Duqu is described as thought to have been created by Unit 8200 and the NSA, not as a confirmed attribution.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Duqu is thought to be created by the NSA and Unit 8200 in Israel”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Duqu is described as thought to have been created by Unit 8200 and the NSA, not as a confirmed attribution.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Duqu is thought to be created by the NSA and Unit 8200 in Israel”
Flame is described as thought to have been created by GCHQ and the NSA, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Flame is thought to be created by the NSA and GCHQ.”
Operation Socialist COMPROMISES Belgacom
The alleged Operation Socialist intrusion compromised Belgacom's internal network and systems.
Uncertain Confidence 90% · Jack Rhysider EP 48 Details
“the cyber-attack on Belgacom”
“the attack on Belgacom”
Quantum Insert DEVELOPED_BY National Security Agency
Quantum Insert is described as a technology developed by the NSA.
Explicit Direction flagged Confidence 98% · Jack Rhysider EP 48 Details
“a technology that the NSA developed called Quantum Insert”
Kaspersky followed Symantec with its own report on Regin and had been tracking it since 2012.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Kaspersky immediately followed up with a report of their own”
Symantec exposed Regin in a 2014 report.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“In November 2014, Symantec exposed a serious and advanced malware framework they referred to as Regin”
Operation Socialist INITIAL_ACCESS_VIA Quantum Insert
The episode presents Quantum Insert as the alleged method used to obtain initial access to Belgacom's network.
Uncertain Confidence 88% · Jack Rhysider EP 48 Details
“what they used was a technology that the NSA developed called Quantum Insert”
“the NSA helped the GCHQ conduct these attacks to get the initial access”
Trinity was the Belgian investigation into the cyber-attack against Belgacom.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“They code-named their investigation Trinity.”
“The Trinity investigation into this cyber-attack”
Trinity INVOLVES Federal Public Prosecutor in Belgium
The Belgian federal prosecutors participated in and ultimately received the confidential report from the Trinity investigation.
Explicit Confidence 94% · Jack Rhysider EP 48 Details
“The Belgian federal prosecutors submitted their confidential investigation report to the Belgian government.”
Operation Socialist INVOLVES Regin
Regin was later matched to the malware found on Belgacom during the alleged operation.
Derived Confidence 92% · Jack Rhysider EP 48 Details
“Regin was matched with the malware found on the Belgacom systems”
GCHQ OPERATED_BY United Kingdom
GCHQ is identified as the United Kingdom's government communications headquarters.
Explicit Confidence 90% · Jack Rhysider EP 48 Details
“GCHQ, or the Government Communication Headquarters, is like the NSA but in England.”
BICS is described as another company belonging to Belgacom.
Explicit Confidence 93% · Jack Rhysider EP 48 Details
“they have another company called BICS which is the Belgacom International Carrier Services”
Belgacom SAME_AS Proximus Group
The episode states that Belgacom is now called Proximus Group.
Explicit Confidence 99% · Jack Rhysider EP 48 Details
“It’s actually now called Proximus Group now, but the story takes place when it was known as Belgacom.”
Operation Socialist TARGETS Belgacom
Operation Socialist was the name given to the operation targeting Belgacom, according to the leaked GCHQ presentation.
Attributed Confidence 96% · Jack Rhysider EP 48 Details
“the GCHQ called this attack Operation Socialist”
Regin TARGETS European Commission
Regin was involved in an attack in which the European Commission discovered that it had been hacked.
Explicit Confidence 94% · Jack Rhysider EP 48 Details
“the European Commission discovered it had been hacked”
Regin TARGETS European Council
The episode states that multiple European Council systems were infected in the same attack involving Regin.
Explicit Confidence 93% · Jack Rhysider EP 48 Details
“Multiple systems at the European Commission and European Council were infected”
Regin was used against Belgacom's systems, including systems used by administrators and network infrastructure.
Derived Confidence 95% · Jack Rhysider EP 48 Details
“After the Quantum Insert phishing method was done on Belgacom, then this malware was installed on the target’s computers which was called Regin.”
Regin USES command and control server
Regin uses command-and-control infrastructure to communicate with attackers and transfer collected data.
Explicit Confidence 95% · Jack Rhysider EP 48 Details
“the infected systems talk to each other first on the network and then through a central hub which then communicates back to the command servers”
Quantum Insert USES Quantum Server
The Quantum Insert method uses a Quantum Server to respond faster than the legitimate web server.
Explicit Confidence 95% · Jack Rhysider EP 48 Details
“For this to work, they use something called a Quantum Server”
Regin used SSL as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Regin USES Server Message Block
Regin used SMB as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Regin assigns an infected machine a virtual IP address that forms a VPN layer over the network.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“This forms a VPN layer on top of everything else.”
Firebase security rules misconfiguration AFFECTS Firebase
The Firebase database was exposed because debug settings and permissive security configuration were left enabled.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“They kept the debug settings on so it was pretty easy to get everything.”
“There was zip for permission and security there”
63red API vulnerability AFFECTS 63red
The 63red API vulnerability allowed unauthenticated users to modify accounts and otherwise control database contents.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“There was no authentication process so everybody has the ability to modify, to do whatever they want.”
Donald Daters database exposure COMPROMISES Firebase
Elliot gained access to the Donald Daters Firebase database and could view its contents.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Within five minutes, Elliot has gained access to the entire Donald Daters database.”
“I had access to everything; all the messages, all the people’s details.”