? Don't those Italian news outlets have websites?

This guy seems to be pretty good at googling around for stuff.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by Esau on Sunday April 17, 2016 @09:21AM (#11514407)
You comment about spelling and phrases reminds me of the NYT's Dialect Quiz Map. I tried it and it was accurately able to guess where I was originally from. While not useful by itself, I could see it being handy as part of an overall investigation.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by adanto6840 on Sunday April 17, 2016 @10:30AM (#11514606)
Hadn't seen it before and so looked it up -- pretty neat. Unfortunately the "results page" was broken, but the individual questions & associated heatmaps were still very interesting. Thanks!

http://www.nytimes.com/interactive/2013/12/20/sunday-review/...

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by CamatHN on Sunday April 17, 2016 @04:50AM (#11513905)
Who exactly would be trying to track him down?

Is there some global force that would be active on him?

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by nerdy on Sunday April 17, 2016 @05:33AM (#11513983)
HT, Gamma, victims we aren't aware of, or any government who could believably threaten to prosecute then offer a deal for cooperation?

Some people even do it out of curiosity: https://news.ycombinator.com/item?id=11304752

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by CamatHN on Sunday April 17, 2016 @06:28AM (#11514071)
Thats the thing, HT or Gamma without the co-operation of international law enforcement presumably would have a very hard time finding these people in a legal manner. So whats going on up there.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by 21 on Sunday April 17, 2016 @09:51AM (#11514478)
HT Gamma can file a complaint with the relevant authority, just like any other hacked company, and this could trigger an international LE operation.

So I'm not sure what your trying to say.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by nommm-nommm on Sunday April 17, 2016 @04:27PM (#11516161)
The Unabomber was turned in by his brother and sister in law who recognized his writing.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by nickpsecurity on Monday April 18, 2016 @02:28PM (#11522089)
Yep. There's even automated techniques for spotting it with decent accuracy.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by dorfsmay on Sunday April 17, 2016 @11:08AM (#11514745)
Or even evaluating the frequencies of words, as well as the frequencies of juxtaposition of words.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by richard_mcp on Sunday April 17, 2016 @01:10AM (#11513570)
What was the other hack?
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by mmaunder on Sunday April 17, 2016 @01:12AM (#11513577)
Gamma International.
[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by nickpsecurity on Monday April 18, 2016 @02:33PM (#11522122)
He's (or she ;) has skill although I can't say how special. What I'll give Fisher are two things:

1. Great choice of targets where the leaks are less questionable in terms of ethics.

2. A great write-up with references that could benefit attackers, defenders, and students alike.

[ Parent | on HN ]
Re:Phineas Fisher's account of how he took down HackingTeam by cypherg on Monday April 18, 2016 @03:15PM (#11522402)
Phineas Fisher has already publicly outed himself as an Italian security researcher. He openly shares his first and last name on his website.
[ Parent | on HN ]