Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
JACK: [MUSIC] It’s naïve to think that nations aren’t spying on each other, like deploying secret agents in each other countries. But in the modern times we live in, when nations rely so heavily on computers to store communications and data, that spying is now done online. Governments train people to become elite hackers, to break into networks of other countries and snoop on their e-mails and databases. You see, in cyberspace, the rules are unclear on what one nation can do to another. The geographical boundaries are unseen and the attacks go undetected. Even if you see an attack, it’s almost impossible to know who did it. Nation state cyber-attacks intent on spying are covert and silent. The malware they use can be sitting inside the network of targeted industries and organizations for years before they’re found.
That’s if they’re ever found at all; in that time, they are collecting data, spying on their targets before quietly leaving with their surveillance gear intact. Or at least, that’s what’s supposed to happen. This is the story about one of the most advanced malware toolkits ever found and how one country used it to break into a global telecom provider. It’s a story that attackers didn’t ever want you to know about. This attack and the malware and mission required a ton of resources to carry out, resources that only a nation state could provide, such as a team of extremely talented hackers, access to exploits that no one else had, and the motivation to infiltrate a company to steal secret information. This is the story of Operation Socialist.
JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: This story begins with Belgacom. It’s actually now called Proximus Group now, but the story takes place when it was known as Belgacom. Belgacom is an international telecoms company based in Belgium. It provides mobile and internet connections and solutions for consumers and other mobile networks internationally. Over 15,000 staff, over five million mobile customers, and 1.5 million internet clients. Belgacom is a big player in the world of telecommunications. In fact, it’s the largest telecom company in Belgium. [MUSIC] With Brussels being the primary location of Europe’s political bodies and Belgacom headquartered in Brussels, you start putting two and two together pretty quickly. Chances are, a lot of Belgium’s top political leaders use Belgacom for their internet and mobile services.
The client list of Belgacom includes the European Parliament, the European Council, the European Commission, but Belgacom didn’t just provide mobile and internet connections; their services also include wholescale solutions for voice and mobile data services worldwide. In fact, they have another company called BICS which is the Belgacom International Carrier Services and it provides data for 1,000 networks including 370 mobile network providers. Basically, telecom companies in other countries can use Belgacom’s network to rebrand it and sell it as their own network. If you think about how many text messages, phone calls, and all the internet usage that go over Belgacom’s network, that becomes kind of an attractive target for hackers. On June 21st, 2013, the IT security team at Belgacom headquarters in Brussels noticed their e-mail server was malfunctioning.
Staff weren’t getting their e-mails. This had happened a year before; a short period of instability that they put down as a technical fault. Probably the same again, they thought. Still, they needed to check it out to be sure but there was no technical fault on their mail servers. What they found were traces of malware. [MUSIC] A malware attack that had infiltrated their networks is a disaster for a company like Belgacom, one [00:05:00] which could cost them millions of dollars, never mind their reputation. The head of security immediately called Fox-IT which is a security company in the Netherlands which has the reputation of doing incident response. Within a few days, the team at Fox-IT were there at Belgacom investigating the malware. They realized this wasn’t your ordinary, run-of-the-mill malware.
You see, there are three main categories of attacks; first you’ve got your typical spray-and-pray kind of attack. This is where someone scans the whole internet looking for any vulnerability to exploit and not really caring who the target is; just see if they can get into anything. Then you’ve got your targeted attacks. These are people who want to gain access to a specific company or person and they’ll try to craft exploits that work specifically for that target. But if they can’t get in, they sometimes run out of resources and stop. But then there are the APTs, or Advanced Persistent Threats. This is an attacker who is much more sophisticated. They have better malware, a vast amount of knowledge, a lot of motivation, and a specific objective in mind, and also considerable resources. They might have a team of coders and electrical engineers to all assist with the attack.
When Fox-IT investigated this malware, they thought they had an APT on their hands. This was a very sophisticated attack which required years of research to conduct and carry out, something that not many hacker groups in the world could accomplish. What’s worse for Belgacom is that this malware was not like anything the security teams had ever seen before. They were baffled; what is this? How did it get in? What was it trying to do? Over the next two weeks, they worked together to try to find out exactly what was going on. Belgacom had been hacked. They knew that, but how bad were they hacked, and for how long, and by who? Initial investigations found a program that installed the malware on their networks; a dropper. A dropper is sort of like sticking your shoe in the door of a building. If you can get just your toe in the door, then you can get your whole foot in and open the door and get in yourself.
