Menu
Gemalto says spies probably didn't steal mobile phone encryption keys from it after all

Gemalto says spies probably didn't steal mobile phone encryption keys from it after all

After an internal investigation, Gemalto said hacks on its network didn't breach separate infrastructure protecting SIM card encryption keys

SIM card maker Gemalto has dismissed recent reports that U.K. and U.S. spies obtained encryption keys protecting millions of mobile phones by hacking its network.

Secret documents revealed last week suggested that spies from the U.S. National Security Agency and the U.K. Government Communications Headquarters had stolen SIM card encryption keys from Gemalto, allowing them to intercept the conversations of millions of mobile phone users. The GCHQ documents, dating from 2010, were among those leaked by former NSA contractor Edward Snowden.

On Wednesday, though, Gemalto said that while it had detected sophisticated attacks on its office networks in 2010 and 2011 that it now believed were probably conducted by the NSA and GCHQ, these could not have led to the massive theft of SIM encryption keys.

While the leaked documents showed the spies boasting "(We) believe we have their entire network," Gemalto said that its internal investigation showed that the intrusions only breached its office network, and not the entirely separate infrastructure used for generating and transmitting the SIM card encryption keys.

By 2010 those keys were being exchanged with its network operator customers by secure means in all but a few cases, making the wholesale theft of the keys unlikely and meaning that Gemalto could not have been the source of the massive leaks reported, it said.

Furthermore, Gemalto had never sold SIM cards to four of the 12 networks named in the leaked documents, so it could not have been the source of, for example, 300,000 SIM encryption keys stolen from a Somali carrier, it said.

That doesn't exclude the possibility that the keys were stolen from other SIM manufacturers, though: Gemalto is the largest, but not the only, supplier of the devices.

Even if the spy agencies had somehow stolen SIM encryption keys from Gemalto, only communications on second-generation mobile networks such as GSM would be vulnerable, not the newer 3G and 4G networks introduced by many operators after 2010, the company said.

Gemalto assumed for the purposes of its investigation that the leaked documents were genuine and accurate, but did not seek to confirm or refute the documents' claims, it said.

Outsiders regularly -- and unsuccessfully -- try to hack its networks, it said, and only a few attempts breach even the outer levels of its network.

In June 2010, it detected and immediately countered an attack seeking to spy on the office network at one of its French sites.

The following month, some of its network operator customers received emails from spoofed Gemalto addresses, with attachments containing malware.

Around that time, attacks were also made on the PCs of Gemalto staff in contact with customers.

Following its investigation, Gemalto said it planned to improve its security processes and continue monitoring its networks. Barring further developments in this case, though, however, it plans to make no further comment on the matter.

Peter Sayer covers general technology breaking news for IDG News Service, with a special interest in open source software and related European intellectual property legislation. Send comments and news tips to Peter at peter_sayer@idg.com.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags telecommunicationGemaltosecurityU.S. National Security AgencyU.K. Government Communications Headquarters (GCHQ)

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments