Latest Snowden reveal: It was GCHQ that hacked Belgian telco giant

Leaked documents provide evidence that GCHQ planted malware in the systems of Belgacom, the largest telecommunications company in Belgium. According to slides obtained by NSA whistleblower Edward Snowden and supplied to German newspaper Der Spiegel , the attack targeted several Belgacom employees and involved planting an …

[asdf]

hmm

Where are all the yank haters on this one? At least on this issue I think enough Brits in IT had a sneaking suspicion their government was up to almost as much no good as the NSA so the criticism was a bit muted. It sucks when you have little control of your government but personally get blamed by people in other countries huh?

[Tikimon]

Re: hmm

Second that! Ahhh, I've watched sanctimonious Brits sneer at my country plenty. Nice to see them hoist on their own petard and the deafening, embarrassed silence it generates.

The takeaway is this: we're all at the mercy of our unaccountable governments. Let's not rip and tear on the CITIZENS of any nation for the stupidity of their so-called leaders, eh? American-bashing is uncool and unproductive, and I won't be indulging in counter-strike Brit-bashing for that reason.

[Destroy All Monsters]

Re: hmm

There is only one way to save our city: Neo The Tea Party

[Anonymous Coward]

Re: hmm

Nah yanks... its Friday, its sunny and probably the last warm sunny weekend of the year... so we have all bunked off early for the pub, look after the place for a bit, be back on Monday.. toodle pip :)

[Psyx]

Re: hmm

"Second that! Ahhh, I've watched sanctimonious Brits sneer at my country plenty. Nice to see them hoist on their own petard and the deafening, embarrassed silence it generates."

No, we knew that GCHQ was in bed with NSA as regards hacking international telecoms about fifteen years ago, so there's no point us doing anything more than shrugging our shoulders now.

But y'know: You do kind of lose any moral high ground on sanctimoniousnessnessness by immediately counter-gloating...

[Don Jefe]

Re: hmm

Nobody is hoisted on a petard, they don't work that way. A petard hoists you if you're slow or had sex with the fuseers daughter.

[channel extended]

Re: hmm

So I'm a masochist. Bash (shell) me.

[<shakes head>]

Re: hmm

bashing americans it may be uncool??? and unproductive, but it is fun

[Anonymous Coward]

Re: hmm

> ...but it is fun

And they make it so easy!

[Anonymous Coward]

Re: hmm

> Where are all the yank haters on this one?

I think we're all getting a bit jaded about the whole thing.

What? NSA hacked another government's systems? Meh. We kinda know they're into everything now.

What's the betting we are being softened up to prepare us for more intrusive stuff later on.

Perhaps this whole revelation thing was arranged by the NSA to de-sensitize us for the worse that is yet to come.

[btrower]

Re: hmm

@skelband -- I think you are on to the real story.

[Anonymous Coward]

Re: hmm

Where are all the yank haters on this one?

I suspect they'll turn up; don't forget GCHQ used NSA developed software, and probably performed the hack at their behest as well.

[asdf]

Re: hmm

Keep thinking NuLab wasn't as quick to use the terrorism excuse to terrorise its own people as either party in the USA (it didn't need the prodding from NSA or anyone). The Tories are no better either. As for the counter gloating its actually more of counter disgust. Often times here in the United States of Corporate Whores, Europe and the UK are few of the places in the world we can point too and say look see how a civilized country does it. When they are pulling the same bullshit our government can say see everyone does it.

[Matt Bryant]

Re: asdf Re: hmm

".....Europe and the UK are few of the places in the world we can point too and say look see how a civilized country does it...." <Sigh> It always amuses me when Libtard Septics get all misty-eyed over "les Continentals" and how "cultured" the Old European socialists are. What you fail to realise is the Special Relationship works because the UK is quite often the go-to boy for nasty stuff that the US wants done quietly. In the US you have always had much more stringent control and oversight over your intelligence services, even the NSA, whereas in the UK we spent many decades calmly turning a blind eye by insisting that our Secret Services did not officialy exist! But it gets even funnier when such Libtards try to live in denial about our European chums - you really need to go read up on some of the lovely activities of the Fwench and Belgians in their old empires. As just an example, I was most amused by a Greenpecker insisting to me the other day that the recent Russian seizing of the Artic Sunrise was "unprecedented" - how quickly the sheeple forget incidents like the sinking fo the Rainbow Warrior by the Fwench DGSE.