A dropper lets the malware into the computer. What’s weird though is that this was done in stages, a little bit at a time, hiding the evidence across multiple data files. Once it was all there and installed, it deleted itself and left no bread crumbs behind which would give the hackers away. This process of hiding evidence is scary to me. It essentially wipes the logs that indicated anything was ever installed, so investigators would have a really hard time detecting this and looking back to see what was done. Like, who does this? Someone who doesn’t want to be caught, that’s who. Amateurs leave tracks behind, but professionals, they don’t leave anything. [MUSIC] Analysis found the malware had started to install at the end of 2010 to early 2011. Out of the 26,000 systems that were in Belgacom, only 124 were infected with this.
These include their e-mail servers, some network devices, a few SharePoint servers, and about seventy individual employees’ workstations; like, their sysadmins who had pretty much access to everything. It was looking like this malware was brand-new, not known by any antivirus company, and was exploiting fully up-to-date software. It meant that the bugs weren’t even known to the software companies themselves. Thoughts were quickly turning as to who might be behind this attack. Who’s capable of designing such a sophisticated malware? Among the many known hacker groups, even individual hackers who are skilled in coding, this malware was on another level. They concluded it was most likely designed and implemented by a nation state actor either from within another government itself or from a group that was funded by a government. Highly-advanced coding, very advanced installation, technically skilled operations, and stealth-like ability to hide for long periods of time.
On June 19th, they filed a complaint with the Federal Public Prosecutor in Belgium. They told them they had been a victim of an advanced malware cyber-attack. The attack, they said, was using malware, they believed, that might be nation state-sponsored. When a company discovers they have been the victim of a cyber-attack, they need to go in their networks and clean it up as soon as possible but part of that process is the analysis and investigation of the malware to identify what it is and what it’s been doing. This has to be done properly which can sometimes mean not letting the hackers know you found them. The internal clean-up of Belgacom’s systems had to be done in secret, strictly on a need-to-know basis to find out just how extensive this attack was and make sure their clean-up operation got it all. What they were doing could not get out.
For two long months a select team of two hundred Belgacom staff worked around the clock to address the multiple issues this attack had created. They had technical staff, lawyers, supply chain specialists, and they all came together to formulate a plan of action. [MUSIC] [00:10:00] There was an internal crisis team to manage the investigation into the attack. Coordinating with outside agencies included state security and federal and regional computer crimes units. Legal advisors were needed to advise on the legal ramifications of the attack and potential options open in finding those responsible and holding them accountable. They wanted to kick these hackers out of the network once and for all and if the world knew about this plan, then the hackers might change their tactics entirely. For forty-eight hours across the weekend of September 14th and 15th in 2013, their clean-up plan was put into action.
Because this attack had infected their network to the very core, they replaced a ton of Belgacom’s network devices and their systems and they reconstructed their servers and installed all-new computers. I mean, after all, one of the safest ways to know a hacker’s gone completely is to get a new computer, right? At that time the investigation and security teams were still trying to identify how many systems were infected and what the malware did. Two days after this mammoth clean-up weekend, security detected another attempt to hack into their system. A router within their international division started malfunctioning and throwing alerts. Analysis indicated this was another attack but it seemed this time they were able to prevent it and block it from getting any further access. Only then, once they were confident that the networks were clean, could Belgacom publically release this information that they were victim of a cyber-attack.
On September 16th they issued a press release. They kept it very brief; they played down the attack. Routine checks had detected a digital intrusion in the internal IT systems via an unknown virus but this has been fixed after cleaning up the entire system with no indication of a breach affecting their customers or their customers’ data. They wanted to reassure their clients that their data was safe and the company was adequately protected from cyber-threats. Unknown to them, just days later after the attack, an explosive allegation of who was behind this was about to hit the world’s press. [MUSIC] There’s another character in this story, someone you may have heard of. His name is Edward Snowden. He was a CIA analyst and then an NSA contractor. With his inside access, he downloaded over one million files from the NSA databases in late 2012.
He flew to Hong Kong and then to Russia in June 2013 which was the same time Belgacom found out they were attacked. Snowden was releasing some top-secret documents to journalists. This Snowden leak became a big deal. Some of the documents that Snowden leaked talked about the operations going on in GCHQ. GCHQ, or the Government Communication Headquarters, is like the NSA but in England. Just think about how advanced the code-breaking capabilities were for England in World War II, right? I mean, they broke the Enigma Code. Yeah, well, the GCHQ has been involved in code-breaking and deciphering covert signals all the way back to World War I. They have generations of expertise all at collecting transmissions and deciphering them. Of course, being in the modern world we are in now, that expertise carried over into the online world so GCHQ naturally is a very capable hacking group in the world.
