Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

bemildred

(90,061 posts)
Thu Dec 4, 2014, 11:38 PM Dec 2014

Exposed: NSA program for hacking any cellphone network, no matter where it is

Source: ars Technica/Intercept

The National Security Agency has spied on hundreds of companies and groups around the world, including in countries allied with the US government, as part of an effort designed to allow agents to hack into any cellphone network, no matter where it's located, according to a report published Thursday.

Armed with technical details of a specific provider's current or planned networks, agents secretly attempt to identify or introduce flaws that will make it possible for communications to be covertly tapped, according to an article published by The Intercept. Security experts warned that programs that introduce security flaws or suppress fixes for existing vulnerabilities could cause widespread harm, since the bugs can also be exploited by criminal hackers or governments of nations around the world.

"Even if you love the NSA and you say you have nothing to hide, you should be against a policy that introduces security vulnerabilities," Karsten Nohl, a cryptographer and smartphone security expert, told The Intercept. "Because once NSA introduces a weakness, a vulnerability, it's not only the NSA that can exploit it."

It's not the first time the US agency has been reported to introduce backdoors into widely used technologies. Last year documents provided by former NSA subcontractor Edward Snowden—the same source for documents supporting Thursday's story by The Intercept—showed that the NSA worked with standards bodies to adopt encryption technologies with known vulnerabilities in them. Two weeks later, the RSA division of EMC warned customers to stop using the default configuration of its BSAFE BSAFE toolkit and Data Protection Manager because it contained code reported to contain an NSA-engineered vulnerability.



Read more: http://arstechnica.com/tech-policy/2014/12/exposed-nsa-program-for-hacking-any-cellphone-network-no-matter-where-it-is/

14 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies

bemildred

(90,061 posts)
1. Leahy to Obama: End NSA program now
Thu Dec 4, 2014, 11:39 PM
Dec 2014

One of the Senate’s biggest critics of the National Security Agency’s (NSA) contentious spying programs wants President Obama to make drastic reforms himself, after a congressional plan was blocked on the Senate floor last month.

A day before a key NSA program comes out for court renewal, Judiciary Committee Chairman Patrick Leahy (D-Vt.) on Thursday called for Obama to take action into his own hands.

“The President can end the NSA’s dragnet collection of Americans’ phone records once and for all by not seeking reauthorization of this program by the [Foreign Intelligence Surveillance Act] Court, and once again, I urge him to do just that,” Leahy said in a statement. “Doing so would not be a substitute for comprehensive surveillance reform legislation — but it would be an important first step.”

The NSA’s ability to collect and search Americans’ phone records for metadata — such as which numbers a person dialed and how long the conversation lasted — needs to be reauthorized by the secretive surveillance court every 90 days. The current authorization is up for renewal on Friday and the administration is expected to ask for it to continue for another 90 days.

http://thehill.com/policy/technology/226064-leahy-obama-should-end-nsa-program-now

cstanleytech

(26,299 posts)
3. Maybe I am mistaken but isnt gathering intelligence overseas part of the NSAs job to
Fri Dec 5, 2014, 12:29 AM
Dec 2014

gather and collect information from potential threats?

delrem

(9,688 posts)
4. Of course the entire planet is a "potential threat".
Fri Dec 5, 2014, 01:11 AM
Dec 2014

Is a potential threat to the maximization of Microsoft profits a potential threat to the US economy, therefore to the USA? What about a potential threat to the maximization of Goldman Sachs' profits? Or the profits of Haliburton, and Acadami? Well, it's a good thing that questions like that don't come to mind, since a noun, a verb and 9/11, y'know? And since people don't even know what they lost.

cstanleytech

(26,299 posts)
5. Actually, you are right.
Fri Dec 5, 2014, 01:47 AM
Dec 2014

Well atleast partly right, the threats can come from many regions on the planet as it couldnt be the planet itself as its only a planet.

bemildred

(90,061 posts)
9. The problem is the introduction of flaws in security software for the purpose of
Fri Dec 5, 2014, 07:54 AM
Dec 2014

making it hackable. Making sure it does not work so that YOU can be sure of getting in. Unfortunately there is just no way to guarantee that other parties will not also use your hacks. Since most computers are notoriously insecure anyway, this is just piling wood on the fire.

It is indeed true that the NSAs job is intelligence gathering, but it is not true that they are allowed to do it however they like. If they work for us, they must observe the boundaries we set.

 

Demeter

(85,373 posts)
10. Neither is the US Mail. The point is our LAWS are supposed to make us safe
Fri Dec 5, 2014, 08:54 AM
Dec 2014

by making dragnets illegal, and by prosecuting violators to the fullest extent of the law.

If we don't even have the law on our side, we are truly disenfranchised from citizenship.

bemildred

(90,061 posts)
11. NSA mobile phone network hacking raises security concerns
Fri Dec 5, 2014, 10:28 AM
Dec 2014

The US National Security Agency (NSA) spied on the GSM Association to identify and exploit security vulnerabilities in mobile phone networks, documents leaked by whistleblower Edward Snowden reveal.

This has raised concerns about the security of the world’s mobile networks amid speculation that the NSA

http://www.computerweekly.com/news/2240236096/NSA-mobile-phone-network-hacking-raises-security-concerns

Blue_Tires

(55,445 posts)
14. GSMA responds:
Tue Dec 9, 2014, 05:30 PM
Dec 2014

London: The GSMA provided the following statement addressing a recent article appearing in The Intercept.

“The GSMA is aware of the recent article in The Intercept entitled “How the NSA Hacks Cellphone Networks Worldwide”. Our initial analysis of the claims contained in the article has focussed on the possibility of a compromise of GSMA systems, communications and stored documentation. Our preliminary conclusion is that there is no evidence of active targeting or compromise of GSMA systems, communications and stored documentation.

“The article references surveillance of GSMA Working Groups, but again, no evidence is attainable from the published documents that suggests GSMA Working Group activities have been compromised. The documents do contain some details of GSMA Working Groups but the names and structures, which are incomplete, are openly available from a large variety of public sources.

“The article also references the alleged compromise of IR.21 data (technical network data shared across operators and other industry stakeholders). We have closely examined the documents published, and given inconsistencies in the data, we believe it is unlikely that the GSMA is the source of the data. It is important to note that the information contained in an IR.21 is not sufficient to ‘hack’ a cellphone network.

“Although we see no evidence of a breach of GSMA-held assets, we are very concerned at any attempt to access or interfere with our member’s data. We will continue to stringently monitor access to GSMA systems, communications and stored documentation, and will work with all stakeholders to put in place further measures to ensure that our collective data management and security protections remain robust.”

ENDS

About the GSMA
The GSMA represents the interests of mobile operators worldwide, uniting nearly 800 operators with more than 250 companies in the broader mobile ecosystem, including handset and device makers, software companies, equipment providers and Internet companies, as well as organisations in adjacent industry sectors. The GSMA also produces industry-leading events such as Mobile World Congress, Mobile World Congress Shanghai and the Mobile 360 Series conferences.

For more information, please visit the GSMA corporate website at www.gsma.com. Follow the GSMA on Twitter: @GSMA.

http://www.gsma.com/newsroom/press-release/gsma-statement-intercept-article/

Latest Discussions»Latest Breaking News»Exposed: NSA program for ...