[Fibbles]

Re: hmm

"Where are all the yank haters on this one?

I suspect they'll turn up; don't forget GCHQ used NSA developed software, and probably performed the hack at their behest as well."

I notice Lewis Page has been keeping his head down recently. Surely this is the perfect opportunity for him to espouse the virtues of American cyberwafare tech. As in the real word, so in the digital.

[Anonymous Coward]

Re: hmm

I think enough Brits in IT had a sneaking suspicion their government was up to almost as much no good as the NSA so the criticism was a bit muted

Oh don't worry we know our lot as just as bad as your lot... it's a 'special' relationship they have.

[Anonymous Coward]

Re: hmm

The big thing is, the average Brit does not take its government, nor even the country, as seriously as Yanks do theirs. We tend not to go in for flags in schools, flags outside our hovels and, apart from pseudo-yanks like Cameron and Blair, we are not awfully keen nowadays to flex our muscles in foreign parts to depose governments we do not understand, support those who are actually inimical to our interests and generally waste as much of our taxes and fellow citizens/subjects lives as possible in the cause of spreading the grip of coca cola, American finance and American oil interests as possible.

Some of us can even still speak English rather than American. But, judging by the confusion shown in most of these threads, we are a dying breed.

Excellent that, at last, enough MPs had the guts to say, "No". Curious that certain Tories want to keep asking until the answer changes, while condemning the EU for organising ballots repeatedly until the answer changes.

Nice that, despite the embarrassment of Cameron and his ilk, even the Americans finally turned and followed suit, along with the French (who, cunningly, were denied a say by their president). I suspect Cameron and Obama are secretly rather grateful for the escape clause and the cunning of the Russians: yet another unpopular, very expensive intervention with the usual unintended consequences has been avoided.

If espionage pushes this along a bit, all to the good.

[Anonymous Coward]

Many years ago I wrote to GCHQ after leaving a certain large outsourcing company (clue cyberdyne systems) because I got fed up of their lax security think "drive a truck through it from home" even though they had just got ISO27000, erm, and I suppose the fact that they employed me in the fist place (non-SC/DV, no official secrets act)... they didn't even bother to ask what I thought the problem was, and let me put it this way: it would have been ***special*** if those systems had been compromised. One presumes it's all sorted now though.

[Destroy All Monsters]

You mean "ISO 27001" (Requirements for the Information Security Management System).

[Anonymous Coward]

@Destroy All Monsters

trust you to go one better

[Anonymous Dutch Coward]

Or even 27002.

[Destroy All Monsters]

You can't get certified against 27002 as it's just a collection of "best practices", not requirements (as is 27001)

[amanfromMars 1]

Optional ZerodDay Dreaming ... for the Fundamentally and Mentally Ill and Deluded

One presumes it's all sorted now though. .... Anonymous Coward PostedFriday 20th September 2013 15:25 GMT

Yes, of course it is. Everything is rosy in the Perfumed Gardens of Eden and Wet Fields of Dreary Dreams, AC. The Bods and Boffins of GCHQ have Everything under Parliamentary Control.

[Pseu Donyme]

A crime, plain and simple.

[Captain DaFt]

Tch

All this bantering about of... that word.

What would Douglas Adams say?

(It was either rant about the continuing erosion of rights and trust by the "Five Eyes", or attempt to inject a spot of levity. It's Friday, dammit!)

[tom dial]

I cannot imagine why anyone would think an agency such as GCHQ that is tasked specifically with information collection and intelligence production would refrain from carrying out its mission. Nothing in the story or slides except possibly the detailed target names should be a surprise. Those who carried out the exploits did what they were supposed to, apparently with fair success, and are not, at least in the UK (and US, Canada, Australia, and New Zealand) guilty of any crime for that, although they might be advised not to visit Belgium. As for whether allies spy on each other, it may be worthwhile to consider the case of the Israeli spy Jonathan Pollard, who will be eligible for parole from a US Federal prison in 2015.

[asdf]

>and are not, at least in the UK (and US, Canada, Australia, and New Zealand) guilty of any crime

Almost all western countries have laws against entering computer systems without authorization. Perhaps pulling the terrorism card can get you into grey area land legally but as others have said its still a crime to any reasonable person. Also the well everyone does it is usually not a very sound legal defense. If they would have gotten a warrant or equivalent from the Belgium government it would be a different matter entirely.

