You May Be Too Late

But if you had a little sideline manufacturing such stickers, you could probably have made a few bucks.

CIA Is Everywhere

European officials are demanding answers and investigations into a joint U.S. and U.K. hack of the world’s largest manufacturer of mobile SIM cards [Gemalto], following a report published by The Intercept Thursday.

[...]

Analysts at Dutch financial services company Rabobank speculated in a research note that Gemalto could be forced to recall “a large number” of SIM cards.

  The Intercept

And how could we be certain the new SIM cards weren’t equally compromised?

Deutsche Telekom AG, a German company, said it has changed encryption algorithms in its Gemalto SIM cards.

“We currently have no knowledge that this additional protection mechanism has been compromised,” the company said in a statement. “However, we cannot rule out this completely.”

[...]

Sophie in ’t Veld, an EU parliamentarian with D66, the Netherlands’ largest opposition party, added, “Year after year we have heard about cowboy practices of secret services, but governments did nothing and kept quiet […] In fact, those very same governments push for ever-more surveillance capabilities, while it remains unclear how effective these practices are.”

“If the average IT whizzkid breaks into a company system, he’ll end up behind bars,” In ’t Veld added in a tweet Friday.

[...]

[Gemalto’s] clients include AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers. “[We] believe we have their entire network,” GCHQ boasted in a leaked slide, referring to the Gemalto heist.

[...]

While Gemalto was indeed another casualty in Western governments’ sweeping effort to gather as much global intelligence advantage as possible, the leaked documents make clear that the company was specifically targeted.

And, why would that be?

The French daily L’Express noted today that Gemalto board member Alex Mandl was a founding trustee of the CIA-funded venture capital firm In-Q-Tel. The French daily L’Express noted today that Gemalto board member Alex Mandl [an Austrian-American businessman who was once a top executive at AT&T] was a founding trustee of the CIA-funded venture capital firm In-Q-Tel. [...] In 2003, a group of French lawmakers tried unsuccessfully to create a commission to investigate Gemplus’s ties to the CIA and its implications for the security of SIM cards.

White House Response to SIM Card Heist

'If they'd known we were doing it, they would have approved.'

 

Also from that WSJ article…

The NSA has tried in the past two years to deflect criticism of its spying practices, such as collecting bulk telephone records, saying it targets adversaries with its spying practices. But few would argue Gemalto fits that description.

[...]

U.S. officials haven’t confirmed that such information was stolen, or, if it was stolen, whether it was ever used. Multiple U.S. officials are referring questions on the leak to the NSA, which has not responded to multiple requests for comment.

  Wall Street Journal

Big Time Drip from the Snowden Leak

AMERICAN AND BRITISH spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden.

[...]

With these stolen encryption keys, intelligence agencies can monitor mobile communications without seeking or receiving approval from telecom companies and foreign governments. Possessing the keys also sidesteps the need to get a warrant or a wiretap, while leaving no trace on the wireless provider’s network that the communications were intercepted. Bulk key theft additionally enables the intelligence agencies to unlock any previously encrypted communications they had already intercepted, but did not yet have the ability to decrypt.

[...]

The company targeted by the intelligence agencies, Gemalto, is a multinational firm incorporated in the Netherlands that makes the chips used in mobile phones and next-generation credit cards. Among its clients are AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers around the world.

[...]

Gemalto was totally oblivious to the penetration of its systems.

[...]

In all, Gemalto produces some 2 billion SIM cards a year. Its motto is “Security to be Free.”

  Jeremy Scahill

Yeah Buddy.  Feeling a little silly now?  Or just shafted?

According to one secret GCHQ slide, the British intelligence agency penetrated Gemalto’s internal networks, planting malware on several computers, giving GCHQ secret access. We “believe we have their entire network,” the slide’s author boasted about the operation against Gemalto.

[...]

[A]fter being contacted by The Intercept, Gemalto’s internal security team began on Wednesday to investigate how their system was penetrated and could find no trace of the hacks.

[...]

Additionally, the spy agency targeted unnamed cellular companies’ core networks, giving it access to “sales staff machines for customer information and network engineers machines for network maps.” [...] Most significantly, GCHQ also penetrated “authentication servers,” allowing it to decrypt data and voice communications between a targeted individual’s phone and his or her telecom provider’s network. A note accompanying the slide asserted that the spy agency was “very happy with the data so far and [was] working through the vast quantity of product.”

[...]

“Gaining access to a database of keys is pretty much game over for cellular encryption,” says Matthew Green, a cryptography specialist at the Johns Hopkins Information Security Institute. The massive key theft is “bad news for phone security. Really bad news.”

Do we all get new free SIM cards? Will the government have the keys to those, too? We wouldn't know, would we?