Cyber intelligence made easy. Remote Control System 7 Cyber intelligence made easy.

Can you intercept Skype calls? Can you open PGP encrypted files?

Skype adoption is growing fast Skype adoption is growing fast. People trust it for confidential communications. Criminals too.

There’s more.

Everyone uses the Web. It’s cheap, easy and global.

The new Web is the social web. Highly dynamic. Vastly networked The new Web is the social web. Highly dynamic. Vastly networked. Big data.

Actually, too much data. Mostly noise. Difficult to correlate.

Tap a cable and try to figure out what’s happening Tap a cable and try to figure out what’s happening. 99% of that is of no interest.

Interesting data often never gets to the Web. It stays on the device.

And that device may be out of reach. Linked to the Internet And that device may be out of reach. Linked to the Internet. But anywhere on Earth.

So what we want. Get access to secret data So what we want? Get access to secret data. Figure out the interesting parts. Reach them, anywhere they are.

What you already have. Traditional passive interception What you already have? Traditional passive interception. Not effective against encryption. You lose half the picture. Must pass through your network.

Traditional is good. Innovative is better.

Thinking about offensive interception? You should.

“Governments must have offensive IT capabilities.” The Financial Times

“Spy on suspected terrorists by inserting a remote forensic agent on their computers.” The Economist

A remote forensic agent. Clever idea. A sort of 007 for the digital age.

We have it.

Remote Control System 7

Evidence collection is always running. Configurable behavior Evidence collection is always running. Configurable behavior. Autonomous.

What kind of evidences can be collected?

Voice conversations Browsed URLs Accessed documents Keystrokes Printed documents Messaging Microphone Location Camera snapshots File system browsing Passwords … and more

RCS collected the evidences. They stay on remote device RCS collected the evidences. They stay on remote device. How can we gather them?

Let’s talk about Desktops first.

Internet connection. Firewalls and proxies are passed through Internet connection. Firewalls and proxies are passed through. Domain credentials are stolen.

Evidence can also be collected offline.

What about mobile platforms?

GPRS / UMTS / 3G+. You can provide a custom APN.

Open WiFi networks. Known protected networks Open WiFi networks. Known protected networks. Access Points are automatically detected.

What if no data connection is available?

Bluetooth. Short Range. Let’s introduce RCS Mediation Node.

What happens if someone tracks the connection back?

Anonymizer Chain. Prevents disclosure of RCS server addresses Anonymizer Chain. Prevents disclosure of RCS server addresses. Configurable on-the-fly.

RCS is also flexible.

Real-time alerting system. Custom commands execution on remote target Real-time alerting system. Custom commands execution on remote target. Event-driven logic.

A few examples of event-driven logic.

When entering the meeting room, start the mic When entering the meeting room, start the mic. On low battery, stop microphone capture. Special SMS is received, send back a SMS with position. Call is made or received, take a snapshot with the camera.

Combine them to suit your needs.

What if my target is very skilled?

Invisible to target user. Invisible to antivirus and anti-rootkits Invisible to target user. Invisible to antivirus and anti-rootkits. Anti-forensic measures. Resistant to DeepFreeze restoration.

How can I install it on desktop systems?

Embed RCS into common file formats (0-day exploits) Embed RCS into common file formats (0-day exploits). On-the-fly injection into downloaded applications or updates. Webpage code injection during browsing.

I’m lucky. Physical access is granted.

Bootable CDROM or USB thumb drive. Direct hard disk tampering.

What about installation on mobiles?

Memory Card. ActiveSync while synchronizing or charging Memory Card. ActiveSync while synchronizing or charging. Embed RCS into smartphone applications. Over-the-Air installation.

Supported platforms?

Microsoft Windows XP up to 7 (32 and 64 bits) Mac OS X Leopard and Snow Leopard Linux coming in Q4 2011 Windows: we’re working on Windows 8 Mac: we’re working on OS X Lion Linux: will be ready before the end of the year

Windows Mobile 6. 0 up to 6. 5 iOS 3. 0 up to 4 Windows Mobile 6.0 up to 6.5 iOS 3.0 up to 4.2 Symbian S60 3rd & 5th edition BlackBerry OS from 4.5 Android from 2.2 iOS: we’re working on iOS 5 (released on October 12)

Demo time