[Anonymous Coward]

So the GCHQ used some kind of Phishing attack this time?

Unfortunately about the only new twist on this avalanche of NSA/GCHQ stories.

I wonder if all the packet sniffing and "malware for freedom" significantly increases latency through these cables. I have to think that more agencies than gchq are picking on Belgacom.

[Lars]

Whistleblower

Years ago there was a guy who worked at Alaska Airlines in the technics group and relived to the authorities that the company was cheating badly on repairs. Before anybody responded people had to die. This guy had to suffer by the company he worked for as a whistleblower. But would you not agree that he did what we hope and wish anybody, with that kind of information would do.

Lets have a look at what Wikipedia has on this.

"A whistleblower (whistle-blower or whistle blower)[1] is a person who exposes misconduct, alleged dishonest or illegal activity occurring in an organization. The alleged misconduct may be classified in many ways; for example, a violation of a law, rule, regulation and/or a direct threat to public interest, such as fraud, health and safety violations, and corruption. Whistleblowers may make their allegations internally (for example, to other people within the accused organization) or externally (to regulators, law enforcement agencies, to the media or to groups concerned with the issues)."

And:

"The Continental Congress enacted the first whistleblower protection law in the United States on July 30, 1778 by a unanimous vote."

Note how there is nothing about whistleblowing the State, the Government. Personally I think they never thought it would be necessary. or most likely, it never entered their minds at all. (absolutely no knowledge on this).

Anyway, to day, we have Governments (by the people too) who break the law, deny they do it, make secret laws to make more secret laws. Call it what ever you like, Nazi or Communist, it is always the same.

Sorry for the last sentence, but would it not be possible to have a law making any secret laws moot. Any use of any secret law to be against the law. Could be interesting.

Anyway, eventually, trying to came to my point is that we should be obliged to report any wrongdoings by our governments too. And finally, Snowden is just the postman.

Sheep we are, counting sheep and falling a sleep all the time, ever and ever.

[Don Jefe]

The worst part is that Snowden was portrayed as a traitor. Who in a rush for fame had bypassed the Whistleblower procedures of the Federal Government.

The truth is that government contractors (in the US) don't qualify for Whistleblower status and even if they did, the Whistleblowing policies never apply to sensitive or classified information or programs.

Snowden did the only thing he could. Twelve years of silence by 20,000+ other employees and two Presidential Administrations and only one person chose to lose everything and tell us what was really happening.

A democratic government cannot function unless the people have awareness of the facts on which to base their decisions. Hiding information or deception is not empowering the people and it is no longer right to call it a free society. It is a managed society.

[Matt Bryant]

Re: Don Jefe

"....Snowden did the only thing he could...." Sorry to disrupt your little hero worship session, but that's complete male genetalia. As he admitted to the Chinese press, Snowjob deliberately signed up with the intent to commit treachery. He then could also have chosen to take his knowldege to plenty of politicians and journalists in the States that would have broadcast his info widely and used him at Senate hearings and the like. Instead, Snowjob chose to make money off his treachery by selling his info via Greenwald and Poitras (and now no doubt through his "friendship" with Dickileaks). Snowjob did not do the only thing he could, he did the thing that guaranteed him fame, noteriety, and a cheque or three.

[Don Jefe]

Re: Don Jefe

Matt, for a fellow who derides any sort of proof of anything, it is extraordinarily strange that you cite Chinese media as a good source of information.

[Matt Bryant]

Re: Don Re: Don Jefe

"....derides any form of proof....." Er, what proof? All you have is conjecture. You do understand the concept of circumstantial evidence, right? It may be a very strong indicator but it is still NOT proof.

"....you cite Chinese media....." Ooh, is that some racist insistence that only white, Western reporters are to be trusted? Not very progressive or liberal. Or just the usual sheeple denial that any source that does not align perfectly with your baaaah-liefs has to be ignored? If you wish to discredit the South China Morning Post article (www.scmp.com/news/hong-kong/article/1268209/snowden-sought-booz-allen-job-gather-evidence-nsa-surveillance) then please do supply a bit more meat to your argument.