In June of that year, when Edward Snowden leaked information, in that leak it said that GCHQ allegedly was tapping fiberoptic cables to collect and store e-mails, social media posts, and internet search histories, and sharing this data with the NSA. This doesn’t exactly say GCHQ hacked into Belgacom, just that they were tapping going on a general. Snowden’s leaks also said the US government spied on thirty-eight foreign embassies using electronic surveillance and they bugged European Union offices in New York, Washington, and Brussels. As the Belgacom team read these reports and was learning more about the capabilities of the GCHQ, they started to put in the back of their head; is it possible that the GCHQ is who hacked into Belgacom? Five days after Belgacom’s weekend clean-up and three days after their press release, the fortieth leak from the Snowden archive was published. It centered on Belgacom.
[MUSIC] German online magazine Der Spiegel published that they had seen the documents from Snowden. They said the cyber-attack on Belgacom was carried out by Britain’s GCHQ using technology from the NSA called Quantum Insert. For Belgacom to see this Snowden leak which not only says that GCHQ was targeting Belgacom, but also to learn that they used Quantum Insert to do it with? This was a very shocking revelation. I’ll get to what Quantum Insert is in a little bit but Belgium and Britain are friendly nation states. They’re both members of the European Union. What was one doing spying on the other? This wasn’t [00:15:00] government spying on government; it was one government spying on a company in another government. I mean, this is equivalent to having secret agents deployed into Belgium, break into the Belgacom offices, and steal a ton of documents on users.
This was not right. The documents that Der Spiegel posted showed an internal classified GCHQ presentation, like a PowerPoint presentation. In this presentation, it talked about the attack on Belgacom and the GCHQ called this attack Operation Socialist. With an objective to increase exploitation of Belgacom and understanding of their infrastructure, the British spies had logged it as a success. Whatever it was they went in to do, they did it, but they were caught on the way out. Telecom companies are used to threats and attackers trying to break into their network all the time. They’re high-profile targets because getting into one of these gets you access to a lot of people’s data. They manage extensive communications, infrastructures, and hold huge amounts of sensitive user data. They have a highly-secured environment with skilled IT teams to defend their network and respond to any vulnerability.
They’re pretty tuned into the many ways cyber-criminals might try to get into their systems. But trying to defend against the GCHQ or NSA, they really need to be on another level for that. Apparently, they weren’t ready for such an attack and I don’t blame them; trying to defend against attackers like this is extremely difficult, if not impossible. For the hackers, when standard phishing attacks aren’t effective, another method needs to be done in order for the malicious software to get onto those systems. The GCHQ had to first think of a way to get this malware onto Belgacom’s network. There are two big steps to any attack; first is getting the malware onto the network and then taking action on it once it’s in. To get the malware onto the network, they decided to use a tried-and-true tactic which I call the old switcheroo, but this was a switcheroo unlike anything I’ve ever seen before.
[MUSIC] Now, I should say all this is how GCHQ allegedly hacked into Belgacom’s network. See, there’s different sides to this story. There’s the Belgacom side and what they published and then there’s the Snowden side and what he published, and then there’s also a bunch of security researchers that tried to figure out what was going on here, too. We only know about this part because of what Snowden leaked and I don’t think any other documents back this up. The GCHQ knew the system administrators at Belgacom would visit LinkedIn sometimes so they decided to pull the old switcheroo on their LinkedIn. They built a fake LinkedIn site, an exact replica of the real one, and they wanted to get the system administrator to visit it. Yeah, they could have sent a phishing e-mail saying something like hey, we met at this conference last week; can we connect on LinkedIn? Then there’s a link that takes them to the fake LinkedIn site.
But that wasn’t going to be good enough because if the system administrator saw this was a fake LinkedIn site, the whole plan would have been ruined. They needed something much, much more clever and what they used was a technology that the NSA developed called Quantum Insert. This Quantum Insert is amazing. Allow me to geek out on it for a moment. First step is to clone the LinkedIn website and that’s not so hard; with the right software, it’s a few keystroke commands and you’re done. Then you need to put malicious software on this cloned website so if someone visited it, they would be infected. The only complicated part about this step is to know what version of software your target is running so you can exploit their machine if they visit the link. But once you know that, this step is easy, too.
But here’s where things get crazy; if the hackers had access to a router in between the victim and LinkedIn, then the hackers could then see that web traffic between the victim and LinkedIn. What Quantum Insert does, is it uses that router to split the request to LinkedIn into two separate requests; one going to the real LinkedIn site and the other going to this fake LinkedIn site that the hackers own. What has to happen for the attack to work is that the fake LinkedIn site has to respond quicker than the real one which then delivers the malicious software to the victim’s machine who’s none the wiser because there’s literally no way they can tell it’s not the real LinkedIn site. The URL says LinkedIn, the SSL cert is signed, the site looks like LinkedIn. Even all their friends and posts are there. It’s just, this rogue website injected some malicious software into the real one by splitting the traffic at the router. It’s really quite incredible.
