Feeds

Greek mobile wiretap scandal unpicked

Olympics-gate dissected

Choosing a cloud hosting partner with confidence

Software extensions in the Ericsson AXE switching equipment that permitted the "lawful interception" of mobile messages and calls by law enforcement agencies were apparently subverted to create the shadow accounts used the hack, the researchers discovered. The Ericsson exchange ran software modules needed to target and clone mobile phones but not the optional control interface software, which might have been used as an auditing tool to detect rogue wiretaps.

The same approach could equally be applied to monitoring fixed-line phones, so the fact that mobile devices were targeted in this case is - technically, at least - beside the point.

Skilled infiltrators - who probably had physical access to the switches' control terminals at several exchanges - used these modules to implement the eavesdropping operation. Their presence on the system was hidden from Vodafone Greece technicians. Rootkit-style software was used to run the monitoring process. It is likely that the check-sum process used when technicians perform maintenance upgrades was also subverted. The software in four mobile switching exchanges was altered to plant back-doors that enabling snoopers to perform wiretap-related tasks without leaving a trace.

The hack was achieved using 6,500 lines of code, written in the specialist PLEX language, and planted on AXE Exchanges. Much of Ericsson's software development for the AXE has been outsourced over the last 15 years to Intracom Telecom, a Greek firm based in Athens, so the esoteric skills needed to perform the hack certainly exists locally.

Ghost in the Machine

Once Vodafone discovered the eavesdropping, after referring text message delivery problems to Ericsson, it bungled its own investigation - and frustrated those of others that might follow - by erasing crucial log data and destroying visitor sign-in books at one exchange in July 2005. It also erased rogue software and accounts instead of monitoring what was taking place. The firm was fined €76m by Greek regulators last December.

The IEEE authors criticise the response of Greek law enforcement officials who, they say, failed to secure vital evidence. During the course of the investigation, police began to treat Ericsson and Vodafone as suspects rather than victims of a sophisticated hack.

The case raised questions about the security of other phone networks and the extent to which they are penetrated by intelligence agencies or other extremely well resourced and dedicated entities. Although the technical details of how the Vodafone Greece attack took place are now known, the the destruction of crucial evidence means that the motives and identities of the perpetrators might be hidden forever.

The IEEE article has more details on the hack of the century here. ®

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.