Slashdot Mirror
Gemalto: NSA and GCHQ Probably Hacked Us, But Didn't Get SIM Encryption Keys
An anonymous reader writes: Last week The Intercept published a report saying agents from the NSA and GCHQ penetrated the internal computer network of Gemalto, the world's largest maker of SIM cards. Gemalto has done an internal investigation, and surprisingly decided to post its results publicly. The findings themselves are a bit surprising, too: Gemalto says it has "reasonable grounds to believe that an operation by NSA and GCHQ probably happened."
They say the two agencies were trying to intercept encryption keys that were being exchanged between mobile operators and the companies (like Gemalto) who supplied them with SIM cards. The company said it had noticed several security incidents in 2010 and 2011 that fit the descriptions in The Intercept's documents. Gemalto had no idea who was behind them until now. They add, "These intrusions only affected the outer parts of our networks – our office networks — which are in contact with the outside world. The SIM encryption keys and other customer data in general, are not stored on these networks." They claim proper use of encryption and isolation of different networks prevented attackers from getting the information they were after.
They say the two agencies were trying to intercept encryption keys that were being exchanged between mobile operators and the companies (like Gemalto) who supplied them with SIM cards. The company said it had noticed several security incidents in 2010 and 2011 that fit the descriptions in The Intercept's documents. Gemalto had no idea who was behind them until now. They add, "These intrusions only affected the outer parts of our networks – our office networks — which are in contact with the outside world. The SIM encryption keys and other customer data in general, are not stored on these networks." They claim proper use of encryption and isolation of different networks prevented attackers from getting the information they were after.
as per the subject
a bunch of NSA geeks are high fiving each other and can't seem to stop hooting and hollering with awesomeness
Yeah. right. Sounds like the damage limitation engine is in full swing!
Bias-ply
Air gapped networks aren't secure just because they're air-gapped - there's lots of techniques:
https://www.schneier.com/blog/archives/2014/10/jumping_air_gap.html
http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/
and many other types of 'infected' media methods like USB keys. Sure it takes longer, but agencies are very patient.
Heeeeeeeeeeere, Eddie Eddie Eddie.... :) Oh, how we miss you so very much.
...it's probably a wise assumption that they're not going to stop until they get what they're looking for.
Cute story, but intelligence agencies didn't target them for their super secret oatmeal cookie recipe.
....cause if the keys would be compromised, they had to exchange several hundred million SIMs for free, we can't have that...
North Korea hacks Sony => Cyber-Terrorism
USA & Great Britain hacks Gemalto => Patriotic-Duty
Of course Gemalto will say anything they can to limit economic damage, but without proper and transparent oversight of secret agencies they is no way to validate any claim by Gemalto that their 3G/4G SIM secrets were not stolen.
The best course of action is for Gemalto to simply be bought out official by the NSA and GCHQ, since they already own their asses, oops I mean assets.
Chances are they have the IMSI Ki keys. This is the info that is given to the carriers with each IMSI(SIM). That's all that is needed to dupe a SIM or decrypt coms. The vast majority(probably all) of these will use the default A3 /A8 encryption, so this will be a walk in the park (load IMSI+Ki into new card) to spin off duplicate SIMs for the next few years.
Once you can dupe a SIM, you can then fool the VLR/HLR into redirecting calls/SMS or access Voicemail. No need to monitor the local airwaves.
Area51 - We are watching...
This statement does not provide any information as the probability range is subjective. ... Also please consider that there are numerous examples of networks that were outside of direct internet connection that were penetrated by NSA / GCHQ (remember Iran) :)
if the security of the cell network really falls on the security of a single company then that is unacceptable.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Translation of what they really said:
The investigation into the intrusion methods described in the document and the sophisticated attacks that Gemalto detected in 2010 and 2011 give us reasonable grounds to believe that an operation by NSA and GCHQ probably happened
The attacks were sophisticated, thus the fact that we were compromised was justified. We will play the victim card straight off. We presume that because the attacks were sophisticated that it was the NSA and GCHQ, although any hacker group and nation-state would give their left arm for our encryption keys. However NSA and GCHQ are scary acronyms, and so we were supposedly up against the most powerful hacking group in the world, again, justifying the fact that they succeeded.
The attacks against Gemalto only breached its office networks and could not have resulted in a massive theft of SIM encryption keys
The attacks resulted in a theft of our SIM encryption keys, although not a "massive" one, whatever "massive" means.