This is sort of like a man-in-the-middle attack but it’s also a timing attack because the fake LinkedIn site has to respond quicker than the real one and then rejoin the data in the data stream as the user requested it. The malware had to have taken at least a year to create and this is on such another level that I can barely understand how it’s physically possible. But again, in order for this to work, the attackers need access to a router between the victim and LinkedIn, so you might be wondering how does the GCHQ control any router between an admin at [00:20:00] Belgacom and LinkedIn? Well, they might not, but the NSA probably does. See, LinkedIn is an American company so probably, the traffic has to travel through the US, right?
The leaked documents from Snowden show the NSA does control some internet backbones and routers so it’s possible that the NSA helped the GCHQ conduct these attacks to get the initial access. Or maybe it’s possible that Belgacom first hops over to UK before going undersea to the US to get to LinkedIn. If that’s possible, then GCHQ might be controlling a backbone router in the UK somewhere. Like I said, this is sort of a man-in-the-middle attack but actually, some call it a man-on-the-side attack, where the attackers can read and add new messages into the communications between the user and the legitimate web server. For this to work, they use something called a Quantum Server which is just a web server that has an extremely fast response time so that it can get the web traffic there before the legitimate server does. This is what I mean by how sophisticated of an attack this was. You need to have control of a backbone of the internet to carry this out and that’s just to phish the user; we haven’t even gotten to the malware yet.
[MUSIC] Belgacom is a company that’s 53% owned by the Belgium government. This made them extra-keen to find out who had targeted the country’s biggest telecoms company. Belgacom had informed the authorities as soon as they found the malicious software on their systems. Belgium’s Secret Service, their federal police, their military intelligence, and their computer emergency response team came together to investigate this attack. They code-named their investigation Trinity. Belgium wanted to send a clear message of anyone thinking of attacking them through cyber-means; they would investigate and track down who was responsible and they would make sure these people were held accountable. But in August 2013, two months after the Snowden leak, suddenly all the malware that infected Belgacom started deleting itself. Someone hit a kill-switch and was removing the malware from the network and all traces of it, but the Belgacom security team had made copies.
They discovered the data extracted by the malware had been exported from their internal computers out to outside servers, servers they were confident were controlled by the hackers. Naturally, they followed this trail. It seemed, through the IP addresses of these servers that they discovered, these were rented under fake names and addresses and they were registered in the UK to what they thought were front companies. The payment details for renting the servers were from cards issued from the UK but when they checked out, the pre-paid cards issued to anonymous buyers, making whoever rented these servers impossible to trace. The Trinity team are the Belgians that were investigating this malware. Since the road to tracing it led to these servers in the UK, they approached the British Home Office to ask them to help investigate this.
They wanted to know more details about these servers so they could potentially identify the hackers but the British Home Office responded to the Belgians by saying quote, “We have decided to refuse this help. The United Kingdom believes that this could jeopardize our sovereignty, security, and public order.” End quote. Whoa. [MUSIC] It was soon after these discoveries that Snowden documents were released and the GCHQ were publically accused of being behind this cyber-attack on Belgacom. The documents themselves were not considered useful to the investigation for the Belgian police and that’s because Snowden’s documents were released by the media and not handed directly to the police. The chain of evidence would be difficult to prove.
Belgium was now in a difficult position; they wanted to bring the hackers to justice but if it was the intelligence service of the British, an allied country and fellow EU member, well, that changes the lay of the land more than a little. Suddenly politics get involved and the worry of a diplomatic fallout is [00:25:00] a messy dispute. I mean, what does Belgium do with Snowden? The federal prosecutors actually considered getting Snowden to Belgium from his exile in Russia. The thoughts there were that he could testify about these documents and their authenticity but that would not go down so well with the US because the US wanted Snowden back in the US and charge him for espionage. Then there’s the UK; if Belgium started arresting their spies, that too would have a lot of political blowback. They were gonna need to tread very carefully. Towards the end of 2013, federal prosecutors went to Europol for help but they hit a brick wall.
Europol said they couldn’t investigate other EU member states so that just didn’t go any further because there’s no precedent for this. This was the first known attack ever from one EU member state to a fellow EU member state. It’s not something people knew how to respond to. They were used to a clear enemy state where there’s an obvious good guy and a bad guy but this muddied the water and made it very political. Let me remind you of all the Belgian politicians that may have been snooped on during this attack; wherever these hackers were, they might have gotten an inside peek at Belgian politics. [MUSIC] The Snowden leaks threw the concepts of mass-surveillance into the public realm.
