MillenniumPost
Business

US, UK intel ‘hacked’ EU SIM firm Gemalto, show Snowden papers

Investigative website The Intercept said the US National Security Agency and Britain’s GCHQ hacked into the firm in 2010 and 2011 and stole SIM encryption keys, with which they can reportedly monitor communications over mobiles without using a warrant or wiretap.

The website made the allegations on the theft of the keys — which encrypt and decrypt data — based on a document leaked by former NSA contractor Edward Snowden, and its report prompted some experts to decry a huge breach in mobile privacy.

“In 2010 and 2011, we detected two particularly sophisticated intrusions which could be related to the operation,” Gemalto said in a statement. “During the same period, we also detected several attempts to access the PCs of Gemalto employees who had regular contact with customers,” it added. “At the time we were unable to identify the perpetrators but we now think that they could be related to the NSA and GCHQ operation.”

But the company denied that these attacks resulted in a large-scale theft of encryption keys. “The attacks against Gemalto only breached its office networks and could not have resulted in a massive theft of SIM encryption keys,” it said.

The company said the aim of the operation was to intercept the encryption keys as they were exchanged between mobile operators and suppliers such as Gemalto. But “by 2010, Gemalto had already widely deployed a secure transfer system with its customers and only rare exceptions to this scheme could have led to theft.” “In the case of an eventual key theft, the intelligence services would only be able to spy on communications on second generation 2G mobile networks. “3G and 4G networks are not vulnerable to this type of attack.”
Next Story
Share it