Gemalto NV, the largest maker of mobile-phone cards, said it’s investigating a report that U.S. and U.K. spies allegedly hacked into its computer network to steal the keys used to encrypt conversations, messages and data traffic.

The U.K.’s Government Communications Headquarters and the U.S. National Security Agency started intercepting the encoders in 2010 as they were being shipped to phone companies, allowing them to monitor wireless communications and bypass the need to get permission for wiretapping, the Intercept reported Thursday, citing documents from former NSA contractor Edward Snowden.

Gemalto is a particularly valuable holder of the keys as the French company produces 2 billion SIM cards every year, according to the report.

“The publication indicates the target was not Gemalto per se — it was an attempt to try and cast the widest net possible to reach as many mobile phones as possible, with the aim to monitor mobile communications without mobile network operators and users consent,” Gemalto said in a press statement Friday, adding it couldn’t immediately verify the findings in the report.

In an e-mailed statement, GCHQ said it couldn’t comment on intelligence matters, citing agency policy.

The theft of encryption keys would potentially allow U.S. and U.K. agencies to also unlock communications it had recorded but was previously unable to unlock, the Intercept said.

A U.K. court this month ruled against the nation’s spy agencies for the first time, saying its mass collection of Internet and phone data was illegal until late last year. The data-sharing program with U.S. agencies contravened privacy and free-speech provisions in the European Convention on Human Rights, the Investigatory Powers Tribunal said Feb. 6 in London.

According to the Intercept, the spies planted malware on several of Gemalto’s computers and obtained access to private communications among employees to help them set up the theft. They also targeted unidentified mobile-phone companies to gain insight into customers and network maps, and tapped into authentication servers that verify communication between an end user and the network operator, according to the report

http://www.bbc.co.uk/news/technology-31545050
How does the hack work?

Each Sim card has an individual encryption key, installed by the chip manufacturer, that secures communications between the handset in which it inserted and mobile phone masts.

This means that if anyone were to snoop on conversations or text messages, they would receive garbled, unintelligible data.

That is, of course, unless those carrying out the surveillance get hold of the encryption key. With that information, they can even decrypt previously intercepted communications.

However, this tactic only works for phone conversations and text messages. Communications through mobile applications such as Whatsapp, iMessage and many email services have separate encryption systems.
line break

The stolen encryption allowed the agencies to decode data that passes between mobile phones and cell towers. They were able to decrypt calls, texts or emails intercepted out of the air.

A Gemalto spokeswoman said the company was unable to verify whether there had indeed been a breach, and highlighted that other Sim manufacturers could also have been targeted.

She added: "We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such highly sophisticated techniques to try to obtain Sim card data".

frank lee bent wrote:sure