The documents he exposed highlighted covert operations the public were not supposed to know about and they raised a lot of questions, questions on where the line is, where the balance is between covert intelligence through cyber-exploitation and the public’s right to privacy. Not to forget that in the middle of it is the vital role that intelligence plays in keeping our nations safe, protecting us from serious threats both on cyber-space and on the ground. The question everyone was debating was whether this balance had tipped too far and gave the intelligence agencies too much free reign. The cyber-attack on Belgacom caused some serious ripples around the telecommunication industry and it wasn’t just the telecoms community who worried.
REPORTER1: Final story…
JACK: 2014, ten months after the Belgacom and GCHQ leak was published…
REPORTER1: Internet service providers and six countries have filed a legal complaint against the British spy agency the GCHQ.
JACK: A group of internet service providers came together and launched a legal action against the GCHQ.
REPORTER1: Covert mass-surveillance, legal action was taken against the government’s communications headquarters by internet providers of the US, UK, Netherlands, South Korea, Zimbabwe, and also in Germany. GCHQ is accused of using a malicious software program to break into networks and to collect data on users. The decision for court action follows reports of mass government surveillance by American whistleblower Edward Snowden. The UK spy agency has been under mounting criticism for gathering secret intelligence and sharing it with American partner, the National Security Agency.
JACK: They based their case on the Belgacom attack. They said the GCHQ had made it clear that independent operators were targets they could infiltrate, turning those operators into unwitting providers of users’ sensitive data. They were worried that they might have been targeted themselves or that they would be in the future. These organizations referenced the Belgacom attack and they filed a complaint with the Investigatory Powers Tribunal. This is an independent body appointed by the Queen of England herself and deals with any complaints about the UK intelligence community; complaints about MI5, MI6, and the GCHQ. A lot of organizations called these attacks unlawful and destructive. Public outcry came from RiseUp and May First, GreenNet in the UK, Greenhost from the Netherlands, Mango in Zimbabwe, Jinbonet in Korea, and the German hacker collective, The Chaos Computer Club.
Speaking through the civil liberties charity, Privacy International, they said the Belgacom engineers were targeted for intrusive surveillance. These people were not threats to national security; they were tech staff who worked at Belgacom with admin access rights to the networks that GCHQ was interested in. They claimed the actions of the GCHQ were unacceptable and a breach of trust. If an individual had carried out these actions, they’d be looking at a long list of criminal offences. This was the third legal action that Privacy International had taken the lead on against the GCHQ, all based on intelligence operations that were revealed in the Snowden leaks. Belgacom remained in the spotlight and the Belgian authorities were watching with interest on what the result of this legal action was going to be. They would have to wait almost two years for the Tribunal to finish their investigation.
While the Belgian government and federal prosecutors were investigating the attack, the company had managed to clean up their systems and continue with their business. Those involved with the clean-up still had one question; what was the malware that was infected on the Belgacom network and what was it doing? In November 2014, Symantec exposed a serious and advanced malware framework they referred to as Regin, an advanced and sophisticated [00:30:00] malware toolkit believed to be the work of a nation state actor. Kaspersky immediately followed up with a report of their own which is not unusual for security researchers. That’s what they do; they discover and analyze new cyber-threats and they publish their findings but what was unusual about these Regin reports was that Regin was not new. Security companies had been tracking this malware for years and it was used in attacks all over the world.
Within weeks of these publications, Regin was matched with the malware found on the Belgacom systems. [MUSIC] After the Quantum Insert phishing method was done on Belgacom, then this malware was installed on the target’s computers which was called Regin. The malware-scanning website VirusTotal had actually seen this malware as far back as 2009, four years before it was seen on Belgacom. No one really knew what this malware did or what it was about back then. In April 2011, Microsoft suddenly picked up on them and added protection against them in their programs. These were some early samples of Regin. The Regin malware has a trackable history of its attacks. In spring of 2011, the European Commission discovered it had been hacked. It was a sophisticated attack using a zero-day exploit. Multiple systems at the European Commission and European Council were infected before the attack was discovered.
Fast forward two years to 2013 and Belgacom is attacked. Five months later, around November 2013, another attack is discovered but this time it was targeting a Belgian cryptographer and professor, the same guy who figured out the technology behind smart payment cards and still carries out research and advisories on security. All these attacks used Regin. Kaspersky had been tracking Regin ever since 2012; Symantec since 2013, and F-Secure around the same time, too. This malware had been hitting telecoms companies, research institutions, financial institutions, and government agencies across the world in at least fourteen different countries. Afghanistan, Belgium, Brazil, Germany, Russia, Iran, Syria, and India are just a few that have seen Regin. At the same time of exposing Regin in 2014, researchers had seen over one hundred victims.
