In the latest treasure trove of leaked documents provided by Edward Snowden, the former NSA contractor has revealed that the US and Britain broke into the network of Gemalto, the world’s largest SIM card maker to compromise global communications. The Gemalto hack, by the U.S. National Security Agency and the U.K. Government Communications Headquarters (GCHQ), allowed the two spy agencies to monitor a large portion of the world’s mobile phone voice and data traffic, according to a story in The Intercept.
By compromising the company’s internal computer network and stealing valuable encryption keys, the NSA and GCHQ have been able to render as useless the security measures used to protect communications sent through hundreds of networks the world over. One slide contained in the document showed that the GCHQ got inside of the manufacturer’s network, then stealthily installed malware that is believed to have opened up access to the SIM card maker’s entire computer system.
By possessing a copy of the encryption keys, US and UK intelligence agencies are believed to be able to crack into any affected communication, allowing authorities to eavesdrop internationally and on a mass scale without serving search warrants to local telecoms or requesting assistance from host countries. “Once you have the keys, decrypting traffic is trivial,” Christopher Soghoian, the principal technologist for the American Civil Liberties Union, told the magazine.
Mark Rumold, staff attorney at the Electronic Frontier Foundation, said there was no doubt that the spy agencies had violated Dutch law and were in all probability violating laws in many other territories when they used the hacked keys.
Gemalto, based in the Netherlands, produces about 2 billion SIM cards a year. About 450 mobile carriers, including AT&T, T-Mobile, Verizon Wireless and Sprint, use the company’s SIM cards. Gemalto said that it was unaware of the hack until The Intercept reached out to them for comment. The SIM manufacturer said it launched an investigation on its system Wednesday, but it wasn’t able to find any trace of the security breach.
Source: The Intercept
