Sim card database hack gave US and UK spies access to billions of cellphones

American and British spies hacked into the world’s largest sim card manufacturer in a move that gave them unfettered access to billions of cellphones around the globe and looks set to spark another international row into overreach by espionage agencies.

The National Security Agency (NSA) and its British equivalent GCHQ hacked into Gemalto, a Netherlands sim card manufacturer, stealing encryption keys that allowed them to secretly monitor both voice calls and data, according to documents newly released by NSA whistleblower Edward Snowden.

Sim card database hack gave US and UK spies access to billions of cellphones

More big, depressing and unsurprising news from the Snowden leaks.
Most of us knew this was likely already, but the infiltration at a low level into every aspect of our digital lives seems to have covered practically all angles.
When it's done at such a fundamental level as this, what hope do we have?

Edit to add:

More detailed article which was the origin of this story from The Intercept HERE.

To make matters worse, I'm sure it won't just be SIM card data that has been targeted. Gemalto is a world leader in digital security, the list of services and products they offer from their website here:

FINANCIAL SERVICES & RETAIL

Mobile & Apps
eBanking & eCommerce
Cards & Payment
Platform & Services
GOVERNMENT
Identity
Travel
Health
Traffic

IDENTITY & ACCESS

Cards, Tokens & Readers
Bundled Solutions
SSO & Access Management

MACHINE TO MACHINE

Products & services
Markets
Development

MOBILE

NFC & Mobile Commerce
Connectivity & Network
Mobile ID & Security

TRANSPORT

Products
NFC & Services

Hopefully the Dutch government will be furious about this as they have strict rules regarding even official hacking and spying.

“It’s unbelievable. Unbelievable,” said Gerard Schouw, a member of the Dutch Parliament, when told of the spy agencies’ actions. Schouw, the intelligence spokesperson for D66, the largest opposition party in the Netherlands, told The Intercept, “We don’t want to have the secret services from other countries doing things like this.” Schouw added that he and other lawmakers will ask the Dutch government to provide an official explanation and to clarify whether the country’s intelligence services were aware of the targeting of Gemalto, whose official headquarters is in Amsterdam.

Last November, the Dutch government amended its constitution to include explicit protection for the privacy of digital communications, including those made on mobile devices. “We have, in the Netherlands, a law on the [activities] of secret services. And hacking is not allowed,” Schouw said. Under Dutch law, the interior minister would have to sign off on such operations by foreign governments’ intelligence agencies. “I don’t believe that he has given his permission for these kind of actions.”

THE GREAT SIM HEIST
HOW SPIES STOLE THE KEYS TO THE ENCRYPTION CASTLE

What about phones that dont run on sim cards??link to phone stats

a reply to: ATF1886

Any phone on a standard digital telecommunications will have a SIM card, if it's not one you can change it would have to be built into the device. The only networks that didn't were analog ones you can just listen to with a scanner. Or back in the day you could use an old Motorola analog cell in test mode (shorting two pins out) to manually listen to the channels and therefore the calls.

It's easy to listen to GSM calls (but not 3G & 4G) now anyway too, but I'll let you research that.

a reply to: AgentSmith

Wouldn't this be a criminal, prosecutable act if it was done without permission? Have we got no consideration for friendly nations and reputable businesses?

I'm 100% in favour of National Security! Who wants bombs going off or infrastructure being disrupted?

But shouldn't there be some moderation here? Just because we have the skills to listen in to friends and enemies doesn't mean we should. Where's the oversight? Where's the diplomacy? Which nations and states will be able to trust the UK and US in the future?

Isn't national security dependent on international stability too? Such stability has been created by countries becoming allies and unions. Listening in to everyone might increase national security on one hand and take it away with the other when cooperation begins to decline.

More info here: www.abovetopsecret.com...

