Brit Spies Spoof LinkedIn Pages to Track Targets

Do you like this story?

Officially, no one knows anything, but if the latest revelations from Edward Snowden's storehouse of inside information on global surveillance activities can be believed, then it's highly likely Britain's counterpart to the NSA has been hacking into telecoms. GCHQ apparently redirected network engineers to spoofed LinkedIn pages and loaded their computers with malware to gain access.

British intelligence agency GCHQ (Government Communications Headquarters) has spoofed LinkedIn profiles of employees at mobile communications companies and mobile billing firms to gain access to their corporate networks, Der Spiegel reported.

The first known attack was on Belgacom, a telecom firm partly owned by the Belgian government, according to a top secret GCHQ presentation revealed by NSA whistleblower Edward Snowden. That attack was among projects launched by GCHQ to infiltrate foreign networks.
The British intelligence agency also targeted international mobile billing clearinghouses, which process international payment transactions between wireless companies.

Hitting US Companies

Syniverse and Mach, a company it acquired in July, are high on the list of clearinghouses GCHQ has targeted for such penetration, according to Der Spiegel.
GCHQ apparently has targeted three network engineers at Mach, using the Quantum Insert method.
Syniverse provides solutions that let different mobile technologies interoperate around the world. With its acquisition of Mach, it serves more than 1,500 mobile service providers, enterprises, ISPs and app providers in nearly 200 countries.
"There have been no known breaches of the Syniverse or Mach data centers by any government agency," Syniverse spokesperson Bobby Eagle told TechNewsWorld. "Privacy and confidentiality are essential priorities for Syniverse, and we take these matters very seriously."

The Essence of GCHQ's Attack

The British intelligence service is, basically, redirecting traffic to and from targets to a server between them so it can intercept communications.
This is known as a "man in the middle" attack.
Such attacks are commonly used on the banking sector. iMessages are vulnerable to MITM, Quarkslab disclosed in October.
"Man-in-the-middle attacks are one of the oldest kinds of attacks out there," Daniel Castro, senior analyst at the Information Technology and Innovation Foundation, told TechNewsWorld.

We Are the (Tainted) World

GCHQ's techniques are strikingly similar to the ones used by cybercriminals when they launch targeted attacks, such as spearphishing.
The agency first determines who works for a target company using publicly available data such as the victim's LinkedIn profile. It apparently focuses on IT personnel and network admins because they have extensive access privileges on their computers.
The agency then gathers all available information about its victim -- in one case, even gaining access to cookies on a victim's PCs -- then develops what are essentially viruses in payloads customized for the victim's computers.
One method of attack involved concealing the malware payloads on spoofed versions of victims' LinkedIn pages. Pulling up the fake profile would launch the malware into the victim's computer.
"We have never cooperated with any government agency, nor we have any knowledge, with regard to these actions," LinkedIn spokesperson Julie Inouye told TechNewsWorld.
"To date, we have not detected any of the spoofing activity that is being reported," she said. "LinkedIn takes the privacy and security of our members very seriously, and when we're made aware of any activity that may be considered problematic, we work to quickly shut it down."

The Sincerest Form of Flattery

It appears that GCHQ borrowed heavily from the United States' National Security Agency.
The NSA places secret servers, codenamed "Quantum," at key places on the Internet backbone as part of its so-called "Turmoil" system, according to security specialist Bruce Schneier.
Turmoil is part of the NSA's Turbulence program.
Once the Quantum servers are in place, a query to a website they are spoofing hits them before it hits the legitimate site. The query is then redirected to another set of secret Internet servers, codenamed "FoxAcid," Schneier said.
The FoxAcid servers then inject malware into victims' PCs to compromise them.
It's not clear whether the UK agency is using the same technology as the NSA, although Der Spiegel uses the term "Quantum Insert" in its description of the GCHQ attacks.
"Capturing large amounts of Internet traffic and redirecting it like that should be off limits," the ITIF's Castro remarked.