Almost 50% of the computers known to be infected by Regin were inside internet service providers, most likely because the hackers wanted surveillance on targets who were customers of these ISPs. 28% of the computers infected were telecommunication backbone providers like Belgacom. Their network infrastructure and the data going through them would be very attractive for hackers. Analysis of Regin revealed some similar features to other malware like Flame and Duqu. Flame was a spy tool used to collect data to target individuals and businesses just like Regin did. Duqu was malware that favored hacking the venues of important meetings between world leaders. Okay, so there were similarities between this malware, right? Get this; Duqu is thought to be created by the NSA and Unit 8200 in Israel and Flame is thought to be created by the NSA and GCHQ.
This indicates that there may be a common author in all this malware which could possibly be the NSA. A previous Regin attack going straight for the system administrators of a telecom company had some striking parallels. Kaspersky reported Regin used a payload to steal usernames and passwords of system administrators at a telecom company. They didn’t want to name the company or where in the Middle East, but it seems like access to mobile traffic was the objective. If you dig into these tech reports a little more, you see pretty quickly just how advanced this malware is. Regin is the ultimate hacker’s toolkit. Rather than just a program that can install, infiltrate, monitor, and extract data and then remove itself, it’s built on a more flexible and customizable module system. [MUSIC] It can be added to, changed, altered, all in accordance with what the target is and the objective is.
It’s a framework that can be used to adapt and change however the hacker wants. Regin, it seems, is not just a piece of malware that’s designed to carry out one planned campaign; it’s a platform aimed at Microsoft computers that can be used again and again with multiple modules. Seventy-five modules have been found so far and we’re used to malware coming from cyber-criminals looking for monetary reward to hold data hostage or steal it or sell it, but now we see that some of the most advanced malware is being used to spy on enemy states. Stuxnet proved just how powerful a virus can be if developed by the right people with the skills and resources to do it and Regin is also extremely sophisticated, too. But it’s not designed to destroy; it’s designed to spy, to watch, listen, capture, and remain hidden at all costs. Regin was designed to provide extensive remote control of the target systems.
It can take screenshots, steal files, collect keystrokes, access e-mails, and data from network traffic. Regin also has an unusual ability not common in malware infections; it has the ability to infiltrate [00:35:00] GSM systems which are mobile base stations, giving the hackers control over mobile networks. Potentially, this means they could listen to and record calls and intercept and redirect them. Regin gets in and opens doors to allow different types of attacks to be carried out on the target’s network. It’s a powerful malware kit that not only performs its own actions but lays the groundwork for more specific attacks. We still don’t know what the objective is for this attack but it’s possible that the objective was to attack and gain access to routers in Belgacom’s international networks, to intercept mobile traffic communications going through other nations.
The data they could gain from this added together would give them a pretty good idea of the user and exactly what they were doing day-to-day. Belgacom customers included some fairly powerful people, decision-makers within various European political bodies who all have their headquarters in Belgium, and there were customers in Middle Eastern countries who used the Belgacom international network as a rebranded mobile provider. Regin is delivered in five separate stages. Once activated, they follow on from each other, with each one providing an encryption key to unlock and activate the next. Stage one is the installer, getting the malware onto the target system. Stage two-to-five are fully-encrypted. Just in case security researchers find it, it’s gonna be hard for them to figure out what’s going on here. To understand this malware and to figure out exactly what it’s capable of, you need all five stages in order to decrypt at all. These features were no doubt purposely designed within Regin.
Remember, a primary objective of this malware is to remain hidden and not leave any trace of its presence. The creators need it to be impossible to crack and must not, under any circumstance, be trackable back to who created it. Many extra safeguards were put in place with this malware. Extreme care was used when building it. [MUSIC] Once malware is inside a target system, it needs a way to communicate back to the hackers and pass them the data that it finds. This is usually done by a command and control server that’s controlled by the hackers. Elaborate communications are set up for the infected machines to report back to the attackers through these command and control servers but instead of direct communications like usual, the infected systems talk to each other first on the network and then through a central hub which then communicates back to the command servers.
Regin hides the data and the extended attribute section within a packet, splitting its data across multiple packets to hide what’s being stolen. This makes it really hard to spot the data being stolen since it’s encrypted, it’s in the section of a packet you don’t normally look for, and it’s broken up into tiny pieces. Once enough of the packets are collected, the data is then linked together and turned into a single, readable file. When Regin infects a machine, it gets assigned a virtual IP address. This forms a VPN layer on top of everything else. The attackers can then use this to keep inside the infected machine without drawing attention to their presence. This helps them hide the traffic even more. The traffic looks like expected traffic in the network so the security team doesn’t see any spikes or any suspicious activity.
