In an article in Britain's Guardian newspaper, American IT security expert Bruce Schneier describes in detail how Quantum Insert technology is used to place malware. Apparently, the agencies use high-speed servers located at key Internet switching points. When a target calls up a specific website, such as LinkedIn, these servers are activated. Instead of the desired website, they supply an exact copy, but one that also smuggles the government hackers' spying code onto the target computers.
According to other secret documents, Quantum is an extremely sophisticated exploitation tool developed by the NSA and comes in various versions. The Quantum Insert method used with Belgacom is especially popular among British and US spies. It was also used by GCHQ to infiltrate the computer network of OPEC's Vienna headquarters.
The injection attempts are known internally as "shots," and they have apparently been relatively successful, especially the LinkedIn version. "For LinkedIn the success rate per shot is looking to be greater than 50 percent," states a 2012 document.
Much like the Belgacom spying operation, Wylekey is considered a great success. According to a summary, it provided GCHQ with detailed information about Mach, its communications infrastructure, its business profile and various key individuals.
Another document indicates that the operation yielded much more than that. In addition to "enhanced knowledge of the various clearinghouses, their customers," it also provided "knowledge of and access to encrypted links between the clearinghouses and various mobile network operators."
Interim reports on the course of the Belgacom operation were even more enthusiastic, concluding that the British spies had penetrated "deep into the network" of the Belgian company and were "at the edge of the network." This enabled the British internal encryption specialists ("Crypt Ops") to launch their "Operation Socialist II," so as to crack the encrypted connections, or VPNs.
'LinkedIn Would Not Authorize Such Activity'
When contacted, LinkedIn stated that the company takes the privacy and security of its members "very seriously" and "does not sanction the creation or use of fake LinkedIn profiles or the exploitation of its platform for the purposes alleged in this report." "To be clear," the company continued, "LinkedIn would not authorize such activity for any purpose." The company stated it "was not notified of the alleged activity."
A spokesman for Starhome Mach said his company is "with immediate effect undertaking a full security audit to ensure that our infrastructure is secure" and that its platform had recently switched to a completely new configuration with mainly new hardware. Officials at Comfone said: "We have no knowledge of the British intelligence service infiltrating our systems." Syniverse also stated "there have been no known breaches of the Syniverse or MACH data centers by any government agency."
GCHQ did not comment on questions posed by SPIEGEL.
'Any Mobile Device, Anywhere, Anytime!'
For the British, all of this was apparently only an intermediate step on the path to a greater goal. In addition to the conventional Internet, GCHQ now wants to turn the mobile web into an all-seeing surveillance machine.
This is how the GCHQ spies described their "vision" in 2011: "Any mobile device, anywhere, anytime!"
In this context, the attacks on Belgacom and the clearinghouses merely serve as door openers. Once the telecommunications companies' actual mobile phone networks have been infiltrated, completely new monitoring possibilities present themselves to the spies. A briefing dating from 2011 stated the agency wanted to "increase operational capability to remotely deploy implants when we only know the MSISDN." In other words, GCHQ's phone hackers would ideally like to repurpose every mobile phone in the world into a bugging device, merely on the basis of the phone number. "That would be game changing," the document reads.
REPORTED BY LAURA POITRAS, MARCEL ROSENBACH, CHRISTOPH SCHEUERMANN, HOLGER STARK AND CHRISTIAN STÖCKER