[Anonymous Coward]

Re: Don Don Jefe @Matt Bryant

Well then Matt, can you be clear about what you would accept as proof. When does circumstantial evidence become proof.

We'd like to know.

[Matt Bryant]

Re: Don Don Jefe @Matt Bryant

"....When does circumstantial evidence become proof....." When it stands up to professional examination in a court of law, rather than the shrieking court of sheeple opinion.

[Bernard M. Orwell]

Re: Don Don Jefe @Matt Bryant

So, by your standards then, this...

"Well, the first obvious pointer is that Snowjob did not spread his info out as widely as possible and all in one go, instead it has been drip-fed out mainly by Greenwald for obvious Guardian profit. From there you have to ask how is Snowjob paying for his upkeep seeing as his US accounts have been frozen? Gee, do you maybe think he's taking cash payments from at least the Guardian? And then there are his continual interviews with papers which are nothing more than lifestyle pieces - they display his narcissism."

Is not evidence, but is merely shrieking of a different flavour? Conjecture, just like the rest of us.

[Matt Bryant]

Re: Don Don Jefe @Matt Bryant

"....Is not evidence...." Snowden's choice of running off abroad very publicly, rather than staying in the US to push his info through the courts, is a fact. His decision to use Greenwald as a commercial outlet, rather than giving it free to Cryptome or even Dickileaks, is also a fact. You, on the other hand, seem rather short of facts, chap.

".....merely shrieking....." More chuckling, thanks.

"...Conjecture, just like the rest of us." No. You see, any conjecture I make is based on proven facts, such as Snowden's cash having been frozen. Your bleating is purely based on conjecture, and often easily debunked due to the lack of any factual foundation. Big difference, little lambkins.

[Bernard M. Orwell]

Re: Don Jefe

"Instead, Snowjob chose to make money off his treachery by selling his info via Greenwald and Poitras (and now no doubt through his "friendship" with Dickileaks). Snowjob did not do the only thing he could, he did the thing that guaranteed him fame, noteriety, and a cheque or three."

And where is YOUR proof, Matt Bleaty? Can you even come up to your own standards?

No.

[Matt Bryant]

Re: Boring Bernie Re: Don Jefe

"....where is YOUR proof....." Well, the first obvious pointer is that Snowjob did not spread his info out as widely as possible and all in one go, instead it has been drip-fed out mainly by Greenwald for obvious Guardian profit. From there you have to ask how is Snowjob paying for his upkeep seeing as his US accounts have been frozen? Gee, do you maybe think he's taking cash payments from at least the Guardian? And then there are his continual interviews with papers which are nothing more than lifestyle pieces - they display his narcissism.

A true whistleblower cares about what he is revealing rather than personal glory, a good example being Perry Fellwock? "Perry who?" you say. Fellwock revealed the existence of the NSA. He didn't go on a World tour, or deliberately get a job with the intelligence services with the aim of committing treachery for cash, he simply said his piece, got the information to the right people to bring it to court via US Senate Church Committee, and then was content to fade into the background. W. Felt, AKA "Deep Throat", was content for his identity never to be revealed. Felt finally only confirmed his identity as "Deep Throat" thirty years later in order to help pay for his grandchildren's education. Snowden is probably just eager to keep paying for pole dancers.

[Bernard M. Orwell]

Re: Boring Bernie Don Jefe

Good points, well made, gets an upvote from me Matt.

I'd not heard of Perry Fellwock, so you're quite right there and the fact that Snowdon has an exclusive deal with only one news outlet might well be suspect.

I'm not sure I'd call it anymore evidential that some of the posts that disagree with you, but its enough to make me raise an eyebrow and go and do some more research.

[Matt Bryant]

Re: Boring Bernie Re: Boring Bernie Don Jefe

"....you're quite right there...." Blimey! <Checks for flying pigs> I think I'll go buy a Lotto ticket!

[WatAWorld]

Don't buy Chinese unless you want to be spied upon said the USA.

The USA has long advocated we blacklist China from communications projects because China might do what the USA and UK did.

We had House Intelligence Committee Chairman Rep. Mike Rogers traveling the world urging companies not to do business with the Chinese telecommunications giant Huawei as a matter of national security.

