U.S. and Britain Work Together to Pull off SIM Card Heist

U.S. and Britain Work Together to Pull off SIM Card Heist

Ever feel like you’re being watched or followed, but when you turn around no one is there? This could also be happening in your digital life. A new report by The Intercept claims that two of the world’s most powerful spy agencies, the NSA (US) and GCHQ (UK) worked in cahoots to hack the network of Gemalto, a major manufacturer of SIM cards to obtain secret keys that unlock phone data. This massive security breach means that your phone may be vulnerable.

The total number affected is still unknown; however, I suspect the number is fairly large since Gemalto has AT&T, Verizon, T-Mobile and Sprint as their customers.

NSA collects data over the Internet in these two ways:

  • Downstream collection: explicit requests to technology companies for user data; and
  • Upstream collection: pulling data directly from cables/airwaves.

Here’s how this data breach went down:

  • Individual employees of major telecom corps and SIM card manufacturers were targeted by GCHQ.
  • GCHQ accessed the employees’ email and Facebook accounts.
  • GCHQ gathered bits of information that lead them to Gemalto’s systems.
  • Many SIM card manufacturers sent weak keys or non-encrypted keys.

Things you should know about the security breach:

  • Gemalto produces approximately 2 billion SIM cards/year.
  • Gemalto’s motto – “Security to be Free.”
  • Stolen encryption keys enable monitoring of mobile communications.
  • Bulk key theft enables previously encrypted communications to be unlocked.
  • Gemalto seemed to be oblivious to the breach.

By pulling off this encryption key heist, these US and the UK intelligence agencies each have the ability to not only intercept but decrypt communications without informing the wireless network provider, foreign governments or the individual user targeted.

About the Author

Ginger Hill is Group Social Media Manager.

Featured

  • Return to Form

    My first security trade show was in 2021. At the time, I was awed by the sheer magnitude of the event and the spectacle of products on display. But this was the first major trade show coming out of the pandemic, and the only commentary I heard was how low the attendance was. Two representatives from one booth even spent the last morning playing catch in the aisle with their giveaway stress balls. Read Now

    • Industry Events
    • ISC West
  • Live from ISC West: Day 1 Recap

    The first day of ISC West 2023 is in the books, and it’s safe to say that vendors have brought their A-game to Las Vegas. The booths of this year’s Live From partners—NAPCO Security, Alibi Security, Vistacom, RGB Spectrum, and DoorKing—were swamped all day long. Here’s a brief recap of just a few highlights from each partner’s presence at the show. Read Now

    • Industry Events
    • ISC West
  • Turn on the AC, ISC West is Hot

    Nothing warm about the Las Vegas weather outside. It is cold, and it was raining after the opening day. No one seemed to care inside the convention center. The hall was packed with inquisitive security professionals. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2023: Day 1

    ISC West 2023 in Las Vegas, Nevada, has officially begun! Make sure to keep an eye on Security Today’s ISCW Live 2023 page, as well as our associated Twitter accounts—@SecurToday and @CampusSecur—for the latest updates from the show floor at the Venetian Expo. Read Now

    • Industry Events
    • ISC West
Most   Popular

Featured Cybersecurity

New Products

  • PACE® Long Range Ethernet Solutions

    PACE® Long Range Ethernet Solutions

    Altronix introduces the newest addition to its portfolio of PACE® Long Range Ethernet Solutions. 3

  • Camden Door Controls CV-603 2 Door Bluetooth Access Control System

    Camden Door Controls CV-603 2 Door Bluetooth Access Control System

    his app-based system is designed to provide ‘best in class’ security of doors and gates, with up to 2,000 users. The intuitive programming app is Apple® and Android® compatible, with easy to use system set-up, user administration, downloadable audit trail and data back-up. 3

  • BriefCam v6.0

    BriefCam v6.0

    BriefCam has released BriefCam v6.0, which introduces the new deployment option of a multi-site architecture. This enables businesses with multiple, distributed locations to view aggregate data from all remote sites to uncover trends across locations, optimize operations and boost real-time alerting and response – all while continuing to reap the benefits of BriefCam's powerful analytics platform for making video searchable, actionable and quantifiable. 3