SIM card makers hacked by NSA and GCHQ leaving cell networks wide open

By AFP on February 22, 2015  
 
It would be another powerful tool in the arsenal of US and British spy services: encryption keys for a large share of the SIM cards used for mobile phones.
A report by the investigative news website The Intercept, citing leaked documents from former National Security Agency contractor Edward Snowden, said the US and British agencies "hacked into" European manufacturer Gemalto to gain these keys.
The report, if accurate, could allow the NSA and its British counterpart GCHQ to secretly monitor a large portion of global communications over mobile devices without using a warrant or wiretap.
"This is a huge deal," said Bruce Schneier, a cryptographer who is chief technology officer at the security firm Resilient Systems, and a fellow at Harvard's Berkman Center.
"The things that are the most egregious are when the NSA hacks everybody to get a few people," Schneier told AFP.
 
full article

By  Tom Paye Published  February 23, 2015
 
The United States NSA and the UK's GCHQ reportedly hacked into a major SIM card manufacturing firm, with the aim of using stolen codes to help monitor mobile phone conversation and activity.
 
The revelations were made last week as the latest round of Edward Snowden files were published by The Intercept. The company involved, Gemalto, said that it had no prior knowledge that agencies were conducting such an operation.
 
 
full article

See Also  Gemalto may need to recall SIMs: Snowden
 
Posted on 25 February 2015. "The investigation into the intrusion methods described in the document and the sophisticated attacks that Gemalto detected in 2010 and 2011 give us reasonable grounds to believe that an operation by NSA and GCHQ probably happened," Gemalto announced on Wednesday.

The company noted that they, as a digital security company, experience a lot of attacks and that looking back at the period covered by Snowden's documents, there were two "particularly sophisticated intrusions" that could have been effected by the intelligence agencies.

But they say that these intrusions affected only their office networks, and that SIM encryption keys and other customer data are not stored on those networks. "No breaches were found in the infrastructure running our SIM activity or in other parts of the secure network which manage our other products such as banking cards, ID cards or electronic passports. Each of these networks is isolated from one another and they are not connected to external networks," they reassured. 
Full Article
 
Article in ITPRO NSA & GCHQ SIM card hack: Gemalto denies encryption keys stolen through hack

Well I think they are in danger of losing all credibility soon from the impression this article gives us.
 
25th February 2015 By By Jeremy Scahill
 
In a written presentation of its findings, Gemalto claims that “in the case of an eventual key theft, the intelligence services would only be able to spy on communications on second generation 2G mobile networks. 3G and 4G networks are not vulnerable.” Gemalto also referred to its own “custom algorithms” and other, unspecified additional security mechanisms on top of the 3G and 4G standards.
 
Green, the Johns Hopkins cryptography specialist said Gemalto’s claims are flatly incorrect.
“No encryption mechanism stands up to key theft,” Green says, “which means Gemalto is either convinced that the additional keys could not also have been stolen or they’re saying that their mechanisms have some proprietary ‘secret sauce’ and that GCHQ, backed by the resources of NSA, could not have reverse engineered them. That’s a deeply worrying statement.”
 
Full Article