The operation aimed to intercept the encryption keys as they were exchanged between mobile operators and their suppliers globally. By 2010, Gemalto had already widely deployed a secure transfer system with its customers and only rare exceptions to this scheme could have led to theft
Rare exceptions to our scheme led to theft.
In the case of an eventual key theft, the intelligence services would only be able to spy on communications on second generation 2G mobile networks. 3G and 4G networks are not vulnerable to this type of attack
Intelligence services were able to spy on communications on 2G mobile networks, due to this one known particular theft of SIM keys that we managed to discover. Even the most modern cell phones fall back on 3G and 2G mobile networks if 4G is not available, so this could affect any phone.
None of our other products were impacted by this attack
Products of ours were impacted by this particular attack, but at least it wasn't every single product we have.
The best counter-measures to these type of attacks are the systematic encryption of data when stored and in transit, the use of the latest SIM cards and customized algorithms for each operator
We are trying to come up with better counter-measures to prevent them from continuing to access our encryption keys.
Better known as 318230.
This is likely what they were told to say.
Before I part with'em: two pennies weigh ~4.996+/-0.014g, have a zinc core, and the face of Lincoln. You can keep 'em.
North Korea hacks Sony => Cyber-Terrorism
USA & Great Britain hacks Gemalto => Patriotic-Duty
Or more accurately:
North Korea hacks Sony, gets some personal info that might hurt several thousand employees => Cyber-Terrorism
USA & Great Britain hacks Gemalto, gets keys that can decrypt the communication of millions => Patriotic-Duty
what makes these corporate suits think they can be certain they were not hacked or the uses of the hack... all inside of one week?
They will admin that a group penetrated their internal network, but they will not admin that they penetrated another internal network once they had access to the internal network? I find that highly unlikely. Once the attacker has access to the internal network, getting access to everything else is just a matter of time and sniffing ethernet frames.
From TFA:
We immediately informed the customer and also notified the relevant authorities both of the incident itself and the type of malware used.
A lot of good "informing the relevant authorities" turned out to be (unless the customer was in China or Russia or somewhere, I suppose). They were just like "dang, we'll have to try harder next time". Or perhaps "yay!, they bought the distraction!".
Yeah, sure, Gemalto, as if we are going to believe you, you bunch of wussies.
Here is how it probably went. Cut to Gemalto HQ, and a bunch of crypto and forensic geeks working overnight, going through all the server logs with a fine comb, trying to figure out what really happened, surrounded by cans of Cola and half-eaten pizzas.
Suddenly a phone ring. Pointy-haired manager picks up the phone.
- (PHB) : "Hmmm? Oh, sure Sir, we are making good progress, we may have found... What? Oh."
(Long silence, someone is talking to PHB in hushed, urgent tone)
- (PHB) : "Yes, I understand, sir, but...", (much more quietly, almost whispering) "Oh, that contract too? You mean, every US carrier? Every single one of them? And most UK ones as well?"
(More talking on the phone)
- (PHB): "Yes sir! Right away sir!".
PHB hangs up the phone and slowly turns to the geeks, who have been watching him intently, sensing something is very wrong. PHB swallows hard, trying to look cool.
- (PHB): "Er... Ahem... Thanks for all your hard work, chaps, but upper management has given the all-clear. Nothing really happened and everything is fine. You can all go home now. No, it's OK, the taxi ride home, the drinks and the pizzas are all on me. You will all get a big fat bonus for all the extra hours, with our sincerest thanks."
Meanwhile, somewhere in a US telco HQ:
- (Different PHB): "Hi, Admiral Rogers? How are you doing? Good, good, thank you. Listen, about this SIM thing -- yeah, that one -- it's all set. I got in touch with ____ and ____ at Gemalto and they wisely decided nothing had really happened. Yes, a couple of Brits did, too, along with, you know, ____ and ____. Yeah, him too, believe it or not. (Laughter) So, all of this to say, you guys should be in the clear, nothing ever happened, blah blah blah. Sure. Nah, no biggie, always ready to help. No, no problem at all. You are welcome. Nah, don't worry about it, I'll let you know, say hello from me to ____ and ____, OK? Thanks, bye".
And that, Ladies and Gentlemen, is probably how it happened.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
PR written directly by the NSA.
There are two types of people in the world: Those who crave closure
Using scare words strongly indicates not knowing wtf you're talking about. Goes well with not knowing what really happened on your own networks. Good show, security specialists.
No one will believe them, they're business is likely destroyed completely.
