Feeds

Greek mobile wiretap scandal unpicked

Olympics-gate dissected

Security for virtualized datacentres

Software extensions in the Ericsson AXE switching equipment that permitted the "lawful interception" of mobile messages and calls by law enforcement agencies were apparently subverted to create the shadow accounts used the hack, the researchers discovered. The Ericsson exchange ran software modules needed to target and clone mobile phones but not the optional control interface software, which might have been used as an auditing tool to detect rogue wiretaps.

The same approach could equally be applied to monitoring fixed-line phones, so the fact that mobile devices were targeted in this case is - technically, at least - beside the point.

Skilled infiltrators - who probably had physical access to the switches' control terminals at several exchanges - used these modules to implement the eavesdropping operation. Their presence on the system was hidden from Vodafone Greece technicians. Rootkit-style software was used to run the monitoring process. It is likely that the check-sum process used when technicians perform maintenance upgrades was also subverted. The software in four mobile switching exchanges was altered to plant back-doors that enabling snoopers to perform wiretap-related tasks without leaving a trace.

The hack was achieved using 6,500 lines of code, written in the specialist PLEX language, and planted on AXE Exchanges. Much of Ericsson's software development for the AXE has been outsourced over the last 15 years to Intracom Telecom, a Greek firm based in Athens, so the esoteric skills needed to perform the hack certainly exists locally.

Ghost in the Machine

Once Vodafone discovered the eavesdropping, after referring text message delivery problems to Ericsson, it bungled its own investigation - and frustrated those of others that might follow - by erasing crucial log data and destroying visitor sign-in books at one exchange in July 2005. It also erased rogue software and accounts instead of monitoring what was taking place. The firm was fined €76m by Greek regulators last December.

The IEEE authors criticise the response of Greek law enforcement officials who, they say, failed to secure vital evidence. During the course of the investigation, police began to treat Ericsson and Vodafone as suspects rather than victims of a sophisticated hack.

The case raised questions about the security of other phone networks and the extent to which they are penetrated by intelligence agencies or other extremely well resourced and dedicated entities. Although the technical details of how the Vodafone Greece attack took place are now known, the the destruction of crucial evidence means that the motives and identities of the perpetrators might be hidden forever.

The IEEE article has more details on the hack of the century here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.