The GCHQ (British Government Communications Headquarters) used fake LinkedIn and Slashdot to hack Belgacom, OPEC & others GRX providers.
According to the German weekly news magazine Der Spiegel the British signals intelligence spy agency has again adopted a “quantum insert” technique to target employees of two companies that are GRX (Global Roaming Exchange) providers. The companies attacked by intelligence agents are Comfone and Mach, this second one was recently acquired over by Syniverse, consider that the number of GRX providers globally is nearly two dozen.
A GPRS roaming exchange (GRX) operates as a hub for GPRS connections from roaming users, it was mainly designed to facilitate a more efficient way for operators to interconnect networks while users roam around the globe.
There are only around two dozen such GRX providers globally. This new attack specifically targeted administrators and engineers of Comfone and Mach (which was acquired over the summer by Syniverse), two GRX providers.
The revelation was made by the journalist Laura Poitras accredited as one of the professionals that have access to the documents leaked by former National Security Agency contractor Edward Snowden, intelligence experts do not exclude a link to the attack against another GRX provider, the Belgacom International Carrier Services that is a subsidiary of Belgacom.
The German magazine Der Spiegel reported in September the responsibility of GCHQ for the malware based attack against the major Belgian Telco, the new magazine cited top secret documents from the Government Communications Headquarters (GCHQ) that explicitly refers the operation codenamed “Operation Socialist”.
The British Government Communications Headquarters (GCHQ) used spoofed versions of LinkedIn and Slashdot pages to serve malware and infect victims, a similar attack was conducted against nine employees of the Organization of Petroleum Exporting Countries (OPEC). Just a few days ago I remarked the strategic importance of social media for intelligence analysis and to arrange targeted attacks.
Operation Tempora has been going on for at least 18 months, British intelligence adopted “intercept probes” to intercept a huge volume of data from transatlantic fiber-optic cables
“The GCHQ mass tapping operation has been built up over five years by attaching intercept probes to transatlantic fibre-optic cables where they land on British shores carrying data to western Europe from telephone exchanges and internet servers in north America.”
To better understand how it is possible to exploit the vulnerabilities of GRX give a look to the following presentation made by Phillippe Langlois, the founder of P1 Security.
(Security Affairs – GCHQ, Surveillance)
