7 ms·
Hackers are stealing years of call records from hacked cell networks
- julienreszka 7y agoWe all knew this was going to happen/is happening. 'I have nothing to hide from the government' yeah what about the mafia, criminals and such that could/will access the data? https://techcrunch.com/2018/06/25/nsa-att-intercept-surveillance/ https://techcrunch.com/2018/06/25/nsa-att-intercept-surveill...
- ackbar03 7y agoI usually just preassume I have zero privacy online these days
- jacquesm 7y agoYour sense of being 'online' might be off when you are calling someone on your cell phone through the provider, this is very sensitive information for many reasons. It allows the attackers to do network analysis and to figure out stuff that even LE hasn't caught on to yet. This is problematic because people doing bad stuff that have third parties aware of this are vulnerable to blackmail, think local politician that is on the take on some public works project.
- 01100011 7y agoI usually just assume zero privacy anywhere these days. Your face is scanned, your image recorded, your license plate logged. Quite the world we have now.
- meruru 7y agoI usually try to make sure I have privacy, but to each their own I guess.
- patrickhogan1 7y agoThere is truth that CDR data is valuable. The problem with this article is the hyperbole the researchers use to describe the data. 1. Researcher says CDR contains all the raw data you send. False. It contains call detail records. Not your internet traffic. Not your Facebook calls. Not your icloud or WhatsApp messages. 2. The researchers here fail to share who was targeted and share almost no verifiable data to confirm what they found. Anyone could claim to have found a hack like they claim and get credit without providing any details to draw a big headline. Seems like marketing not research.
- iamshs 7y agoI wish they had shared the companies targeted. That was the only part I was interested in really.
- bashwizard 7y agoThe security researchers are more than likely gagged and can't share which targets or any detail information of a finding this huge.
- patrickhogan1 7y agoWhile this could be true. We do have to be suspect that these security articles, unless very well detailed like what cloudfare publishes or many of the other great security services publish, could very well be fake news. Essentially this article gets 75% of its technical details wrong or embellishes on their details. We are then told, we can't disclose anything related to the hack beyond the fact that we saw a [insert] _____very well known type of hack performed___ on ___very large group of people___ and ____we've been investigating for awhile_____ and we know this because we saw the hackers get a password from ____one computer then hop to the next computer - then get the domain server!! jackpot______
- bashwizard 7y agoWell, it's pretty much common practice in the business. In my own experience as an independent security researcher/bug hunter I've been in a few situations where I've been under NDAs for finding critical RCE vulnerabilities. Basically I got paid for finding them and to keep my mouth shut and I'm sure Cybereason in this case is in the same kind of situation but the scale is much bigger. Cybereason doesn't need the marketing. Everyone in infosec knows who they are and if they say they found this I'd say it's legit.
- lawnchair_larry 7y agoSomething seems off about this story and the way it’s presented. And techcrunch is an odd choice, unless everyone else passed on it.
- adventured 7y ago> And techcrunch is an odd choice, unless everyone else passed on it. What do you mean passed on it? It's being covered broadly. TechCrunch is only one publisher carrying the story. https://www.wsj.com/articles/global-telecom-carriers-attacked-by-suspected-chinese-hackers-11561428003 https://www.wsj.com/articles/global-telecom-carriers-attacke... https://www.cnbc.com/2019/06/25/hackers-hit-telecommunications-firms-cybereason.html https://www.cnbc.com/2019/06/25/hackers-hit-telecommunicatio... https://www.wired.com/story/chinese-hackers-carrier-metadata/ https://www.wired.com/story/chinese-hackers-carrier-metadata...
- maze-le 7y agoIf the data hadn't been collected in the first place, it wouldn't be used against us. Data austerity is the best form of data protection. In this case the state mandates the data hoarding of telco providers, which makes it even worse.
- wil421 7y agoThey are legally required to if they fall under FCC jurisdiction. For entities that fall under the jurisdiction of the Federal Communications Commission (the “FCC”), “[e]ach carrier that offers or bills toll telephone service shall retain for a period of 18 months such records as are necessary to provide . . . billing information . . ..” (47 C.F.R. § 42.6). https://morningconsult.com/2017/04/25/tech-groups-push-fcc-undo-phone-call-record-retention-regulation/ https://morningconsult.com/2017/04/25/tech-groups-push-fcc-u...