From news section of The Canadian Broadcasting Corporation:

http://www.cbc.ca/news/politics/canada-at-risk-from-chinese-firm-u-s-warns-1.1213967

"Allowing Huawei near any part of that network, says the chairman of the U.S. Intelligence Committee, could be courting disaster.

"This is your personal data. This could be your medical records, your financial records, everything that you hold dear that you think is locked away in a safe place on your computer…" The key word there is new secure network; I would not have the faith and confidence." Rogers says the information about Huawei gathered by his committee "puts at risk consumer data, and puts at risk security interests certainly of the United States, and I would argue of Canada as well."

Another quote from another American, Michelle K. Van Cleave:

www.cbc.ca/news/politics/chinese-firm-s-canadian-contracts-raise-security-fears-1.1157281

"The former head of U.S. counter-espionage says the Harper government is putting North American security at risk by allowing a giant Chinese technology company to participate in major Canadian telecommunications projects.

"In an exclusive interview in Washington, Michelle K. Van Cleave told CBC News the involvement of Huawei Technologies in Canadian telecom networks risks turning the information highway into a freeway for Chinese espionage against both the U.S. and Canada."

So the USA should understand when we blacklist them.

And imagine the outcry in the USA if we did this to them.

They would be screaming, recalling diplomats, canceling trade deals, and increasing the rate with which the violate trade agreements they signed with us.

Only the USA has the budget, morality and easily subverted head offices that allow it to subvert so many suppliers.

The EU has no choice. The EU must simply blacklist US-based companies from bidding on communications contracts. We need EU-based suppliers at any cost.

Otherwise the EU and national governments might as well give up on security and go with the low bidding Chinese suppliers.

[Anonymous Coward]

Imagine the outcry if an EU nation did this to the USA

Imagine the outcry in the USA if we did this to them.

They would be screaming, recalling diplomats, canceling trade deals, and increasing the rate with which the violate trade agreements they signed with us.

Only the USA has the budget, morality and easily subverted head offices that allow it to subvert so many suppliers.

[Don Jefe]

Re: Imagine the outcry if an EU nation did this to the USA

The US couldn't do what it does without the greed of the UK opening the doors for them. The US is absolutely wrong in what they are doing, but the UK isn't only not stopping them, they are actively helping...

[amanfromMars 1]

Know your Friends ..... They could be the Enemy

Regarding whistleblowers/Snowden Asylum Seeker type systems admins, does the EU have a rewarding take upon the practice .......

3.3. Whistle-Blowers’ Protection and Incentives

Recommendation: Systematic protection and incentives for whistle-blowers should be introduced in the new Regulation. Whistle-blowers should be given strong guarantees of immunity and asylum, and awarded 25% of any fine consequently exacted. The whistle-blower may have to live in fear of retribution from their country for the rest of the lives, and take precautions to avoid “rendition” (kidnapping). Ironically, US law already provides rewards of the order of $100m for whistle-blowers exposing corruption (in the sphere of public procurement and price-fixing).

And as for the Convenience of Cloud in Computing and for Commerce, it is quite vital that one knows what one is doing, and what can be done by others in that realm, for IT is easily abused to server valuable personal and private/professional and pirate base metadata/rich mineable semantic content to whoever would have a foreign intelligence interest and a want and/or need to know to gain and/or maintain and sustain an inequitable competitive advantage/artificially rigged dominant position, which is always a very precarious and perilously dangerous position to put oneself in, for it is an indicator of a lack of necessary natural leading intelligence supply in-house for internetworking services provision …… and in the virtual machine world/AI field, internetworking server provision. The position and weakness though is not unrecognised ……

Data can only be processed whilst decrypted, and thus any Cloud processor can be secretly ordered under FISA 702 to hand over a key, or the information itself in its decrypted state. Encryption is futile to defend against NSA accessing data processed by US Clouds (but still useful against external adversaries such as criminal hackers). Using the Cloud as a remote disk-drive does not provide the competitiveness and scalability benefits of Cloud as a computation engine. There is no technical solution to the problem.

Exposing data in bulk to remote Cloud mass-surveillance forfeits data sovereignty, so confining data to the EU is preferable pending legal solutions. Although NSA has extensive capabilities to target particular systems inside the EU, this is harder and riskier to do. However basic reforms to the new Regulation are needed, otherwise in practice these two situations will be treated as equivalent, and Cloud business will go to lowest bidder.

