When pen testers go bad
Heads of security accused of corporate espionage
IDG News Service - Milan magistrates have arrested four Telecom Italia SpA employees for alleged illegal espionage activities, bringing a fresh wave of scandal crashing down onto the former national carrier.
The suspects were identified as Fabio Ghioni, the head of information security at Telecom Italia, his assistant Rocco Lucia, and Guglielmo Sasinini, a former journalist who had been hired by the company to conduct country risk analyses for the Middle East region, according to a 230-page arrest warrant signed by Judge Giuseppe Gennari and widely cited in newspaper reports Friday.
A fourth warrant was served in prison on Giuliano Tavaroli, the former head of security at Telecom Italia, who had already been incarcerated on illegal espionage charges as a result of a separate investigation.
The four men are accused of using Telecom Italia’s resources to spy on Vittorio Colao, the former executive chief executive officer of the Rizzoli Corriere della Sera (RCS) SpA publishing group and on Massimo Mucchetti, the deputy director of the Corriere della Sera newspaper, as part of an elaborate intelligence operation that has all the hallmarks of a spy thriller, according to wire reports Thursday and newspaper articles Friday.
Ghioni and his colleagues targeted Mucchetti because of his well-informed and critical articles about Telecom Italia and its parent company Pirelli SpA, according to an article in Corriere della Sera, which contained excerpts from a book written by Muchetti on the subject.
Ghioni, the head of a 10-member "Tiger Team" set up to run penetration tests against Telecom Italia's information security system, allegedly used a Trojan program, Telecom Italia server in Rome, plus computers in Brazil and Switzerland, to break into Colao's company notebook computer and steal sensitive data.
Among the documents allegedly stolen was a draft version of the RCS three-year business plan. Ghioni allegedly exploited the theft by contacting RCS and warning the company that its security measures were inadequate. He told company officials the business plan was floating around on hacker Web sites and offered to take over the RCS security function himself, newspapers reported Friday.
The modus operandi resembled that of his former boss Tavaroli, who allegedly rose to the top of Telecom Italia’s security department after engineering the discovery of an electronic bug planted in the Telecom Italia chief executive officer’s car in 2001. The then head of security at Telecom Italia was fired for the lapse and Tavaroli was able to take his place.
The suspects allegedly exploited contacts with officers of the French domestic intelligence service Direction de la Surveillance du Territoire (DST) to spy on Pirelli Chairman Marco Tronchetti Provera and his family when they spent time in Paris. They are also accused of spying on Mucchetti’s bank accounts and are even alleged to have hired an attractive young woman to loiter in a bar near the Corriere della Sera in the hopes of picking up the newspaper’s deputy director.
Though himself a victim of the Tiger Team’s espionage, Tronchetti Provera has also been accused by a collaborating witness of having a professional interest in some of the intelligence that was allegedly illegally gathered by Ghioni, Tavaroli and their associates.
Milan prosecutors say the quantity and quality of the information gathered on behalf of Pirelli/Telecom was completely out of proportion to the real needs of the group.
Tronchetti Provera issued a statement Thursday saying he had never authorized the illegal collection of information on anyone and had "taken absolutely no part in any illegal activity."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts