British spy agency attempts mammoth hack

Britain's Government Communications Headquarters (GCHQ) has been scanning every public-facing server in 27 countries for several years to find any weak systems in waht some have described as a 'gargantuan scale' hack.

The agency's so-called 'Hacienda' program, revealed by German publication Heise, started in 2009 when GCHQ decided to apply the standard tool of port scanning against entire nations.

Documents published by Heise show GCHQ fully trawls 27 countries – meaning it “randomly scans every IP identified for that country” – and partially scans five other nations. The 32 country names are blanked out in the report.

Port scanning has been used by attackers since the early days of TCP, exploiting a flaw in the handshake between TCP clients and servers which means the server leaks information without checking the client's authorisation.

Heise warns: “It is not the technology used that is shocking, but rather the gargantuan scale and pervasiveness of the operation. The massive use of this technology can make any server anywhere, large or small, a target for criminal state computer saboteurs.”

The documents showed GCHQ used Hacienda for “vulnerability assessment, network analysis and target discovery”, and to detect ORBs (operational relay boxes) – servers it can use as stepping stones to hide the source of its attacks.

Referring to previously revealed GCHQ hacks, Heise says: “As shown with the penetration of Belgacom and Stellar, when an employee's computer system or network credentials may be useful, those systems and people are targeted and attacked.”

The agency gathers data on any weak server including the host name, banners (which provide system and application information), application names, port status, directory listing and content of the main page. It also profiles the machines concerned, including browser, operating system, PSP and patch history.

The data is then shared with the UK's partners in the Five Eyes group of countries which also includes US, Canada, Australia and New Zealand.