Gemalto confirms NSA and GCHQ hack but says no massive theft of SIM keys

25 Feb 2015

Gemalto has confirmed the NSA and GCHQ did indeed hack its networks, but said there had been no massive theft of SIM encryption keys, only a breach of its office network.

Gemalto produces 2bn SIM cards a year and the theft of encryption keys would have given the US and UK spy agencies respectively an unparalleled capability to access virtually any phone on the planet.

Last week, in the latest round of revelations from former CIA contractor Edward Snowden, it was claimed GCHQ and the NSA collaborated to stalk Gemalto engineers, hack into encoding machines in mobile retail stores and crack Gemalto’s servers.

However, Gemalto today said that while the NSA and GCHQ did indeed attempt to hack the company, the hacking was restricted to an office network.

“The investigation into the intrusion methods described in the document and the sophisticated attacks that Gemalto detected in 2010 and 2011 give us reasonable grounds to believe that an operation by NSA and GCHQ probably happened.

“The attacks against Gemalto only breached its office networks and could not have resulted in a massive theft of SIM encryption keys.

“The operation aimed to intercept the encryption keys as they were exchanged between mobile operators and their suppliers globally. By 2010, Gemalto had already widely deployed a secure transfer system with its customers and only rare exceptions to this scheme could have led to theft.

“In the case of an eventual key theft, the intelligence services would only be able to spy on communications on second-generation 2G mobile networks. 3G and 4G networks are not vulnerable to this type of attack.

“None of our other products were impacted by this attack.

“The best counter-measures to these type of attacks are the systematic encryption of data when stored and in transit, the use of the latest SIM cards and customised algorithms for each operator,” Gemalto said.

Gemalto said that in 2010 and 2011, it detected two particular intrusions that could have related to the NSA/GCHQ operation.

“In June 2010, we noticed suspicious activity in one of our French sites where a third party was trying to spy on the office network. By office network we mean the one used by employees to communicate with each other and the outside world. Action was immediately taken to counter the threat.

“In July 2010, a second incident was identified by our security team. This involved fake emails sent to one of our mobile operator customers spoofing legitimate Gemalto email addresses. The fake emails contained an attachment that could download malicious code. We immediately informed the customer and also notified the relevant authorities both of the incident itself and the type of malware used.

“During the same period, we also detected several attempts to access the PCs of Gemalto employees who had regular contact with customers.

“At the time we were unable to identify the perpetrators but we now think that they could be related to the NSA and GCHQ operation.”

Oranges and onions

Gemalto said the intrusions only affected the outer part of its networks, which are in contact with the outside world.

“The SIM encryption keys and other customer data in general, are not stored on these networks. It is important to understand that our network architecture is designed like a cross between an onion and an orange; it has multiple layers and segments which help to cluster and isolate data.

“No breaches were found in the infrastructure running our SIM activity or in other parts of the secure network which manage our other products, such as banking cards, ID cards or electronic passports. Each of these networks is isolated from one another and they are not connected to external networks.”

Gemalto said it is extremely difficult to attack a large number of SIM cards on an individual basis and that’s why the intelligence agencies chose to attack the data as it was transmitted between suppliers and mobile operators.

The nature of Gemalto’s security mitigated the risk of the data being intercepted during transmission.

It found the attacks were targeted at mobile operators in Afghanistan, Yemen, India, Serbia, Iran, Iceland, Somalia, Pakistan and Tajikistan. 

In relation to documents leaked by Snowden, Gemalto insisted it never sold SIM cards to four of the 12 operators listed in the documents, including a Somali carrier that had 300,000 SIM keys stolen.

It also said 3G or 4G SIMs could not be affected by such an attack described in the leaked documents.

But it said security is a cat-and-mouse game, where innovation requires companies to be one step ahead of hackers all the time.

“Digital security is not static. Today’s state-of-the-art technologies lose their effectiveness over time as new research and increasing processing power make innovative attacks possible. All reputable security products must be redesigned and upgraded on a regular basis. SIM cards are no different and they have evolved over time. In particular, the technology was massively redeveloped for 3G and 4G networks.

“Security is even higher for mobile operators who work with Gemalto to embed custom algorithms in their SIM cards. The variety and fragmentation of algorithmic technologies used by our customers increases the complexity and cost to deploy massive global surveillance systems.

“This is one of the reasons why we are opposed to alternative technologies which would limit operators’ ability to customise their security mechanisms. Such technology would make it much simpler to organise mass surveillance should the technology unfortunately be compromised or fail,” Gemalto said.

SIM image via Shutterstock

John Kennedy is a journalist who served as editor of Silicon Republic for 17 years