Putrajaya's multi-million bought spyware may go up in flames

Several government agencies may have spent close to RM8 million to acquire citizen-spying remote control software (RCS) but the expenditure may have gone up in flames.

This was after the spyware's source code was leaked online, revealing the vulnerabilities it exploited, and which was promptly fixed by software manufacturers.

The leak was a result of the spyware's creator, Hacking Team, being hacked by anonymous hackers on July 7, which stole 400GB of data from the Milan-based company and uploaded it on the Internet.

According to Digital News Asia, the revelation prompted several software manufacturers to scramble patches in order to fix the vulnerabilities, rendering the spyware ineffective.

"Software manufacturers like Adobe, Google and Microsoft rushed to publish patches that fixed the vulnerability.

"What that means was that the exploits that Hacking Team relied on to install their backdoor RCS no longer exist, rendering their product obsolete and, in some cases, completely useless," it said.

It was from the same 400GB trove of data, which included emails and client lists, that it was revealed Malaysian government agencies had bought the spyware.

The spyware sold by Hacking Team is a trojan that, once activated by opening the file, can track, eavesdrop and download information from the victim's computer.

Last Thursday, Malaysiakini reported that Hacking Team's client list revealed that it had €1.86 million (RM7.83 million) in deals from government agency clients in Malaysia.

The documents showed Malaysian Anti Corruption Commission (MACC) as the biggest payee to Hacking Team, followed by Malaysian Military Intelligence (MI) and the Prime Minister's Office (PMO).

The MACC has paid €789,123 (RM3.32 million) to Hacking Team for the software including maintenance for the year 2016.

MI also paid €552,000 (RM2.32 million) while the PMO paid €520,000 (RM2.19 million) to Hacking Team.

The document also revealed that Hacking Team was targeting the Malaysian Communications and Multimedia Commission (MCMC) and the Royal Malaysian Police's commercial crimes division to peddle their citizen-spying software.

The company even forecasts that it can secure a €380,000 (RM1.6 million) deal with the MCMC by the second quarter of this year, and another €550,000 (RM2.31 million) deal with the Commercial Crimes Division of the Malaysian police by the third quarter of this year.

It is not clear if any of these forecasted deals were eventually inked.

However, with the vulnerabilities exploited by the spyware fixed, Hacking Team may now have trouble selling the spyware to anyone.