Feeds

Latest Snowden reveal: It was GCHQ that hacked Belgian telco giant

Cheltenham-in-the-middle attack against roaming smartphone convos

Intelligent flash storage arrays

Leaked documents provide evidence that GCHQ planted malware in the systems of Belgacom, the largest telecommunications company in Belgium.

According to slides obtained by NSA whistleblower Edward Snowden and supplied to German newspaper Der Spiegel , the attack targeted several Belgacom employees and involved planting an attack technology called "Quantum Insert", which was developed by the NSA. The attack technique surreptitiously directs victims to spook-run websites where they are exposed to secondary malware infection.

The ultimate goal of "Operation Socialist" was to gain access to Belgacom's Core GRX routers in order to run man-in-the middle attacks against targets roaming with smartphones.

The documents shows that spooks in Cheltenham were particularly interested in BICS - a joint venture between Belgacom, Swisscom and South Africa’s MTN - which provides wholesale carrier services to mobile and fixed-line telcos around the world, including trouble spots such as Yemen and Syria. BICS is among a group of companies that run the TAT-14, SEA-ME-WE3 and SEA-ME-WE4 cables connecting the United States, UK, Europe, North Africa, the Middle East and Singapore to the rest of the world.

Early goals for the spies included mapping its network to understand Belgacom's infrastructure as well as investigating VPN links from BICS to other telecoms providers. The leaked slides describe the exercise as already being a success and close to achieving its ultimate goal of compromising enough of Belgacom's infrastructure to run man-in-the-middle attacks. One slide explains spooks had successfully compromised "hosts with access" to Belgacom's Core GRX routers, leaving them just one step away from their objective. The slides themselves aren't dated but other leaked documents date the compromise of Belgacom's systems to around three years ago in 2010.

In a statement issued earlier this week, Belgacom admitted its internal systems were compromised but played down the impact of the breach, saying the intrusion did not compromise the "delivery" of communications. It added that the intrusion is under investigation by Belgian law enforcement.

If GCHQ was indeed the agency concerned then this investigation is unlikely to go anywhere and the most that can be expected is some sort of diplomatic complaint from Belgium to the UK, its EU and Nato partner. We've asked Belgacom if it has any comment on Der Spiegel's revelations.

In response, a spokesman supplied the following short statement which clarifies that Belgacom filed a criminal complaint in July shortly after detecting the hack, and long before going public with the problem on Monday:

We have filed on July 19 a complaint against an unknown third party and have granted since then our full support to the investigation that is being performed by the Federal Prosecutor.

Background on GRX (GPRS Roaming Exchange), a tasty target for signals intelligence types, can be found in a presentation put together by Philippe Langlois, founder and chief exec of P1 Security, from the Troppers security conference in Germany back in 2011, and available here in PDF. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.