How UK Spies Hacked a European Ally and Got Away with It

https://theintercept.com/2018/02/17/gchq-belgacom-investigation-europe-hack/

246 58 8 years ago

nickcox• 8 years ago

The article doesn't seem to touch on the motivation for the attack. (Perhaps it's taken to be obvious.) Why would the British government want to do this?

jjgreen• 8 years ago

Big boys told us to do it.

mjw1007• 8 years ago

From the article:

« The British spies appear to have targeted Belgacom due to its role as one of Europe’s most important telecommunications hubs. Through a subsidiary company called Belgacom International Carrier Services, it maintains data links across the continent and also processes phone calls and emails passing to and from the Middle East, North Africa, and South America. But tapping into a broad range of global communications is only one possible motive. GCHQ may also have sought access to Belgacom’s networks to snoop on NATO and key European institutions, such as the European Commission, the European Parliament, and the European Council. All of those organizations have large offices and thousands of employees in Belgium. And all were Belgacom customers at the time of the intrusion. »

toyg• 8 years ago

The main motivation is that Bruxelles is in Belgium. The US / UK / “Five Eyes” security apparatus takes the EU more seriously than most EU members themselves. Among other things, they really don’t want for anything like “an European integrated army” to emerge as an alternative to Nato.

And the second motivation is that they can. The pre-Snowden speculation was that all major European carriers are targets for NSA and friends, and the Snowden files basically reinforced that view. The question is not “why should they spy on their allies”, everyone has always done that; the question is the degree of success that any given player achieves and what they do with the info they gather. In this case, it looks like the operation was a great success, followed by huge failure (it was burnt to the ground).

kylell• 8 years ago

How can you get infected by just visiting a fake website, where they on windows, are we doing such a poor job, we like to brag with nice titles, architect etc, but the industry is quite shit, if you can get infected just by visiting a site.

petepete• 8 years ago

"After installing malware on the engineers’ computers by luring them to a fake version of the LinkedIn website, GCHQ was able to steal their keys to the secure parts of Belgacom’s networks and begin monitoring the data flowing across them. "

FFS.

chatmasta• 8 years ago

The computers of engineers are great targets for hacking. Dozens of package managers across languages and operating systems, as well as GitHub, provide easy vectors for getting complex code to execute on computer of the dev. Devs are used to running code from the terminal, and typically have many interesting files in their file systems that could assist with lateral movement or even lead to compromising of the build system (!!)

Despite this, devs are still generally very cavalier about running code from the internet on their machines. Often times they have no choice of security mitigations because their package manager is compromised by flaws in its design.

madez2• 8 years ago

Why do people let keys lie around on storage? A smartcard is dirt cheap and comes even including reader in all shapes and sizes. There are no excuses.

JohnStrangeII• 8 years ago

Every current PC system can be broken, no matter which operating system it is running. Intelligence agencies use 0-day exploits and test the software they use against known antivirus software and intrusion detection systems.

There are also plenty of companies such as Lench/Gamma who overtly advertise their ability to penetrate any system. You can only buy or lease their software as a state actor, though.

DyslexicAtheist• 8 years ago

You can only buy or lease their software as a state actor, though.

there is a wide spectrum of actors in this space and besides the well known (Gamma/HackingTeam) also include many smaller firms that do not shy from working in a gray area and cater to both criminal enterprises, unstable regimes, warlords. Especially smaller fish fill the niche (AREA[¹], Negg[²], ...)

Though any of these providers they don't just give you a software because "solutions* would (due to their nature) rarely work out of the box. Instead they come with a consulting service contract to ensure the system is correctly used (to facilitate breaching the target). So "state actors" isn't restricted to spy-agencies but low-level law-enforcement who lack the budget and technical know-how for maintaining or creating these tools. So these systems are kind of a poor-mans TAO.

¹ https://www.linkedin.com/feed/update/urn:li:activity:6367357...

² https://twitter.com/ValbonneConsult/status/95357449457630412...

stordoff4• 8 years ago

Monitor their communications so you know exactly what software they are using, then drop a 0-day on the forged site (I find it very unlikely that GCHQ don't stockpile Firefox/Chrome escapes and Windows/Linux priv. escalations etc.). There's little an individual can do against such a targeted attack without completely airgapping the machine which A) probably isn't viable for a network/software engineer and B) GCHQ are probably determined enough to gain physical access if they deem it necessary.

3170702• 8 years ago

It gets even better: Europol flat out refused to help in the investigation [1]

However, Europol wanted nothing to do with the investigation and refused to assist, according to two sources familiar with the interaction. Europol asserted that it would not carry out investigations into other European Union member states – in this case, the U.K. The Belgians were frustrated and believed Europol had stonewalled them for political reasons; they noted with suspicion that the organization was led by Rob Wainwright, who is British.

I mean, what are we doing here? How can Europol so blatently refuse a case? Isn't that a clear violation of the trias politica?

