Greek, U.S. Officials Tapped For Years

Bruce Schneier posts on a story being reported in the Seattle Intelligencer. Greek and U.S. officials in Greece apparently had their phones tapped for over a year before the 2004 Olympics. From the article: "It was not known who was responsible for the taps, which numbered about 100 and included Greek Prime Minister Costas Caramanlis and his wife, and the ministers of foreign affairs, defense, public order and justice. Most of Greece's top military and police officers were also targeted, as were foreign ministry officials and a U.S. embassy number. Also tapped were some journalists and human rights activists." Schneier gives a bit of technical background on how the tapping was accomplished.

Comments

Organized Crime?

[egarland]

This sounds like an organized crime activity to me. Lots of cash flowing around and knowing people's secrets could be just what somebody needed to get a fat contract where they could skim millions. Follow the money and you'll probably find who did this, even if you cant prove it.

I wouldn't be surpriesd if organized crime here in the US hadn't figured out a way to tap into people's phone calls. The telepone companies don't seem to care who listens to our phone calls anymore.

It's time for end to end encryption of all communications. We should get an SSL session from one handset to the other.

Re:Interesting

[kent_eh]

How did they get access to the phones

They didn't have to.

They (whoever "they" is) did it all from the telephone company switch.

This is exactly the same mechanism that is used for "proper" (IE: court ordered, law enforcement initiated) taps.

A command is issued in the switch that makes any future calls to or from the "target" phone part of a conference. The 3rd party in the conference would normally be a one-way audio device, that is connected to the police recording equipment.

In this case, it appears that the monitoring party was another cell phone (a pre-paid one, hard to track down who it belongs to).

The "hack" in this case, is really just an un-authorized use of an existing function in the telephone switching platform. It only takes a couple of commands, from a login with appropriate permissions, to do this.

All that stuff in the movies "..what was that, did you hear a click?" is bogus. I've been involved in a lot of testing of these and you can't tell that there's anything out of the ordinary going on.

Not the whole story...

[Sub Zero 992]

Some more interesting details:

1) The software used was developed by Vodafone's major supplier,
Ericsson. It was installed although Vodafone does not own any licenses
to use it.
http://news.kathimerini.gr/4dcgi/_w_articles_polit ics_371_03/02/2006_172382

2) Vodafone was notified by a Reseller, Q-Telecoms, about delays in
text message delivery, after which they undertook an ad-hoc analysis.
They found the software, supposedly a remotely activated Trojan (how
the hell could a Trojan get onto an SMS gateway?), by sheer luck, and
then disconnected the computer from the network.

3) The day after (2) the local security manager was discovered dead.
"Suicide", don't you know.

4) Ta Nea (http://digital.tanea.gr/) are claiming it was the CIA,
since the remote proxy used for collecting data appeared to lie in the
vicinity of the American and / or British embassies. How amateurish is
that? Their motive was "Anti-Terrorism" before, during and evidently
also after the 2004 Olympics, which is no doubt why the list of
mobiles being tracked also included those of some prominent, and very
very active (if you follow the news about bombs and firebombs at Greek
banks and ministries, you'll know what I mean) anarchists (not
commies, much more left wing than those boy-scouts).

So long,

Re:Interesting

[Rei]

I'd guess that they probably got access at some stage during shipping, not at the factory, and swapped outbound phones with ones modded in at their leisure.

Never underestimate the power of even a simple device to spy. My favorite spy tool of all time was a plaque given to the US Embassy at Moscow by the Soviets in 1946. The US inspected it and determined that there was absolutely no way it could be bugged. It was ;) It was a hollow cavity resonator - it had a large open space in the center with a simple wire in it. The vibration changed the capacitance between the diaphragm and the post plate, but there was no power source. It was not a bug on its own, but when the Soviets would broadcast a strong radio signal, an induced current would induce currents and stimulate a return broadcast at varying frequencies using the wire as an antenna, with frequency determined by the distance between the diaphragm and the post plate (which was determined by the sound impacting the diaphragm). I.e., a simple arrangement of metal became an FM transmitter when you broadcast radio waves at it.