Feeds

Greek mobile wiretap scandal unpicked

Olympics-gate dissected

Internet Security Threat Report 2014

Software extensions in the Ericsson AXE switching equipment that permitted the "lawful interception" of mobile messages and calls by law enforcement agencies were apparently subverted to create the shadow accounts used the hack, the researchers discovered. The Ericsson exchange ran software modules needed to target and clone mobile phones but not the optional control interface software, which might have been used as an auditing tool to detect rogue wiretaps.

The same approach could equally be applied to monitoring fixed-line phones, so the fact that mobile devices were targeted in this case is - technically, at least - beside the point.

Skilled infiltrators - who probably had physical access to the switches' control terminals at several exchanges - used these modules to implement the eavesdropping operation. Their presence on the system was hidden from Vodafone Greece technicians. Rootkit-style software was used to run the monitoring process. It is likely that the check-sum process used when technicians perform maintenance upgrades was also subverted. The software in four mobile switching exchanges was altered to plant back-doors that enabling snoopers to perform wiretap-related tasks without leaving a trace.

The hack was achieved using 6,500 lines of code, written in the specialist PLEX language, and planted on AXE Exchanges. Much of Ericsson's software development for the AXE has been outsourced over the last 15 years to Intracom Telecom, a Greek firm based in Athens, so the esoteric skills needed to perform the hack certainly exists locally.

Ghost in the Machine

Once Vodafone discovered the eavesdropping, after referring text message delivery problems to Ericsson, it bungled its own investigation - and frustrated those of others that might follow - by erasing crucial log data and destroying visitor sign-in books at one exchange in July 2005. It also erased rogue software and accounts instead of monitoring what was taking place. The firm was fined €76m by Greek regulators last December.

The IEEE authors criticise the response of Greek law enforcement officials who, they say, failed to secure vital evidence. During the course of the investigation, police began to treat Ericsson and Vodafone as suspects rather than victims of a sophisticated hack.

The case raised questions about the security of other phone networks and the extent to which they are penetrated by intelligence agencies or other extremely well resourced and dedicated entities. Although the technical details of how the Vodafone Greece attack took place are now known, the the destruction of crucial evidence means that the motives and identities of the perpetrators might be hidden forever.

The IEEE article has more details on the hack of the century here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.