[1] https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...

stupidcar• 8 years ago

Europol as an organisation has no power to act on its own, it relies on the co-operation of the EU member states, and needs permission from the relevant national authorities to conduct investigations and arrest suspects. Regardless of the nationality of its leader, it can't realistically investigate British suspects if the British won't co-operate, and there's no prospect of them doing that here.

Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries, and none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it, and that would harm the fight against organised crime and terrorism.

Basically, when it comes to a supranational organisation like Europol, real separation of powers is impossible, because there's always a political calculus involved in a collaboration between sovereign countries with occasionally competing interests.

fauigerzigerk3• 8 years ago

Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries

That may well be, but without having any inside knowledge I'm pretty sure that the extent to which such incidents damage relations depends on more than a yes/no question. How was this done and why? Were any non-public inter-agency agreements or silent understandings breached? Was the UK acting alone on this or with the US?

I think all of this could influence the mood in the negotiations now taking place over the future security collaboration between the EU and the UK.

This incident will certainly not be the most important consideration by far. That would be just crazy. But it could add to the potential distrust of a UK now desperately dependent on getting into the good graces of the US, which isn't exactly seen as a staunch defender of the rule of law outside US territory.

3170702• 8 years ago

none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it,

Well, now see it from the point of view of the other side. How will Belgium now see their future cooperation with europol? You are not wrong, but it is a stance which causes supranational organisations to whither until nothing is left.

Zak2• 8 years ago

Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries

Why is this tolerated? Is it, perhaps that surveillance a country cannot legally conduct internally is conducted by its "friends", sometimes resulting in relevant information being shared with its own intelligence services?

mirimir• 8 years ago

Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries, and none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it, and that would harm the fight against organised crime and terrorism.

The UK seems well organized ;)

jarym• 8 years ago

First, it strikes me as obvious that if the Brits did this then it would have had to have been with the blessing of their peers in Belgium

No senior GCHQ officer is going to sign off in a cyber hack of an ally unless they had a really good reason and had covered their own ass.

But if they’d really been freewheeling then it amazes me just how much impunity state apparatus can act with - what hope has an ordinary individual or private company got of protecting themselves and seeking redress through the courts?

hutzlibu• 8 years ago

"No senior GCHQ officer is going to sign off in a cyber hack of an ally unless they had a really good reason and had covered their own ass."

good reason: much more information

Covering: was very good, only because of Snowden it got linked to the UK

So even though it might be possible, that Belgium was in it on high level (you hack, but we get data conveniently without legal issues), it is also very possible, that they went for it without saying anything.

pbhjpbhj3• 8 years ago

Aside from Belgacom, the agency has broken into the computer systems of the oil production organization OPEC; the Netherlands-based security company Gemalto; and organizations that process international cellphone billing records, including Switzerland’s Comfone. //

In theory any of these countries could surely just issue an arrest warrant for the head of GCHQ and order their extradition.

In view of that it seems there's some other aspect preventing such actions -- like blackmail by GCHQ. Or controlling powers in Belgian security being in part responsible.

Anyway, I wonder how much of this shit the Belgian public will put up with post Brexit.

It still seems illegal under UK law -- these things do show how the powers that be have no respect for the authority of the rule of law, that our democracy is only allowed inasmuch as it doesn't interfere with their plans.

Tharkun3• 8 years ago

The Belgian public neither knowd nor cares. The press should have made a fuss but didn't. I remember a couple of very short articles about it, which kind of sort of maybe said the British might have potentially but not likely been involved.

Belgium was designed to be a toothless and spineless state by the UK, France & Germany, and it's playing its part wonderfully.

jacquesm• 8 years ago

Belgium was designed to be a toothless and spineless state by the UK, France & Germany, and it's playing its part wonderfully.

Belgium is in its own way more often than not, which is a pity because with Brussels the de-facto capital of Europe the potential to become a regional power-house is definitely there. But Belgian politics, the language divide and a surprisingly large amount of corruption (a bit better than France but substantially worse than Germany and NL) do not help.

wiz21c• 8 years ago

>> The Belgian public neither knowd nor cares.

Maybe there are more interesting hacks to do ? What about https://www.ehealth.fgov.be/ or https://www.smals.be or nuclear plants networks (these are isolated I think, so extra bonus if one hacks into them)?

Also, anyone has data about the last failure @ Belgacom ( http://www.lesoir.be/125094/article/2017-11-19/le-reseau-pro... )

Chriky2• 8 years ago

It still seems illegal under UK law

Under what law?

pbhjpbhj3• 8 years ago

CMA for one.

wbl• 8 years ago

Why on earth would you do that? Yes, he's the head of the agency that breaks the law in your country, but you've got one of those too. There is 0 chance of extradition actually happening.

pbhjpbhj3• 8 years ago

Why wouldn't you punish people who illegally hacked your countries companies at high cost to the companies, and by extension your citizens. Especially when the actions are illegal in that country, illegal in your country, and illegal by treaty that your countries are both part of.