- w8vY7ER 7y agoAny opinions on whether this practice continues to serve the general good of the society? The comment above about austerity has a ring of truthiness to it that is very difficult to ignore.
- PeterisP 7y agoThe possibility to steal years of call records doesn't arise because of a legal requirement to retain such records for 18 months. You can meet those legal requirements while (a) deleting all records after 18 months have passed and (b) storing all 'archive' records (e.g. between 30 days and 18 months) on a separate system that's only used for these specific requirements and has all access (which should be rare and narrowly specific, unlike daily business) logged.
- d3v0 7y agoBut a lot of lawsuits have depended on these phone records.
- Jonnax 7y agoIt's easy to say that "oh, phone calls have no security at all, what do you expect?" It's true that we can talk to friends and family with internet services. But for businesses we use our phones. Personally I don't think I would affected if my call records were given to anyone or leaked. But I can think of scenarios where it could be really damaging to someone. Like imagine a celebrity was having cancer treatment they didn't want people to know. Their call.records get leaked to a tabloid who infer their calls to a clinic mean that they have cancer and run an article. I can imagine that would be a painful experience.
- Iv 7y agoI remember reading an article about a developer who started replacing Android on his phones because his office was located in the same building as a psychiatrist and the Google hivemind had identified him as a patient. The fact that this is legal is really troubling.
- sokoloff 7y agoWouldn’t it be more likely they’d infer he was a doctor? I wouldn’t expect patients to go every day for 8 hours. (Not saying either is “ok”, but guessing patient from those facts is particularly poor I think)
- ebeip90 7y agoThere are likely more patients than doctors, so the inference is statistically correct.
- sokoloff 7y agoThat depends on what population selection data you choose to consider/admit. As an example, suppose a cell phone appears at the local supermarket/grocery store every weekday from 9 AM to 5 PM. If you conclude that phone is owned by an extremely avid supermarket shopper rather than a store manager, you're ignoring the persistence over time dimension. If you claim that it's more likely a cashier rather than a store manager (because there are more cashiers than managers), you're on much firmer ground than if you claim it's more likely a shopper than a store manager just because there are wildly more shoppers than managers.
- oulipo 7y agoAnd it will be even worse when they will hack Alexa or the Google Home servers and get logs of what you say at home and access to your whole life This is why at https://snips.ai https://snips.ai we are building Voice AI which does not require the cloud and can work offline
- ga-vu 7y agoSome IOCs would have been nice. At this point, all of this seems like a fairytale from a cybersecurity firm looking for press coverage.
- DigitalTerminal 7y agoWhy are they even keeping years of call records? This strikes me as something that should be deleted after the current billing cycle (plus a delay for complaints, say 12 months). This kind of just-in-case or I-don't-want-to-push-the-button retention of data should hopefully be given some disincentives by GDPR but there is still a hell of a lot too much of it going on. Storage is cheap doesn't mean keep everything forever, especially potentially sensitive personal data.
- jay_kyburz 7y agoIn Australia we have mandatory metadata retention for 2 years.
- exabrial 7y agoShenote: sms auth is not even remotely secure. Let's move on.
- bawana 7y agoso that's why I'm getting a crapton of robocalls now?!
- ryeguy_24 7y agoIs this why we receive spammer phone calls that come from numbers that we have a history of dialing? I assume this is still happening because I visited Nashville for the first time this year and must have called a restaurant or two for reservations there. Now, I get a ton of Nashville spammer calls among the usual area codes that they always hit me with. Pretty curious.
- deleted 7y ago[deleted]
- onemoresoop 7y agoThat's not my experience. I receive daily spammer calls from numbers similar to mine, the last 4 digits are different. It never occurred to me to get a spam call from a number I knew. Did you receive spam from your contacts or recently dialed numbers? Maybe it's something new..
- ryeguy_24 7y agoI bet at least someone is using this data for trading as it is likely an indicator of revenue/profit for quarterly earnings.