Schneier on Security

The technical commitee that examines the issue concluded that the "intruders" must have had physical access --there was no way this could have been done remotely. So it's an insider thing.

Link (in Greek, unfortunately, but you can translate at systran.otenet.gr):
http://www.enet.gr/online/online_hprint.jsp?q=%F5%F0%EF%EA%EB%EF%F0%DD%F2&a=&id=80225496

@Dimitris:

Thanks for that additional info.

This underlines the point that "law enforcement" backdoors invite insider abuse.

Although it is partly an insider attack, keep in mind that those avenues are always open...

In the original Latin...

"Nihil tam munitum quod non expugnari pecuna possit" --Cicero

or "No fortress is so strong it cannot be taken by money" ...

You can always buy an insider for the physical access part. If you are ingenious enough, you only need to buy the insider once, and if you are really ingenious, the insider doesn't even know what they enabled.

In this case, without the lawful intercept system, the damage an insider could have done would have been much more limited.

So, Vodaphone detected this abuse of their mandated lawful intercept backdoor through 'routine' software controls. That's an interesting explanation -- and raises some questions of its own.

But I'm more interested in:

Who were the attackers/evesdroppers?
Is it known what the evesdroppers heard?
Have there been arrests?

When the police can coerce a communication service into giving them a backdoor, they will also force them to prevent an audit trail. Why? Because the police will want to spy without the impediments of warrants. When they find somebody dirty, then they can dummy up some evidence to show the judge to get the warrant, then use the warrant-supported surveillance in court to convict the dirty guy.

Our FBI calls their own illegal unwarranted surveillance 'intel', as opposed to 'evidence', which they can use in court.

Because there is no audit trail, the system is open to anyone who learns how to get in.

Our judiciary subscribes to the idiotic premise that the police cannot uphold the law without breaking it first. I submit that this is the root of all evil.

@Dimitris Andrakakis

I call bull. This could definitely be done without physical access. Telephone exchanges are esentially large computers. Everything is remotely accessible. Doing so without insider knowledge would be difficult, but not nearly impossible depending on the level of security of the network. The one thing which would often be done with local access would be the installation/activation of the lawful interception software.

Please note also, that the papers given by Bruce do not describe the monitoring system. They describe the monitoring _management_ system. That would be a physically separate computer. The claim that the software was installed secretly wouldn't really match with an extra HP workstation suddenly appearing.

It is possible that the standard switch software used in Greece has the needed MML commands, but the IMS its self wasn't installed. The intercepts would have been configured manually. Note, that the Ericsson architecture described in the documents means that if there wasn't a central IMS, the attackers had access to every individual switch in the network (10s accross different cities) or at least several (required just to monitor subscribers moving around Athens).

I do not understand the bit about the interception only being active when the phones were calling. How do you know the phone is calling if there isn't an interception set up? Maybe it just means "if nobody was calling, then they weren't monitoring the call" which is kind of obvious.

Given what we've heard so far, which seems quite skillful, I wonder what they would have found if they did locate the phones? A secure room with a high speed internet connection? Data being uploaded to zombies in a different country?

...another case to show the usefulness of end-to-end encryption of (mobile) communication... these people are just insane to allow a prime minister and other officials to use normal mobile phone equipment...

@moz:

Interesting analysis, thanks.

"...if they did locate the phones? A secure room with a high speed internet connection?"

Perhaps going out over WPA2 encrypted 802.11g over a 20 dBi flat panel antenna mounted sideways, to give +/-45° vertically and 10° horizontally. With the antenna mounted on a rotatable shaft, and the moment the burglar alarm triggers, a solenoid switches off and a falling weight rotates the mast to a random direction. The GSM modems, 802.11 base and glue logic are sitting in a cheap fire-resisting safe lying on its back (antenna cables and power running out the bolt-down holes), and seconds later the thermite turns it all to slag.

I've heard some rumors about telnetd on Ericssons AXE platform having a backdoor, something like the old "service accounts"... see my link for details.

The newspaper "Ta Nea" says that "maximum 10 people at Ericsson and Vodafone" had access to the systems.

Tryed to post a trackback, but all I get is "You are pinging trackbacks too quickly. Please try again later." even though I haven't sent a trackback here in weeks.

@moz:

I'm by no means a security expert, much less a telco one. This is a conclusion from the Authority for the Information and Communication Security and Privacy.

Hm.. I don't now!

Dear Sir,

I want to know Mr Bruce Schneier.

Why? He has been my hero since i started to know about cryptography. And now, i am writing on cryptography as my project. I need his technical assistance, it's a lot of of units this project work, and i want to score an "A"

My name is Nathan O. Justice