The reasons not to have them indicted are "we don't want to keep the rule of law" and "we don't care about costs to our citizens" and "screw democracy, we want to play with the pawns too".

Yes, there is zero chance of extradition because such people give less than two shits about rule of law and democracy ... but that's exactly why one should care. They should evict all our UK government personnel from Belgium.

Low-life criminals.

stordoff4• 8 years ago

It still seems illegal under UK law

CMA doesn't apply: https://www.legislation.gov.uk/ukpga/1990/18/section/10

The powers of GCHQ are basically unconstrained by the law: "[GCHQ shall] monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material [...] in the interests of national security, [...] in the interests of the economic well-being of the United Kingdom [... or] in support of the prevention or detection of serious crime." per http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gch...

superjambo• 8 years ago

I mean if the laws are only enforced selectively against the kings enemies it makes a mockery of the rule of law.

But if the laws are written so that they don't apply to the king in the first place of course the law is just.

azernik2• 8 years ago

In theory any of these countries could surely just issue an arrest warrant for the head of GCHQ and order their extradition.

The rules are different for states. Arresting a foreign security official for the actions they carried out in their official capacity is an inherently political/diplomatic decision, and not a normal criminal one.

There are some carve-outs for war crimes, but there's a reason those were so difficult to push through even for countries that haven't committed war crimes lately and aren't even liable to get into any wars any time soon - the whole concept goes against a lot of the assumptions of state sovereignty.

eecc• 8 years ago

I’m starting to distrust the current security model of all major operating systems. Assuming a safe CPU - and that’s a big one already - I’d like a system where any random app does not have unfettered access to any user file, where individual files can be classified and restricted from being accessed by processes with network capabilities and so on. Android permissions are a start.

This and browsers should really just execute in their own externally managed sandbox

striking• 8 years ago

You can already do something like this with Flatpak on Linux https://en.wikipedia.org/wiki/Flatpak or VMWare Thinapp for Windows https://en.wikipedia.org/wiki/VMware_ThinApp.

Want to try it now? You can try it with Steam, which is otherwise notoriously annoying to install on Linux:

  flatpak install --user --from https://flathub.org/repo/appstream/com.valvesoftware.Steam.flatpakref
  flatpak override com.valvesoftware.Steam --filesystem=$HOME

  # run it with this command:
  flatpak run com.valvesoftware.Steam

Unfortunately, if you're running X11, Steam can still spy on everything you're doing in X11. But Wayland is coming/is here, and fixes that too.

Xylakant• 8 years ago

Unfortunately, if you're running Wayland, many games turn into an audio game, lacking video (stellaris on F27, I’m looking at you).

:sigh: year of the linux desktop, ...

ENOTTY• 8 years ago

Mandatory access controls were invented to address this exact weakness. Ironically, selinux might be the most mature implementation of it in Linux, if not the rest of the Unix land.

luch• 8 years ago

You should take a look at QubesOS : https://www.qubes-os.org. Each application starts in a VM in order to isolate them from each other.

The only issue is that QubesOS rely on paravirtualization (it's a Xen hypervisor underneath) for process isolation.

(By the way Windows is taking the same path with ApplicationGuard)

crtasm• 8 years ago

It also runs your network connection and firewall in their own VMs, plus makes it easy to stack more. e.g. you want to connect to a VPN and then to Tor? No problem.

At the same time you can run your password manager in a VM with no network access.

madez2• 8 years ago

I think Qubes' approach should be the default. There is no valid reason for so many permissions by default. The current default for example on Debian is crazy! Any user can read the home directory of any other user by default! If somebody whould have told me that before knowing it, I would have considered it a bad joke. I can't fathom why it's not changed.

However, Qubes can't protect against malicious hardware. I see no way around it, we must have hardware with completely open sources.

jsiepkes• 8 years ago

What is also quite interesting is that this (at least partially) came to light because of the NSA breach. Couple of months ago we had Trump blabing his mouth about the Dutch hacking the Russians. I wonder how much all this loosing of secrets affects the standing of the US in the intelligence community.

scdthrowrgjir• 8 years ago

Hmm seems like Belgacom has had several visits from the NSA and/or GHCQ. The most likely reason for these friendly visits is that Belgacom manged(manages?) a couple of submarine cables in the middle east and north Africa. It's public knowledge that either the NSA or GCHQ had infected their core routers/switches.

When that story first came to light, what they didn't tell you is that the NSA was also in Deutsche bank and several other financial institutions. Perhaps they still are.

stevew20• 8 years ago

This type of behavior is actually extremely commonplace. These are the ones that were sloppy enough to get caught...

fimdomeio• 8 years ago

I would love to know what plans does the eu have to stop routing so much internet trafic via the uk once brexit effectivly takes place.

How UK Spies Hacked a European Ally and Got Away with It

Related Stories