Feeds

Greek mobile wiretap scandal unpicked

Olympics-gate dissected

Internet Security Threat Report 2014

Software extensions in the Ericsson AXE switching equipment that permitted the "lawful interception" of mobile messages and calls by law enforcement agencies were apparently subverted to create the shadow accounts used the hack, the researchers discovered. The Ericsson exchange ran software modules needed to target and clone mobile phones but not the optional control interface software, which might have been used as an auditing tool to detect rogue wiretaps.

The same approach could equally be applied to monitoring fixed-line phones, so the fact that mobile devices were targeted in this case is - technically, at least - beside the point.

Skilled infiltrators - who probably had physical access to the switches' control terminals at several exchanges - used these modules to implement the eavesdropping operation. Their presence on the system was hidden from Vodafone Greece technicians. Rootkit-style software was used to run the monitoring process. It is likely that the check-sum process used when technicians perform maintenance upgrades was also subverted. The software in four mobile switching exchanges was altered to plant back-doors that enabling snoopers to perform wiretap-related tasks without leaving a trace.

The hack was achieved using 6,500 lines of code, written in the specialist PLEX language, and planted on AXE Exchanges. Much of Ericsson's software development for the AXE has been outsourced over the last 15 years to Intracom Telecom, a Greek firm based in Athens, so the esoteric skills needed to perform the hack certainly exists locally.

Ghost in the Machine

Once Vodafone discovered the eavesdropping, after referring text message delivery problems to Ericsson, it bungled its own investigation - and frustrated those of others that might follow - by erasing crucial log data and destroying visitor sign-in books at one exchange in July 2005. It also erased rogue software and accounts instead of monitoring what was taking place. The firm was fined €76m by Greek regulators last December.

The IEEE authors criticise the response of Greek law enforcement officials who, they say, failed to secure vital evidence. During the course of the investigation, police began to treat Ericsson and Vodafone as suspects rather than victims of a sophisticated hack.

The case raised questions about the security of other phone networks and the extent to which they are penetrated by intelligence agencies or other extremely well resourced and dedicated entities. Although the technical details of how the Vodafone Greece attack took place are now known, the the destruction of crucial evidence means that the motives and identities of the perpetrators might be hidden forever.

The IEEE article has more details on the hack of the century here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.