NSA steals SIM card encryption keys from largest manufacturer Gemalto

dalta5billion · 19-02-2015 09:54PM #1

https://firstlook.org/theintercept/2015/02/19/great-sim-heist/

This is hilarious: for all our nail-biting over rainbow tables and statistical flaws in GSM encryption - the NSA and GCHQ just waltzed in and stole all the keys.

I'm *so* done.

Shannon757 · 19-02-2015 10:05PM

Snowden didn't tell us that did he?

dalta5billion · 19-02-2015 10:09PM

Shannon757 wrote: »

Snowden didn't tell us that did he?

Excellent point. I've wondered about the ethics of Greenwald holding back on information- that is, unless there's another leak.

industrialhorse · 19-02-2015 10:44PM

Have you'se ever stopped to consider that Snowden probably got his hands on as much information as he could at that time but other NSA projects (like this!) may have been in their earliest stages and had their data stored on the local drives of direct employee's machines or at a much higher level of access than Snowden was afforded?

dalta5billion · 19-02-2015 10:49PM

industrialhorse wrote: »

Have you'se ever stopped to consider that Snowden probably got his hands on as much information as he could at that time but other NSA projects (like this!) may have been in their earliest stages and had their data stored on the local drives of direct employee's machines or at a much higher level of access than Snowden was afforded?

Yeah, it's crazy to read of 2010 programmes with no idea of what else they had in store.

I would guess with the rise of open source crypto they'll be focusing on influencing that by pushing algorithms they know to be flawed, and using more backdoors like the ones we're seeing now.

Impetus · 20-02-2015 08:25AM

Ki keys for millions of SIM cards have been stolen by CIA/GCHQ bh. hackers. Cards made by Gemalto (NL) are known to be compromised.

The Ki code is used in the encryption and authentication process for mobile phone calls. Access to these codes enable snoops to listen to mobile phone traffic (eg using fake cellsites or co-operating mobile networks). I would have thought that mobile phones issued to senior government and political figures are a key target.

Cards used by networks based in Ireland, Iceland, India, Yemen, Afghanistan, Iran and Somalia are included in the Ki theft, according to Ars.

Gemalto produce about 2 billion SIM cards per annum.

Depending on the network, some SIMs have the manufacturer’s logo. Gemalto’s shares are down about 7% since yesterday’s close -
http://www.aex.nl/nl/products/equities/NL0000400653-XAMS/quotes

http://www.faz.net/aktuell/politik/snowden-dokumente-nsa-knackt-verschluesselung-von-sim-karten-13439240.html

http://arstechnica.com/tech-policy/2015/02/sim-card-makers-hacked-by-nsa-and-gchq-leaving-cell-networks-wide-open/

https://firstlook.org/theintercept/2015/02/19/great-sim-heist/

dbit · 20-02-2015 01:57PM

Ticket to india , a backpack and a tin opener good luck and thanks . There is a spoon and NSA owns them all. :-(

jmcc · 20-02-2015 03:15PM

GSM is not and never was secure.

Regards...jmcc

digitalninja · 20-02-2015 03:22PM

Shannon757 wrote: »

Snowden didn't tell us that did he?

From the article's first line:

according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden.

dalta5billion · 20-02-2015 03:33PM

jmcc wrote: »

GSM is not and never was secure.

Regards...jmcc

It most definitely wasn't secure against active attacks. The problem with this breach is that it enabled the NSA and GCHQ to do passive attacks.

jmcc · 20-02-2015 03:39PM

dalta5billion wrote: »

It most definitely wasn't secure against active attacks. The problem with this breach is that it enabled the NSA and GCHQ to do passive attacks.

It was not and is not secure. And having the Ki, amongst other data, allows for a lot more than just passive attacks.

Regards...jmcc

Impetus · 20-02-2015 05:13PM

jmcc wrote: »

GSM is not and never was secure.

Regards...jmcc

Agreed. UMTS is more secure. But if you are listening to 2 Mbits/sec of wireless traffic, encrypted, you hae a huge computing requirement to decrypt each channel of traffic, listen to it and examine the C7 data, it taken a lot of computing power, to see if the chatter is of interest or background noise. However, if you have the keys, it makes the job much simpler. It changes the task from brute force on lots of separately encrypted voice channels to an "open the padlock with the key" job.

Hotblack Desiato · 21-02-2015 07:28PM

jmcc wrote: »

GSM is not and never was secure.

Regards...jmcc

Never mind arguments over protocols. It has always been extremely foolish to assume the networks are not compromised by the authorities who issue their licences to operate.

NSA steals SIM card encryption keys from largest manufacturer Gemalto

Comments