If Your Secret Intellectual Property Is Appearing On the Internet, You Could Be The Victim Of An Underground Espionage Syndicate

Very Few Of Us Are What We Seem

If Your Secret Intellectual Property Is Appearing On the Internet, You Could Be The Victim Of An Underground Espionage Syndicate

17 February 2009 No Comment

Secret organizations exist that are paid to steal the data from your personal computer. These organizations can target anyone at anytime. We recently got a rare glimse into this secret world of espionage with the high profile case of Michael Haephrati.

Michael Haephrati, a computer programmer, originally created the Trojan to spy and harass his former in-laws. It was his method of revenge. His wife, Ruth Brier-Haephrati saw the business opportunity in selling this capability to other people and firms.
The world's most dangerous couple?
Michael Haephrati and his wife Ruth Brier-Haephrati created software designed to steal the intellectual property of any individual or company a "business subscriber" paid them to. They sold secret correspondence, documents, economic data, and intellectual property obtained from the computer systems of individuals and firms targeted by Haephratis subscribers.

Here is how they did it.

Between May 2003 and May 2005 a psychological hook was delivered to a specific individual. The targeted individual received an email from an address that looked like a known associate. The hook delivered by email was of a lucrative business opportunity. When the target responded to the email their computer received a Trojan from info@targetdata.biz. If the target did not respond to the email, the target would later receive a CD in the mail that contained the psychological hook again with the the Trojan hidden in the programming code.

The Trojan allowed Haephrati to remotely control the computer of the target. This Trojan included a key-logger and a store and forward capability. It had the capability of watching what someone was doing on their computer "live" or in real time. It would send files from the target computer to FTP servers located in Israel, the U.S., and other locales. Haephrati had dozens of servers located around the globe.

According to Israeli police, items stolen included business plans, marketing plans, details on new products in the making, and employee information and pay slips. This information was then sold to competitors of the target. Israeli police said that over 11 gigabytes of confidential data was obtained before they shut it down.

Subscribers of Haephratis used the service to gain economic advantage of their competition.

A subscription to Haephratis didn't come cheap. Haephratis charged a business customer $3,500 (U.S. dollars) to create a customized software program and to make the initial install on the victim's computer. The monthly fee was then $900 to maintain the infrastructure used to collect, store, and forward the secretly acquired data on a monthly basis.

The ultimate cost to victims was severe. They lost their intellectual property, lost the trust of customers, and even lost employees' personal data. They also lost their best marketing plans to Haephratis' underground servers. Underground servers are believed to facilitate most International identity and credit card theft. The following scary as hell price list was found on underground servers in 2007 (Source: Symantec Internet Security Threat Report, 2007).

U.S.-based credit card with card verification value $1 - $6
UK-based credit card with card verification value $2 - $12
An identity (including U.S. bank account, credit card, date of birth, and government-issued identification number) $14 - $18
List of 29,000 e-mails $5
Online banking account with a $9,900 balance $300
Yahoo Mail cookie exploit—advertised to facilitate full access when successful $3
Valid Yahoo and Hotmail e-mail cookies $3
Compromised computers $6 - $20
Phishing Web site hosting—per site $3 - $5
Verified PayPal account with balance (balance varies) $10 - $50
Unverified PayPal account with balance (balance varies) $12
Skype accounts $12
World of Warcraft accounts—one month duration $10

Haephrati may have never been caught if it wasn't for his own stupidity. He continued to harass his former in-laws by taking his former father-in-law's private work and posting it publicly on the Internet to defame his person and character. His former father-in-law went to the police in November of 2004.

The police used secret forensic tools to identify and trace the Trojan back to Haephrati's business.

In May of 2005, Michael Haephrati and his wife were arrested by British authorities in London per the request of Israeli authorities. They were extradited from the UK to Israel. They pled guilty to the charges brought against them and were convicted of economic and industrial espionage.

Some type of secret plea agreement was reached and the Haephrati's were set free. The rumor on the street is that Haephrati now sub-contracts his Trojan and espionage service to law enforcement agencies only.