NSA, GHCQ Implicated In SIM Encryption Hack

First time accepted submitter BlacKSacrificE writes Australian carriers are bracing for a mass recall after it was revealed that a Dutch SIM card manufacturer Gemalto was penetrated by the GCHQ and the NSA in an alleged theft of encryption keys, allowing unfettered access to voice and text communications. The incident is suspected to have happened in 2010 and 2011 and seems to be a result of social engineering against employees, and was revealed by yet another Snowden document. Telstra, Vodafone and Optus have all stated they are waiting for further information from Gemalto before deciding a course of action. Gemalto said in a press release that they "cannot at this early stage verify the findings of the publication" and are continuing internal investigations, but considering Gemalto provides around 2 billion SIM cards to some 450 carriers across the globe (all of which use the same GSM encryption standard) the impact and fallout for Gemalto, and the affected carriers, could be huge.

Comments

Fallout?

[The Rizz]

the impact and fallout for Gemalto, and the affected carriers, could be huge.

Why is it that the fallout is centered on these companies, instead of on the NSA and GHCQ? Why are these criminal enterprises masquerading as government agencies so completely above the law?

Re:Fallout?

[Anonymous Coward]

It would be nice to know who will pay the damages or that NSA and GHCQ can just destroy businesses as they please.

Re:Fallout?

[Anonymous Coward]

Certainly very true. Absolutely, NSA and GCHQ are at fault here.

However, these kinds of stories draw the attention of even the most idiotic of individuals. Those that only a few months ago were, without any consideration, spouting, "I don't care if the NSA sees everything I do or works to break into everything." must now stop and realize they were used and lied to, and that the work of these criminal organizations is directly damaging many companies. Various encryption or communication groups and companies have disappeared without any notice by the average person, but they will see the damage when it comes to their cell phones.

Damages

[Anonymous Coward]

So who does Gemalto sue when the bankrupting recall they are forced to do is the result of a government approved hack?

Re:Damages

[AmiMoJo]

How would they ever prove it? The stolen documents will be inadmissible. Everything will be protected as a state secret. Their customers won't care of course, but the courts will.

Taxpayers

[Anonymous Coward]

So, not only do we fund the hack, but now we need to fund the compensation for it.

Wonderful job.

Re:Taxpayers

[transporter_ii]

They want to know what you are saying, and they are willing to spend every penny you have to find out. And then some.

We're Number 1! We're Number 1!

[Anonymous Coward]

Welcome to the USSA. Just like the old USSR, with better technology.

Corruption == Treason

[Anonymous Coward]

Time to start treating it as such, use your backwards antiquated capital punishment laws for something productive for a change.

Sanctions

[Anonymous Coward]

The world should introduce trade-sanctions against the USA and the UK, until they stop attacking other countries, and fall in line.

Even if the courts punish US/UK

[EmagGeek]

The governments will simply say "come and take it, if you can."

Re:I think I speak for everyone when I say

[fisted]

Oh come on, how would that even work? It's one and the same person.

even more interesting

[Pop69]

I believe the smartcards and USB readers our bank supplies us for authentication of online transactions are supplied by Gemalto

Are they affected as well ? I would expect so

Re:even more interesting

[ledow]

Gemalto do the majority of the smartcard market these days.

I've used them for everything for business banking to access control.

Is it not scary enough that they have been compromised to the point of making almost every SIM on the planet useless? By comparison a banking smartcard here or there is nothing.

Ironically, every few months our bank will tell us that we have to replace the PIN-pads/smartcards/whatever for a newer model "to be secure". Nobody's yet answered then why their software only works on IE (and older versions at that).

Re:even more interesting

[AmiMoJo]

Gemalto do a lot of industrial SIMs. I have used them in products designed at work. Many cars with GSM/3G connectivity use their SIMs. Many smart meters, many mobile payment terminals, many sensor networks, many medical devices.

It's the kind of thing someone could use to bring down a lot of infrastructure. I bet loads of infrastructure monitoring uses Gemalto SIMs for M2M communications. It's probably safe to assume that if GCHQ and the NSA have the keys, so do others. Considering how much leaks out of those two organizations from relatively low level operatives I'm sure China and Russia and probably a few others have at least that much access.

Re:even more interesting

[oodaloop]

And our Smart Cards we use on classified networks in the intelligence community use Gemalto. Just checked. Goddamnit.

I'm not even kidding. Seriously.

The UK needs to pay

[Anonymous Coward]

This is an act of industrial espionage and infrastructure sabotage committed by one EU member against another. The UK needs to be held financially responsible for the damage, and punitive sanctions should follow. The UK should also explain how it sees its own future in the EU in the light of these revelations.

Re:I think I speak for everyone when I say

[fuzzyfuzzyfungus]

Just ask the Holy Spirit, he's consubstantial with both the Son and the Father; despite begetting the son(yet not being the father).

From SIM to Chip and PIN

[MeNeXT]

Now they can also prove that you were there when they emptied out your bank account. This is probably why they a refusing to provide any information on stingrays it goes way deeper than anyone thought.

It would be nice if...

[tekrat]

It would be nice if the NSA was using this technology to spy on the real terrorists; and by that I mean the people who actually do want to hurt you and steal from you -- CEOs and Large Banks.

I mean, there has not been a SINGLE prosecution in the great financial disaster of 2008, yet, I'll be there's plenty of cell phone conversations and text messages about breaking up bad mortgages into financial instruments of mass destruction, and reselling them as AAA+ rated securities.

Excuse me, but after 20 trillion dollars lost, and another 2 or so trillion given away to prop up a few banks who wanted to play along with the government (until such time that it became time to steal again); it seems to me that the NSA should be more concerned about these guys than a few rouge crazies who blow up the occasional civilian.