The email appeared to come from a trusted colleague at a renowned academic institution and referenced a subject that was a hot-button issue for the recipient, including a link to a website where she could obtain more information about it.

But when the recipient looked closely at the sender’s email address, a tell-tale misspelling gave the phishing attempt away — the email purported to come from a professor at Harvard University, but instead of harvard.edu, the email address read “hardward.edu”.

Not exactly a professional con-job from nation-state hackers, but that’s exactly who may have sent the email to an American woman, who believes she was targeted by forces in Turkey connected to or sympathetic to the powerful Gülen Movement, which has infiltrated parts of the Turkish government.

The woman, who asked to remain anonymous because she’s concerned about retaliation, sensed the email was a fraud and did not follow the link. Instead, the email was passed to researchers at digital forensics firm Arsenal Consulting, who set up a honeypot to visit the Turkish web site and obtained the downloader.

Though investigators didn’t obtain the file that the downloader was supposed to install, analysis of it showed that it was the same downloader that has been used in the past to install Remote Control System (RCS), a spy tool made by the Italian company Hacking Team and sold to governments. A digital certificate used to sign the downloader has also been used in the past with Hacking Team’s tool.

“It was the first hint that this was connected to Hacking Team and RCS,” Mark. G. Spencer, president of Arsenal, told Wired.

Hacking Team asserts that it sells the RCS tool only to law enforcement and government security agencies for lawful intercept purposes, but it has reportedly been used against activists and political dissidents in Morocco and the United Arab Emirates and possibly elsewhere, an issue for which Hacking Team has been severely criticized.

The company touts in marketing literature that the tool evades encryption and bypasses antivirus and other security protections to operate completely invisibly on a target’s machine.

The RCS tool, also known as DaVinci, records text and audio conversations from Skype, Yahoo Messenger, Google Talk and MSN Messenger, among other communication applications. It also steals Web browsing history and can turn on a computer’s microphone and webcam to record conversations in a room and take photos. The tool relies on an extensive infrastructure to operate and therefore is not easily copied and passed to non-government actors outside that infrastructure to use for their own personal spy purposes, according to a Hacking Team spokesman.

Spencer says there’s no definitive proof pointing to who is behind the attempted hack of the American woman, but notes there is circumstantial evidence that warrants further attention.

“We have an email, a purported sender, and a target all critical of the Gülen movement. We have professional malware launched from a server in Turkey. You can take it from there,” Spencer said.

Turkey is a member of the North Atlantic Treaty Organization alliance. If authorities there were behind the hack attack, it would mean that a NATO ally had attempted to spy on a U.S. citizen on U.S. soil, presumably without the knowledge or approval of U.S. authorities, and for reasons that don’t appear to be related to a criminal or counter-terrorism investigation.

Mustafa Kemal Sungur, a spokesman for the Turkish Embassy in Washington, DC, said he had no comment on the allegations.

Hacking Team spokesman Eric Rabe would not say if Turkey is a customer of its software, only that Hacking Team sells to “several dozen countries.”

Speaking generally, he said the company will investigate cases where it believes clients may have used its software in an illegal manner or in a manner that violates the terms of service, and that if a customer is found to be using its software in an illegitimate manner, Hacking Team has ways to render the software useless by halting updates to it.

“If we don’t update the software pretty regularly, antivirus programs will detect the software and it will be useless to the agencies,” he said, referring to tweaks and obfuscations the company adds to the program to thwart detection.

The woman believes she was targeted because she’s an outspoken critic of Turkish charter schools in the U.S. that are run by supporters of the Gülen Movement, a secretive organization led by charismatic Turkish imam and scholar Fethullah Gülen, who resides in exile in Pennsylvania. She believes the email was sent to an anonymous email address she uses in an attempt to identify her and gain access to her private data and communications in order to try to discredit her.

The Gülen Movement has millions of supporters around the world and is behind a network of schools operated in more than 100 countries, including a string of charter schools in the U.S. But critics say that members of the movement have heavily infiltrated the Turkish judicial system and the police intelligence services with the aim of increasing Islamic influences in Turkey and pushing the country in a more conservative direction. Members of the movement are accused of using government and media connections to retaliate against and discredit opponents, including using trumped-up charges to get them jailed.

“We are troubled by the secretive nature of the Gülen movement, all the smoke and mirrors,” an anonymous U.S. official told the New York Times last year. “It is clear they want influence and power. We are concerned there is a hidden agenda to challenge secular Turkey and guide the country in a more Islamic direction.”

The woman who received the phishing attempt says she’s been warned against traveling to Turkey due to her outspoken criticism of the movement’s charter schools.

“I’ve been told by a U.S. official that I should never travel to Turkey, that it would be dangerous for me,” she told Wired.

