World’s top SIM maker says NSA spies hacked in, but didn’t steal encryption keys

SIM card maker Gemalto has dismissed recent reports that U.K. and U.S. spies obtained encryption keys protecting millions of mobile phones by hacking its network.

Secret documents revealed last week suggested that spies from the U.S. National Security Agency and the U.K. Government Communications Headquarters had stolen SIM card encryption keys from Gemalto, allowing them to intercept the conversations of millions of mobile phone users. The GCHQ documents, dating from 2010, were among those leaked by former NSA contractor Edward Snowden.

On Wednesday, though, Gemalto said that while it had detected sophisticated attacks on its office networks in 2010 and 2011 that it now believed were probably conducted by the NSA and GCHQ, these could not have led to the massive theft of SIM encryption keys.

While the leaked documents showed the spies boasting (We) believe we have their entire network, Gemalto said that its internal investigation showed that the intrusions only breached its office network, and not the entirely separate infrastructure used for generating and transmitting the SIM card encryption keys.

By 2010 those keys were being exchanged with its network operator customers by secure means in all but a few cases, making the wholesale theft of the keys unlikely and meaning that Gemalto could not have been the source of the massive leaks reported, it said.

Furthermore, Gemalto had never sold SIM cards to four of the 12 networks named in the leaked documents, so it could not have been the source of, for example, 300,000 SIM encryption keys stolen from a Somali carrier, it said.

That doesnt exclude the possibility that the keys were stolen from other SIM manufacturers, though: Gemalto is the largest, but not the only, supplier of the devices.

Even if the spy agencies had somehow stolen SIM encryption keys from Gemalto, only communications on second-generation mobile networks such as GSM would be vulnerable, not the newer 3G and 4G networks introduced by many operators after 2010, the company said.

Gemalto assumed for the purposes of its investigation that the leaked documents were genuine and accurate, but did not seek to confirm or refute the documents claims, it said.

Outsiders regularlyand unsuccessfullytry to hack its networks, it said, and only a few attempts breach even the outer levels of its network.

Here is the original post:
World's top SIM maker says NSA spies hacked in, but didn't steal encryption keys