They use a variety of transport protocols to also disguise their communication to the infected servers. They sometimes used UDP, they sometimes used TCP, they sometimes sent data over HTTP cookies. A lot was done over your typical SSL and even SMB. With all these covert channels being used, it allowed the attackers to use this malware for years before it was detected. Obviously, a lot of time and money was spent making this malware. The longer that the hackers can use it before it goes noticed, the more value they can get out of it. Because once it becomes discovered, then it gets patched and it gets detected by Antivirus. If the attackers use it again, people can quickly point fingers at who it might be. With any malware attack, finding who did it is really hard. This becomes especially hard when indications point to nation state espionage.
No one wants to raise their head above the pulpit and expose a nation state’s weapon in the fight for national security. While the security companies are not keen to name names on the creators of Regin, they do all seem to agree that it is state-sponsored malware. Maybe they were just being cautious on what they expose because it is scary for a security researcher to expose a weapon of a nation state actor to the world. If that threat actor knew you were about to publish that report, they might do something to stop you from doing it. In December 2015, the Investigatory Powers Tribunal was done with their investigation. This is the UK body appointed by the Queen to investigate allegations against MI5, MI6, and GCHQ. This is where the internet service providers in six countries filed their legal complaint with.
The Tribunal heard the case that these ISPs said the GCHQ hacked Belgacom and it was illegal. The Tribunal’s job is to investigate these complaints to decide whether the agency in question [00:40:00] acted improperly. During the tribunal, to everyone’s surprise, the GCHQ did admit to carrying out hacking operations in the UK and abroad which to me is a big deal; for the GCHQ to officially say they do hacking? Yeah, I don’t think they publically admitted to that previously. We even learned that in 2013, about 20% of its intelligence reports came from information that was from hacking operations. They also said that computer network exploitation, or otherwise known as hacking, has protected the public from threats and can often be the only way to gather certain intelligence. But after the Tribunal heard the case and spent a few years looking it over, they came to a conclusion; the Tribunal ruled in favor of the GCHQ.
The ruling said that they were satisfied with the correct balance between safeguarding the public on one side and protecting an individual’s rights and privacy on the other. Really, the Tribunal said the computer network exploitation, or hacking carried out by the GCHQ was legal and didn’t infringe upon individual rights. That seems to be the end of the lawsuit. In 2016, the Belgacom cyber-attack in GCHQ involvement was still being questioned. Alexander De Croo, the Deputy Prime Minister for Belgium, made some unexpected comments while at a conference. He was participating in the World Economic Forum in January, 2016 in Davos, Switzerland. He was asked how Belgium protects its citizens from being spied on by an ally. His slightly uncomfortable response was definitely surprising. Here’s what he said.
REPORTER2: How does Belgium protect its citizens from being spied on by allies?
ALEX: You want me to say we do it in a good way or in a bad way?
REPORTER2: The bad way would be better, more entertaining for us.
ALEX: Well, no, mainly we’ve had one case where a big teleco that basically came out. Yes, it seems that there had been infiltration. The whole question is, did we agree or not?
REPORTER2: Infiltration by who?
ALEX: Infiltration – it’s not defined.
REPORTER2: The Germans?
ALEX: But based on the Snowden slides, you could infer something. The whole question of course is – and even me; I mean, I’m not the Minister of Justice. I don’t get access to everything. My question was, did we agree or not? It might very well be that the Belgian intelligence services said yeah, why not? Please go ahead. The whole question is who is giving an okay to that or not?
JACK: Again, that was the Deputy Prime Minister of Belgium giving a suggestion that possibly the Belgium government also agreed to this attack. For the UK’s intelligence services, that’s MI5, MI6, and the GCHQ, any surveillance operations that are considered intrusive and that intercept communications need the approval of the Secretary of State. A Foreign Secretary is responsible for GCHQ, keeping the Prime Minister and the Secretary of State up to date on their activities. For something like Operation Socialist, it most likely would have gone all the way to the Foreign Secretary and Secretary of State for approval. [MUSIC] But did that approval involve asking permission from Belgium’s State Secretary Services, and did they give it? We don’t know, and this, of course, is where all this stops.