Yes, they hacked us and didn't get the encryption keys. They then asked for the encryption keys nicely the next day, we gave it to them :-)
There is no consistency at all. The US has said more than once that real-world military force is a reasonable response to state sponsored cyber attacks, yet we don't see cruise missiles headed for GCHQ or a tactical ICBM targeting NSA headquarters.
Instead other countries will develop their own cyber offence capabilities and start fighting back. It's already open season on US companies thanks to the actions of the NSA. If a US company is involved in any kind of infrastructure it can expect to have relentless attacks from foreign powers. We are on the brink of WW3, except that it won't be a traditional war fought with bombs and guns, it will by a cyber war where the lights keep going out and banks collapse as their accounts are drained and depositors pull out. Your computer, your router, your phone are all just tools that will be conscripted into foreign armies to attack your country, if they have not already been p0wned by your own cyber military looking to hide themselves.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Standard operating procedure for many network incursions is to do a DDOS attack to distract the IT/Security people while the real penetration is going on, hidden by terabytes of traffic.
I highly doubt sophisticated agents like the NSA/GCHQ would not use this tactic as well, masquerading as conventional malware/spearfishing, and then leaving sophisticated harddrive firmware compromises that Gemalto could not detect to finish the job later on.
Of course. When the NSA hacks into german or french targets, c'est un scandale for euro politicians / journalists. When the the DGSE or the BSA is shown to have used the same techniques, well that's just normal.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Watch for this guy. He can really draw a crowd. In fact, that could be his job, noting every response. Spies are everywhere.
“He’s not deformed, he’s just drunk!”
They don't need the keys!
If they get the code that was used in them, or manage to change the code locally, it will impact all new products released.
North Korea hacks Sony => Cyber-Terrorism
USA & Great Britain hacks Gemalto => Patriotic-Duty
That's not the full table:
North Korea hacks Sony => Cyber-Terrorism, from Sony's perspective
North Korea hacks Sony => Patriotic-Duty, from NK persp.
USA & Great Britain hacks Gemalto => Patriotic-Duty, UKUSA persp.
USA & Great Britain hacks Gemalto => Cyber-Terrorism, from Gemalto's persp.
Just because they didn't find any evidence that the encryption keys were stolen doesn't mean they weren't.
The failure is business models requiring secrets to be burnt into hardware by manufacturer.
When customer takes delivery they should be responsible for installing keys.
Otherwise events like RSA FOB compromise or the proverbial safe company with stolen customer and combination lists will continue.
The only defense against mass exploit is decentralization. Not only does it make prospect of "0wn1ng th3 w0rld" less likely it keeps you from presenting a massive target to extremely well funded adversaries.
Well, My home was burgled (lock was unlocked and locked) and all that was taken were two flash drives. A few books were also moved. I had hard times convincing the police to even file a report.
If they admit the lost the keys to the kingdom, then the kingdom is dead.
all they can do is deny, or their business will go bankrupt.
Every time there is the slightest hint of the NSA doing something bad, especially if it is somehow related to Snowden, everyone here seem to believe it without question. However, every time there is a response saying that it may not be as bad as it seems, there are cries of LIES.
I'm not saying that intelligence agencies don't lie and that big corporations don't try to downplay serious problems but critical thinking goes both ways. For example, why focus on the keys, even in the office network, there are plenty of interesting stuff from accounting and employee data to network architecture and source code.
North Korea hacks Sony => Cyber-Terrorism
USA & Great Britain hacks Gemalto => Patriotic-Duty
Of course Gemalto will say anything they can to limit economic damage, but without proper and transparent oversight of secret agencies they is no way to validate any claim by Gemalto that their 3G/4G SIM secrets were not stolen.
The best course of action is for Gemalto to simply be bought out official by the NSA and GCHQ, since they already own their asses, oops I mean assets.
North Korea hacked Sony in order to (1) punish economically and reputationally and possibly (2) create fear.
The USA and GCHC hacked Gemalto in order to (1) conduct signals intelligence operations, meaning eavesdrop. To Spy, in other words.
Spying isn't terrorism--it's deceit that every country in the world is expected to engage in to further its own policies and protect its interests.
North Korea's act probably wasn't technically terrorism either, because there is no evidence that they intended it to create fear in a target population rather than just economic and reputational harm. But it was closer to terrorism, because it was designed to cause harm to a large group of people.
Wtf? Why would you even admit that without AC.
Does this mean that CDMA is more secure than GSM?
Uhhhhh, yup.
Newflash: that's how patriotism and nationalism works.
Those folks at Gemalto? Not American citizens, therefore they do not have constitutional rights and are fair game for NSA hacking.
Seems pretty cut and dried to me.