So reading this story I was hit with an idea. A large part of how these programs work are in looking at metadata, seeing who is communicating with who. If a terrorist group were to get a large supply of phone numbers and actively work on communicating with others from them (mass text messages, rss feeds from websites) aimed at the general public. Wouldn't the end result be a communications volume that's too large to automatically prune to just the interesting stuff (since its all interesting) and effectively crush these spy attempts under the weight of the data they're collecting?

The take away from this, is that the best way for you to end the spying is to start getting text messages from ISIS.

A nice touch is that every single mobile-based communication is now worthless as proof in court, as the possiblity of counterfeiting a SIM-card by national agencies is now proven.

Therefore, every documented communication via mobile could be a forgery by a governmental agency.

originally posted by: Kandinsky
a reply to: AgentSmith

Wouldn't this be a criminal, prosecutable act if it was done without permission? Have we got no consideration for friendly nations and reputable businesses?

I'm pretty sure it is, but we'll see what happens. Hopefully Dutch media won't bury it.

I'm 100% in favour of National Security! Who wants bombs going off or infrastructure being disrupted?

Me too, in principle I don't even really have issues directly with some underhand tactics as you have to fight fire with fire. But the problem is when things are abused, and when you have humans involved there will be abuse. It's a vicious circle, while humans are corruptible you need to use some extreme tactics to fight threats - but the people behind those tactics are also potentially corruptible so it will get misused. If we lived in an ideal world where we can guarantee these powers won't be misused, they would by default be redundant. I honestly don't know what the solution is. You can try and have layers and layers of oversight but it won't solve the problems really.

But shouldn't there be some moderation here? Just because we have the skills to listen in to friends and enemies doesn't mean we should. Where's the oversight? Where's the diplomacy? Which nations and states will be able to trust the UK and US in the future?

I have no idea, it's all quite saddening. And it's not just the US and UK, other governments will be just as bad. In a way they need to be, but it's misused or has the potential to be. What's the solution? I really don't know.

Isn't national security dependent on international stability too? Such stability has been created by countries becoming allies and unions. Listening in to everyone might increase national security on one hand and take it away with the other when cooperation begins to decline.

Unless behind closed doors they're all still winking at each other, then yes I think these revelations are just going to keep eroding the trust between countries. But it's probably best it comes out now, because things are getting out of control.

a reply to: AgentSmith

I have to say that I agree with your points. :up;

There was a recent story that GCHQ had leant on German intel agency BND to obstruct the German parliamentary hearings into NSA intrusions.

I guess that's how the Dutch mischief will play out. There'll be public outrage followed by muted deals across the back channels and then some agreement.

If the evidence can be obfuscated nothing really happened.

Unfortunately, I predict that there will probably faux outrage for a while, then the story will go quiet, and eventually people will forget about it and be distracted enough for the governments involved to avoid answering any real questions.

In the short term, I can guarantee someone from the government here in the UK will use the line that this was all done "within a legal framework".

Notice they never say done in "accordance with the law"? That's because none of it is actually in accordance with the law. It's entirely illegal and they absolutely know it. Saying it's done within "a legal framework" allows those who say it to claim they had no idea it was illegal, and they were told everything was above board. These slimy cretins are only covering their own butts here, passing the blame should they ever end up being accused of something. All they need to do is say it was all done "within a legal framework" and the blame is shifted to whoever created that lie.

It simply means that they wrote a document covering their asses and a lawyer signed off on it knowing it's illegal and that it cannot be properly challenged in any court.

This is basically saying that the laws you and I have to recognize do not apply to our governments, and those who are given a get out of jail free card to use as and when they like. The same applies to the richest people too, of course, those who can get away with making special deals to avoid paying tax while you or I are bent over a barrel.

Watch this closely, I guarantee the statement from government will include the words "legal framework".

originally posted by: ManFromEurope
A nice touch is that every single mobile-based communication is now worthless as proof in court, as the possiblity of counterfeiting a SIM-card by national agencies is now proven.

Therefore, every documented communication via mobile could be a forgery by a governmental agency.

If only our laws applied to those who write them.

