Slashdot Mirror
Gemalto: NSA and GCHQ Probably Hacked Us, But Didn't Get SIM Encryption Keys
An anonymous reader writes: Last week The Intercept published a report saying agents from the NSA and GCHQ penetrated the internal computer network of Gemalto, the world's largest maker of SIM cards. Gemalto has done an internal investigation, and surprisingly decided to post its results publicly. The findings themselves are a bit surprising, too: Gemalto says it has "reasonable grounds to believe that an operation by NSA and GCHQ probably happened."
They say the two agencies were trying to intercept encryption keys that were being exchanged between mobile operators and the companies (like Gemalto) who supplied them with SIM cards. The company said it had noticed several security incidents in 2010 and 2011 that fit the descriptions in The Intercept's documents. Gemalto had no idea who was behind them until now. They add, "These intrusions only affected the outer parts of our networks – our office networks — which are in contact with the outside world. The SIM encryption keys and other customer data in general, are not stored on these networks." They claim proper use of encryption and isolation of different networks prevented attackers from getting the information they were after.
They say the two agencies were trying to intercept encryption keys that were being exchanged between mobile operators and the companies (like Gemalto) who supplied them with SIM cards. The company said it had noticed several security incidents in 2010 and 2011 that fit the descriptions in The Intercept's documents. Gemalto had no idea who was behind them until now. They add, "These intrusions only affected the outer parts of our networks – our office networks — which are in contact with the outside world. The SIM encryption keys and other customer data in general, are not stored on these networks." They claim proper use of encryption and isolation of different networks prevented attackers from getting the information they were after.
as per the subject
a bunch of NSA geeks are high fiving each other and can't seem to stop hooting and hollering with awesomeness
Air gapped networks aren't secure just because they're air-gapped - there's lots of techniques:
https://www.schneier.com/blog/archives/2014/10/jumping_air_gap.html
http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/
and many other types of 'infected' media methods like USB keys. Sure it takes longer, but agencies are very patient.
...it's probably a wise assumption that they're not going to stop until they get what they're looking for.
Cute story, but intelligence agencies didn't target them for their super secret oatmeal cookie recipe.
North Korea hacks Sony => Cyber-Terrorism
USA & Great Britain hacks Gemalto => Patriotic-Duty
Of course Gemalto will say anything they can to limit economic damage, but without proper and transparent oversight of secret agencies they is no way to validate any claim by Gemalto that their 3G/4G SIM secrets were not stolen.
The best course of action is for Gemalto to simply be bought out official by the NSA and GCHQ, since they already own their asses, oops I mean assets.
Chances are they have the IMSI Ki keys. This is the info that is given to the carriers with each IMSI(SIM). That's all that is needed to dupe a SIM or decrypt coms. The vast majority(probably all) of these will use the default A3 /A8 encryption, so this will be a walk in the park (load IMSI+Ki into new card) to spin off duplicate SIMs for the next few years.
Once you can dupe a SIM, you can then fool the VLR/HLR into redirecting calls/SMS or access Voicemail. No need to monitor the local airwaves.
Area51 - We are watching...
if the security of the cell network really falls on the security of a single company then that is unacceptable.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Translation of what they really said:
The investigation into the intrusion methods described in the document and the sophisticated attacks that Gemalto detected in 2010 and 2011 give us reasonable grounds to believe that an operation by NSA and GCHQ probably happened
The attacks were sophisticated, thus the fact that we were compromised was justified. We will play the victim card straight off. We presume that because the attacks were sophisticated that it was the NSA and GCHQ, although any hacker group and nation-state would give their left arm for our encryption keys. However NSA and GCHQ are scary acronyms, and so we were supposedly up against the most powerful hacking group in the world, again, justifying the fact that they succeeded.
The attacks against Gemalto only breached its office networks and could not have resulted in a massive theft of SIM encryption keys
The attacks resulted in a theft of our SIM encryption keys, although not a "massive" one, whatever "massive" means.
The operation aimed to intercept the encryption keys as they were exchanged between mobile operators and their suppliers globally. By 2010, Gemalto had already widely deployed a secure transfer system with its customers and only rare exceptions to this scheme could have led to theft
Rare exceptions to our scheme led to theft.
