Supercharge your infrastructure

Leaked documents provide evidence that GCHQ planted malware in the systems of Belgacom, the largest telecommunications company in Belgium.

According to slides obtained by NSA whistleblower Edward Snowden and supplied to German newspaper Der Spiegel , the attack targeted several Belgacom employees and involved planting an attack technology called "Quantum Insert", which was developed by the NSA. The attack technique surreptitiously directs victims to spook-run websites where they are exposed to secondary malware infection.

The ultimate goal of "Operation Socialist" was to gain access to Belgacom's Core GRX routers in order to run man-in-the middle attacks against targets roaming with smartphones.

The documents shows that spooks in Cheltenham were particularly interested in BICS - a joint venture between Belgacom, Swisscom and South Africa’s MTN - which provides wholesale carrier services to mobile and fixed-line telcos around the world, including trouble spots such as Yemen and Syria. BICS is among a group of companies that run the TAT-14, SEA-ME-WE3 and SEA-ME-WE4 cables connecting the United States, UK, Europe, North Africa, the Middle East and Singapore to the rest of the world.

Early goals for the spies included mapping its network to understand Belgacom's infrastructure as well as investigating VPN links from BICS to other telecoms providers. The leaked slides describe the exercise as already being a success and close to achieving its ultimate goal of compromising enough of Belgacom's infrastructure to run man-in-the-middle attacks. One slide explains spooks had successfully compromised "hosts with access" to Belgacom's Core GRX routers, leaving them just one step away from their objective. The slides themselves aren't dated but other leaked documents date the compromise of Belgacom's systems to around three years ago in 2010.

In a statement issued earlier this week, Belgacom admitted its internal systems were compromised but played down the impact of the breach, saying the intrusion did not compromise the "delivery" of communications. It added that the intrusion is under investigation by Belgian law enforcement.

If GCHQ was indeed the agency concerned then this investigation is unlikely to go anywhere and the most that can be expected is some sort of diplomatic complaint from Belgium to the UK, its EU and Nato partner. We've asked Belgacom if it has any comment on Der Spiegel's revelations.

In response, a spokesman supplied the following short statement which clarifies that Belgacom filed a criminal complaint in July shortly after detecting the hack, and long before going public with the problem on Monday:

We have filed on July 19 a complaint against an unknown third party and have granted since then our full support to the investigation that is being performed by the Federal Prosecutor.

Background on GRX (GPRS Roaming Exchange), a tasty target for signals intelligence types, can be found in a presentation put together by Philippe Langlois, founder and chief exec of P1 Security, from the Troppers security conference in Germany back in 2011, and available here in PDF. ®

5 ways to reduce advertising network latency