SIM card manufacturer Gemalto said it has launched an investigation into how its systems might have been compromised following a report by The Intercept that U.S. and British spy agencies hacked its systems to steal millions of encryption keys for SIM cards made by the company.
The report, citing documents provided by former National Security Agency analyst Edward Snowden, said that the NSA and its British counterpart, Government Communications Headquarters, or GCHQ, penetrated Gemalto's internal computer systems and harvested encryption keys for SIM cards so that they could secretly monitor cellular voice and data traffic. That would have allowed the agencies to bypass the need to get permission from carriers or governments to wiretap intelligence targets' communications. However, as the report notes, it exposes a clear security hole in the SIM card encryption and distribution system.
In April 2010 the NSA and GCHQ formed the "Mobile Handset Exploitation Team," the report said, which was tasked with hacking into computer networks of companies that make SIM cards as well as those of wireless carriers.
As the report notes, individual SIM cards have their own encryption keys, which are given to carriers that let them recognize the SIM on their networks. Mobile devices authenticate themselves on the network using the SIM and encryption key by making a "handshake" that validates that the encryption key on the SIM is the one the carrier has. After that, communications between the device and the network are encrypted. However, if spy agencies could steal the keys, they could get around the encryption of voice and data traffic.
The report said GCHQ targeted unnamed wireless carriers' core networks, giving it access to "sales staff machines for customer information and network engineers machines for network maps." GCHQ also claimed to be able to trick carriers' billing servers to "suppress" charges in an effort to conceal its secret actions against an individual's phone, the report said. GCHQ also reportedly hacked into "authentication servers," allowing it to decrypt data and voice communications between a targeted individual's phone and his or her carrier's network. Hackers working for GCHQ remotely hacked into Gemalto's computer network in order to steal the encryption keys in bulk as they were being sent to carriers.
A GCHQ document said during a three-month period in 2010 the spy agencies were able to harvest millions of keys, and that as of 2009, the NSA had the capability to process between 12 and 22 million keys per second. However, the report notes that to date it is impossible to determine how many encryption keys for SIM cards have been stolen, but that "even using conservative math, the numbers are likely staggering."
The NSA and GCHQ declined to comment, according to The Intercept and other media reports.
Verizon Wireless (NYSE: VZ), AT&T Mobility (NYSE: T), Sprint (NYSE: S), T-Mobile US (NYSE:TMUS) and around 450 other wireless carriers around the world are among Gemalto's customers. Gemalto produces around 2 billion SIM cards per year, the report notes.
Gemalto noted in a statement that it was not the target of the NSA and GCHQ per se but that the agencies were attempting to "try and cast the widest net possible to reach as many mobile phones as possible, with the aim to monitor mobile communications without mobile network operators and users consent. We cannot at this early stage verify the findings of the publication and had no prior knowledge that these agencies were conducting this operation."
"Gemalto, the world leader in digital security, is especially vigilant against malicious hackers, and has detected, logged and mitigated many types of attempts over the years," the company said. "At present we cannot prove a link between those past attempts and what was reported yesterday. We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such sophisticated techniques."
For more:
- see this The Intercept article
- see this Gemalto statement
- see these two separate WSJ articles (sub. req.)
- see this Bloomberg article
- see this Reuters article
- see this The Verge article
Related Articles:
Researcher says up to 750M phones may be vulnerable to SIM card security flaw
Wickr, secure messaging startup, aims to power encrypted communications for Facebook and financial transactions
T-Mobile upgrades to A5/3 encryption on parts of GSM network in attempt to thwart eavesdropping
Apple's Cook meets with Chinese vice premier following report of iCloud hack in China
FBI director says cell phone data must be available for law enforcement