The intelligence operations of any country are not open to the public and the GCHQ, or the NSA, or the Belgium intelligence services will never confirm or deny any suggestions or allegations about their operations. Really, we will never know. The only thing we have are those leaked Snowden documents and these large, moving shadows just below the surface. There’s no hard evidence who was behind this or what was taken. Belgacom themselves have never publically commented on the allegations that it was the GCHQ or NSA that hacked them. Although the exact data that the malware may have extracted from their systems is unknown, Belgacom stated that the traffic from the malware was very low and they didn’t believe that it was an aim to extract bulk data from their networks. Since the attack, Belgacom has a new CEO and they rebranded to Proximus, both changes that they implemented in 2014.
At the end of that year the company still had a 41% in the Belgium mobile market. The cyber-attack didn’t seem to affect their share price. They were up 40% a year after the hack. Proximus, as they’re now known, have invested heavily in cyber-security since this attack was discovered in 2013. The company now has an internal cyber-security program costing fifteen million euros and a cyber-security incident response team. They also continue to have ethical hackers and penetration testers to test out the security to highlight any gaps. It’s obvious that they tried to learn from this attack and strengthen their security as much as possible and at significant cost. The Trinity investigation into this cyber-attack reached its final stages [00:45:00] in September of last year.
The Belgian federal prosecutors submitted their confidential investigation report to the Belgian government. The report is believed to confirm the attack on Belgacom had been ongoing for around two years before it was discovered by the IT team. It also said the investigators believed Operation Socialist must have been approved on a high level of the British government before it was implemented. With no firm evidence that would hold up in court on who was behind this attack, no individual prosecutions were going to happen. The investigation into the Belgacom cyber-attack appears to have been closed.
[MUSIC] This story is about a communication provider allegedly hacked on a grand scale by a nation state using a few very advanced pieces of malware. The Quantum Insert technique and the Regin malware give us a peek as to how sophisticated nation state malware is. There are surely many more things behind this that we don’t even know about. For the victims of a cyber-attack like this, it’s a David and Goliath scenario, but one that David has no way of winning. Craig Mundie is the advisor to the CEO at Microsoft. A few years back he was speaking at the School of International and Public Affairs at Columbia University. There, he had this to say.
CRAIG: The real problem right now is that if a nation state chooses to use their full array of capabilities against even a sophisticated business, the business almost doesn’t stand a chance. Part of the problem we’ve got is that people are still thinking that if they use conventional defensive techniques to improve the perimeter security of their network, that they’re going to be okay. That may be sufficient against malicious mischief or petty criminals but it’s questionable against sophisticated organizations and it’s probably hopeless as a defense strategy against the government. The reason is governments don’t confine themselves to the network means of attack.
They’ll come in and bribe your system administrator. They’ll come in and threaten to do evil things to his family or whatever it might be. People become a key component of compromise. It’s always been true but we now start to see those kind of national techniques being applied in these economic espionage cases. Therefore, even if your CIO tells you that he’s happily got the perimeter secured, you really can’t believe that. I think, whether you’re a business or a government now, you really need to start to think wow, there’s really sophisticated actors here and if I have anything I really care about, I’m going to have to take some additional steps to try to protect these things.
JACK: [MUSIC] Even if conclusive, no-doubt evidence can be found which of course it can’t, the political ramifications of Belgium seeking criminal charges against a nation state attacker is huge. The twist in the tale here is that this was an alleged nation state attack on a friendly, allied state; not a hostile one. On top of that, it was an attack on a company in a friendly, allied state. Because of that, the rules are different, the response is different, and the outcomes for those who are hacked are different. It really seems to me that in cyber-space there are no boundaries and that political agreements are ignored, and friendly nations might be foes, and information sharing is happening on back channels.
The online world offers a level of anonymity, of deniability; as long as your skills are up to scratch so that all rows leading back to you are blocked. This is something not only criminally-minded hackers are taking advantage of, but nation states too in this ever increasing, developing landscape of cyber-crime and cyber-warfare.
JACK (OUTRO): [OUTRO MUSIC] Hey, if you can’t wait for the next episode to come out, guess what? You can get bonus episodes over on Patreon. There are now three bonus episodes available for you there, right now. Patreons also get an ad-free feed too, so you don’t have to listen to ads anymore. By being a Patreon supporter, it helps everything. It helps keep ads to a minimum, it helps support the show to hire extra help which helps get you more episodes. This show might not even be here today if it wasn’t for the Patreon supporters so thank you very much, everyone who has donated. Please consider signing up there and giving something to support the show. [00:50:00] This show is created by me, the bod guy, Jack Rhysider. Writing help for this episode was by Fiona Guy. Editing help was from the key-tapper Damienne and our theme music is by the beat-builder Breakmaster Cylinder. Even though people ask me how to hack their girlfriend’s Facebook account every time I say it, this is Darknet Diaries.
[OUTRO MUSIC ENDS]
[END OF RECORDING]