Although an EU-based company transacting in the US is also subject to conflicts between EU DP and the FISA law, in practice it is less likely they will be served with such secret orders, because the legal staff and management would be more likely to resist, and as EU-nationals are less threatened by US espionage laws. “Clouds” can be confined to a location, and arguments this would “balkanise the Internet confuses issues of censorship with the problem of keeping data private. ….. The US National Security Agency (NSA) surveillance programmes (PRISM) and Foreign Intelligence Surveillance Act (FISA) activities and their impact on EU citizens' fundamental rights

[Potemkine]

With friends like this you don't need enemies

UK going out the EU would be a good start, we do not need this US trojan horse inside the Union.

[Intractable Potsherd]

Re: With friends like this you don't need enemies @Potemkine

That is a worryingly accurate statement. I'm a big supporter of the EU, and had not considered the risk the UK presents to it. I might need to start persuading my wife it is time for us to move to her native (EU-member) land, and then support the loons that think the UK will be better off out of the EU ...

I wish I was being sarcastic, but I'm not.

[amanfromMars 1]

Special Office of CyberIntelAIgent Security ...... AI.Govt Wild LOVEChild with All the Graces

I cannot imagine why anyone would think an agency such as GCHQ that is tasked specifically with information collection and intelligence production would refrain from carrying out its mission. …. tom dial Posted Friday 20th September 2013 19:30 GMT

The universal ubiquitous lament is that the product they provide and tacitly support such an ignorant destructive and arrogant sub-prime loss leader. And that can only be as a direct result of the collection of dodgy information and the turning of it into crappy intelligence to fit a failed narrative which does not bear smart scrutiny for viable equitable creative continuity in the Bigger Picture Fields that IT and Media be floating it into as a reality to be embraced and endured/built upon.

And their Virtual Reality skillets are a disgrace to the nation ….. however, looking on the bright side of that current catastrophe, which some would say amounts to intelligence fraud being perpetrated on human assets, it does of course provide an opportunity for more competent and switched on to the future needs of a creative peaceful society services and computerised servers to take over global programming provision with new and novel sources of entirely different phorms of intelligent intelligence product, which strengthens and expands ITs influence sublimely and benignly rather than causing conflict and mayhem in bouts of shared madness, which does appear to be the all too likely present state of such crazy affairs, portrayed and pimped by media as current world news.

Real Smart IT and Virtually Clever TV and Audio it aint …… Fix it. Step aside and let the CodeXSSXXXXperts in to do their Future Failsafe Virtual Reality thing, for they cannot be stopped and to think to hinder them for any wrong reason is to indelibly mark oneself and single oneself out for the special attention of their security forces, and believe me and heed this friendly advice, you definitely don't want to see them as, or make them your enemy for they can easily program themselves to not take any prisoners, and answer to no one.

There are no finer friends though, and there is nothing that they cannot nor will not do for them whenever required …. or even as they feel might be just a good thing and give them and their friends, the simplest of complex pleasures.

[Jellied Eel]

Want to gain access to a GRX core router?

Buy a connection and peer with it. It's how GRX exchanges usually work.

Der Spiegel doesn't appear to have asked anyone in industry about this or their previous article. Belgacom doesn't own (many) submarine cables and the ones listed are consortium or 'club' cables. Telcos invest in those in exchange for capacity and other perks like controlling the landing stations, and thus making money off backhaul sales. Having rights to a percentage of the capacity doesn't automatically mean access to SLTs or muxes that would give potential access to other member's capacity.

[Matt Bryant]

Re: Jellied Eel Re: Want to gain access to a GRX core router?

"....Having rights to a percentage of the capacity doesn't automatically mean access to SLTs or muxes that would give potential access to other member's capacity....." True, but it depends what info you are after. Remember, the targeting info for PRISM was based on connections, i.e., who did Achmed call and when? I would suspect the primary target would be the billing systems where this data is held, rather than the cables themselves. The cables can be physically tapped as required, but the billing system data would probably be of greater interest in telling the spooks where to go look. And even if it was compartmentalised it is likely to be on virtualised systems, so hacking the core system would lead to accessing the shared network links and shared storage links all the virtual instances use. There's no need to hack every VM if you can peek at the data going through the physical cards, and hiding in the VM underneath would probably draw less attention than hacking into every billing VM.