I don't think people are fully grasping the potential for the usurping of democratic power here. When you have agencies like the NSA, CIA and GCHQ clearly and willfully breaking all laws both nationally and internationally, you have agencies that cannot be trusted by our own elected governments.

If your democratically elected government is simply "trusting" that these agencies are doing to the right thing, legally, ethically and morally, and they are then found to be breaking all laws to gather information on potentially billions of completely innocent people, you have a usurping of power already.

What is there to stop these agencies from gathering data on every serving politician? Every judge in the country? Every foreign politician? Private corporations?

We have no choice but to assume this is the case, and as such this means these agencies have destroyed our democracies.

a reply to: AgentSmith

Star and flag good information

But I also get a feeling no one cares in the USA, everyone dosed up with fluoride ?

a reply to: PizzaAnyday505

No one really seems to care anywhere. I fear it's too late.
You watch the movie where the protagonist risks life and limb to get some information out to the public, the film climaxes, you see it on the news, the shot pans out, music starts.
The bit they never show you is where no one cares..

a reply to: AgentSmith

It does seem crazy that people are more concerned about Bill O'Reilly lying or the Oscars.

With info like this, it's no wonder why the Obama administration was so ruthless when it came to Snowden. And it also makes me wonder about Michael Hastings and what he may have known and what else these is to even leak out yet still.

But will anyone even care?

a reply to: AgentSmith

How are the votes counted in US elections?
Are computers and telecommunications used?
See where I'm going with this?

a reply to: Rocker2013

Rocker, we haven't had a democratically elected government in the USA since JFK. And some can provide valid arguments that it's even further back than that. Of course, we are a republic not a democracy.

Wow.. I work in the cellphone industry, and handle Sims everyday. This is a goldmine for Nazi like governments who want total electronic identity and control.

Me thinks these alphabet agencies, believe they are separate from the laws and privacy we everyday citizens abide by.

Me thinks we need to start getting pissed off, and find out the human names/identities of the exact people working a globalist agenda, expose them, and imprison them.

Do we have the balls and collective commitment as a species? Or do we continue being farmed, intimidated, manipulated and deceived?

They have ZERO rights to our information, they are not above the people. We need to start making it known.

These alphabet agencies are seriously pissinh me off as of late years..

I'm not sure how useful a hack like this could be for our enemies who violate our privacy on a long term note but I'm fairly sure that given the amount of data they shouldered when they invaded the phone system is far too much for them to get too involved with to any depth. All those SIM numbers will be useless without access to customer data, so as long as they don't got the info on individual customers they basically got billions of shots in the dark to actually make anything useful out of their hack. You also need to consider that phones are no longer a long term item for owners like they were decades ago. These days the half-life of a single phone is 6 months to 2 years at the most (with the occasional stubborn customer who still uses their 1997 motorola flip phone). This means that when the next generation of phones are manufactured a whole new serial of SIM numbers will get issued, rendering the hacked data expired and less useful. I see this as more of a matter of respect. In situations of peril where normal people are able to help solve the issue there would be more agreement to provide the needed data but the truth is that spying on phone users and infiltrating their private lives and maybe even causing their electronics to malfunction really isn't necessary given the current situation technologically in the world. I'll type it again. These problems are an issue of respect for consumers and for technology developers and really serves as minimal towards fighting our true enemies, the savages of sandland.

a reply to: AgentSmith

It wasn't billions of communications there was a breach someone tried to steal encryption keys to sim cards. Company denied they managed to get any of couse I think they did. But there value is limited. Especially on newer sim cards but it works like this when you activate a sim a public key is made sent to sim and a private key kept by network. The public key is assigned off a database the private key is random . They steal the public key they still get a garbled message just nit as bad meaning you can make out some information. Could never listen to a phone call but may be able to make out some text with some work.

The only effective way to decode it is having both keys and even than you can turn off and on your phone and new keys are assigned. Meaning grabbing anything other than Mayne Metadata is very hard and easy to stop every day turn your phone off and on if your paranoid.