In the case of an eventual key theft, the intelligence services would only be able to spy on communications on second generation 2G mobile networks. 3G and 4G networks are not vulnerable to this type of attack
Intelligence services were able to spy on communications on 2G mobile networks, due to this one known particular theft of SIM keys that we managed to discover. Even the most modern cell phones fall back on 3G and 2G mobile networks if 4G is not available, so this could affect any phone.
None of our other products were impacted by this attack
Products of ours were impacted by this particular attack, but at least it wasn't every single product we have.
The best counter-measures to these type of attacks are the systematic encryption of data when stored and in transit, the use of the latest SIM cards and customized algorithms for each operator
We are trying to come up with better counter-measures to prevent them from continuing to access our encryption keys.
Better known as 318230.
North Korea hacks Sony => Cyber-Terrorism
USA & Great Britain hacks Gemalto => Patriotic-Duty
Or more accurately:
North Korea hacks Sony, gets some personal info that might hurt several thousand employees => Cyber-Terrorism
USA & Great Britain hacks Gemalto, gets keys that can decrypt the communication of millions => Patriotic-Duty
Yeah, sure, Gemalto, as if we are going to believe you, you bunch of wussies.
Here is how it probably went. Cut to Gemalto HQ, and a bunch of crypto and forensic geeks working overnight, going through all the server logs with a fine comb, trying to figure out what really happened, surrounded by cans of Cola and half-eaten pizzas.
Suddenly a phone ring. Pointy-haired manager picks up the phone.
- (PHB) : "Hmmm? Oh, sure Sir, we are making good progress, we may have found... What? Oh."
(Long silence, someone is talking to PHB in hushed, urgent tone)
- (PHB) : "Yes, I understand, sir, but...", (much more quietly, almost whispering) "Oh, that contract too? You mean, every US carrier? Every single one of them? And most UK ones as well?"
(More talking on the phone)
- (PHB): "Yes sir! Right away sir!".
PHB hangs up the phone and slowly turns to the geeks, who have been watching him intently, sensing something is very wrong. PHB swallows hard, trying to look cool.
- (PHB): "Er... Ahem... Thanks for all your hard work, chaps, but upper management has given the all-clear. Nothing really happened and everything is fine. You can all go home now. No, it's OK, the taxi ride home, the drinks and the pizzas are all on me. You will all get a big fat bonus for all the extra hours, with our sincerest thanks."
Meanwhile, somewhere in a US telco HQ:
- (Different PHB): "Hi, Admiral Rogers? How are you doing? Good, good, thank you. Listen, about this SIM thing -- yeah, that one -- it's all set. I got in touch with ____ and ____ at Gemalto and they wisely decided nothing had really happened. Yes, a couple of Brits did, too, along with, you know, ____ and ____. Yeah, him too, believe it or not. (Laughter) So, all of this to say, you guys should be in the clear, nothing ever happened, blah blah blah. Sure. Nah, no biggie, always ready to help. No, no problem at all. You are welcome. Nah, don't worry about it, I'll let you know, say hello from me to ____ and ____, OK? Thanks, bye".
And that, Ladies and Gentlemen, is probably how it happened.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
PR written directly by the NSA.
There are two types of people in the world: Those who crave closure
There is no consistency at all. The US has said more than once that real-world military force is a reasonable response to state sponsored cyber attacks, yet we don't see cruise missiles headed for GCHQ or a tactical ICBM targeting NSA headquarters.
Instead other countries will develop their own cyber offence capabilities and start fighting back. It's already open season on US companies thanks to the actions of the NSA. If a US company is involved in any kind of infrastructure it can expect to have relentless attacks from foreign powers. We are on the brink of WW3, except that it won't be a traditional war fought with bombs and guns, it will by a cyber war where the lights keep going out and banks collapse as their accounts are drained and depositors pull out. Your computer, your router, your phone are all just tools that will be conscripted into foreign armies to attack your country, if they have not already been p0wned by your own cyber military looking to hide themselves.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Every time there is the slightest hint of the NSA doing something bad, especially if it is somehow related to Snowden, everyone here seem to believe it without question. However, every time there is a response saying that it may not be as bad as it seems, there are cries of LIES.
I'm not saying that intelligence agencies don't lie and that big corporations don't try to downplay serious problems but critical thinking goes both ways. For example, why focus on the keys, even in the office network, there are plenty of interesting stuff from accounting and employee data to network architecture and source code.