The body of the email she received read, “Hi, There is a new site about Gülen movement. It is http://www.hizmetesorulanlar.org/homepage.html. Also you should read an essay which I sent. (passwprd:12345).”

The email was signed by a Harvard professor who has written and spoken publicly about the Gülen movement in the past, but the URL in the email actually went to a different web site than the one cited — a poorly designed GeoCities-type page in Turkey with the URL www.mypagex.com/fileshare/questions/main.html.

When Spencer’s team visited the latter web site with a test machine, a malicious Flash component called Anim.swf that appeared to be part of a multi-stage attack got installed on their machine.

“It’s really nice and impressive code,” Spencer told Wired.

This component gathered intelligence about the infected machine’s operating system and browser and was programmed to then download a second-stage Flash attack. Spencer’s team didn’t get a look at the second part, however, because the file was removed from the site before they could grab it. They were, however, able to grab half-a-dozen other components that were stored in folders on the site before being removed. These included the downloader file, an executable program that was designed to grab screenshots from targeted systems and send them to a command-and-control server in Turkey. It was also designed to download another tool, which Spencer believes may have been the main RCS spykit, though he can’t say for certain since the attack wasn’t completed.

The downloader file was digitally signed with a certificate issued to an individual named Kamel Abed. GlobalSign, the certificate authority that issued the certificate, told Wired that the company issued the certificate last November after receiving a legitimate application. The certificate was revoked February 12 after GlobalSign learned of its misuse, following a report by Kaspersky Lab that tied the certificate to Hacking Team’s spy tool.

“The certificate was revoked as soon as our community contacts made us aware of the usage of the key for reasons we do not permit,” GlobalSign CEO Steve Waite said in an email. “We conduct revocation investigations 24/7, and in this case the revocation happened quickly.”

He would not say whether Abed himself had misused the certificate or if someone had stolen it from him to sign the malicious downloader, but he said that GlobalSign revoked the certificate after trying to contact the subscriber to discuss it with him and was unable to reach him.

Asked if Hacking Team had ever been issued a certificate in the name of Kamel Abed or used such a certificate to sign its spy tools, spokesman Rabe said only, “Kamel Abed is a common Arab name, and I‘m not going to comment further than that.”

Arsenal contacted Nicolas Brulez, principal security researcher at Kaspersky Lab, to examine the downloader file and certificate. Kaspersky has written extensively about Hacking Team’s tools in the past, and Brulez found that the downloader code and Kamel Abed certificate were identical to another downloader known to have been used with the RCS spykit in the past. He also found test code in the downloader file that matched exactly test code found in a component of the RCS spykit, and the two files used the same encryption algorithm to communicate with the command-and-control server. There were other similarities and exact matches as well, all of which led Brulez to conclude, “The guy who made the downloader that Arsenal found also made the RCS.”

Brulez believes the downloader is used by the attackers to first gather intelligence about a victim before determining if they want to send the entire RCS package to the machine. He also believes the RCS tool would have been installed on the U.S. victim’s machine through a zero-day Flash exploit that was used against other RCS victims around the same time she was targeted, before Adobe patched it.

Kaspersky has detected at least 50 incidents of RCS infections on computers in Italy, Mexico, Kazakhstan, Saudi Arabia, Turkey, Argentina, Algeria, Mali, Iran, India and Ethiopia.

Hacking Team came under fire last year after a number of security researchers linked the company’s spy kit to hacks that targeted political activists in Morocco and the United Arab Emirates for purposes of spying on and silencing dissenters.

In Morocco, an activist group known as Mamfakinch was reportedly a target of government spying in that country through use of Hacking Team’s software. And Ahmed Mansoor, an activist from the United Arab Emirate who was jailed for seven months in 2011 with four other activists on charges that they insulted the country’s vice president and threatened state security, was also reportedly targeted with the software.

Rabe called the claims “largely circumstantial,” but wouldn’t elaborate.

The company did investigate the claims, he said, but he wouldn’t disclose the outcome of the investigation.

“There are circumstances where we have refused to work with clients based on our examination of what they were doing or what we thought they were doing,” he said, but he would not say if Morocco and the UAE had been dropped as clients as a result of the allegations.

He said the company is careful about who it sells its software to, and won’t sell it to every country.

“We do our best to know who the agencies are and who the governments are who we’re selling to. There are certain governments we do not sell our software to,” he said, though he wouldn’t identify any countries that had been rejected.

Situations in which someone might abuse the software to spy on innocent people is something that “concerns” the company, he said, though he admits there is little Hacking Team can do to prevent it.

“We know how powerful is the tool that we’ve developed, so we’re doing our best to make sure it doesn’t get abused,” he said.”[B]ut there is a limit to how we can control what someone does with the software.”

Source: Wired