6 ms·

There is truth that CDR data is valuable. The problem with this article is the hyperbole the researchers use to describe the data. 1. Researcher says CDR conta

There is truth that CDR data is valuable. The problem with this article is the hyperbole the researchers use to describe the data. 1. Researcher says CDR contains all the raw data you send. False. It contains call detail records. Not your internet traffic. Not your Facebook calls. Not your icloud or WhatsApp messages. 2. The researchers here fail to share who was targeted and share almost no verifiable data to confirm what they found. Anyone could claim to have found a hack like they claim and get credit without providing any details to draw a big headline. Seems like marketing not research.

iamshs 7y ago
I wish they had shared the companies targeted. That was the only part I was interested in really.
bashwizard 7y ago
The security researchers are more than likely gagged and can't share which targets or any detail information of a finding this huge.
- patrickhogan1 7y ago
  While this could be true. We do have to be suspect that these security articles, unless very well detailed like what cloudfare publishes or many of the other great security services publish, could very well be fake news. Essentially this article gets 75% of its technical details wrong or embellishes on their details. We are then told, we can't disclose anything related to the hack beyond the fact that we saw a [insert] _____very well known type of hack performed___ on ___very large group of people___ and ____we've been investigating for awhile_____ and we know this because we saw the hackers get a password from ____one computer then hop to the next computer - then get the domain server!! jackpot______
  - bashwizard 7y ago
    Well, it's pretty much common practice in the business. In my own experience as an independent security researcher/bug hunter I've been in a few situations where I've been under NDAs for finding critical RCE vulnerabilities. Basically I got paid for finding them and to keep my mouth shut and I'm sure Cybereason in this case is in the same kind of situation but the scale is much bigger. Cybereason doesn't need the marketing. Everyone in infosec knows who they are and if they say they found this I'd say it's legit.
    - lawnchair_larry 7y ago
      If one is getting paid to find bugs for a company, they aren’t writing articles like this about that company. Also, I’ve been in infosec almost 20 years and have never heard of this company. Also, there is no such thing as a company that doesn’t need marketing.
Aloha 7y ago
Access to CDR's is the worst kept secret in the telecom world - so many layers have access - and by any measure have to. Remember, you don't own your call detail records, the telco does, its not legally your data and never has been. (in the United States anyhow)
- andai 7y ago
  Can anyone comment on how this works in the EU? Does GDPR apply to this sort of data?
  - patrickhogan1 7y ago
    CDR records are kept in every telco switch in every geo. Its required for it to work and to do billing. But the article is quite misleading in the data they contain. https://en.wikipedia.org/wiki/Call_detail_record https://en.wikipedia.org/wiki/Call_detail_record
  - M2Ys4U 7y ago
    >Does GDPR apply to this sort of data? The GDPR applies to any information about an identified or identifiable natural person. So, in a word, yes. However: Data ownership is a red herring. It doesn't matter who owns what data, what matters is if they have the legal authority to process that data.
    - C1sc0cat 7y ago
      Which telcos do
      - tremon 7y ago
        Which telcos don't, except for billing purposes. Yes, they have a legal obligation to collect and store that data for law enforcement, but they are still bound by the GDPR for everything else.
        7y ago
noselasd 7y ago
Note that the term "CDR" is used for many types of records collected in the telco network, not just for "call"(voice). Collected in a mobile network, there's usually a record for each event of a mobile phone. Authenticating to the network, attaching to the network. Doing a location update, sending/receiving an SMS, switching routing/tracking area, handover between cells and so on.
matthewdgreen 7y ago
Does anyone remember the first year after the iPhone shipped on AT&T, and people (including myself) were getting detailed paper bills that included every single HTTP object we requested [1]? My guess is that the CDR data is much more granular than you think. This doesn't get exposed on customer bills anymore, but I'd bet it's available within the system. [1] https://en.wikipedia.org/wiki/300-page_iPhone_bill https://en.wikipedia.org/wiki/300-page_iPhone_bill
- ronsor 7y ago
  Not anymore because of HTTPS
  - dotancohen 7y ago
    HTTPS encrypts the contents of the request. The things requested still happen in plain text.
    - tialaramex 7y ago
      Most of the request is encrypted. Suppose you type https://foo.example.com/bar?baz#quux https://foo.example.com/bar?baz#quux into your browser Most TLS (TLS up to 1.2) will tell anybody who is watching that you visited foo.example.com including the SNI foo.example.com your browser sent to tell the server which name it was looking for and the certificate the server provided to prove it is really foo.example.com. But it will encrypt bar and baz and quux isn't sent over the wire it's just used internally by the browser and any Javascript. That's the difference between "dotancohen looked at webMD" and "dotancohen looked at this article about sexually transmitted infections in men who have sex with men". In TLS 1.3 the certificate is encrypted, a snooper can still see you asked for foo.example.com but not whether this server in fact presented a certificate for that name. eSNI (currently under active development as an addition to TLS 1.3) encrypts that part where your browser asks for foo.example.com, since your browser also did a DNS lookup for foo.example.com we need to encrypt that too for it is make any real difference which is being done under DPRIVE.
      - 7y ago

iamshs 7y ago

I wish they had shared the companies targeted. That was the only part I was interested in really.

bashwizard 7y ago

The security researchers are more than likely gagged and can't share which targets or any detail information of a finding this huge.

patrickhogan1 7y ago
While this could be true. We do have to be suspect that these security articles, unless very well detailed like what cloudfare publishes or many of the other great security services publish, could very well be fake news. Essentially this article gets 75% of its technical details wrong or embellishes on their details. We are then told, we can't disclose anything related to the hack beyond the fact that we saw a [insert] _____very well known type of hack performed___ on ___very large group of people___ and ____we've been investigating for awhile_____ and we know this because we saw the hackers get a password from ____one computer then hop to the next computer - then get the domain server!! jackpot______
- bashwizard 7y ago
  Well, it's pretty much common practice in the business. In my own experience as an independent security researcher/bug hunter I've been in a few situations where I've been under NDAs for finding critical RCE vulnerabilities. Basically I got paid for finding them and to keep my mouth shut and I'm sure Cybereason in this case is in the same kind of situation but the scale is much bigger. Cybereason doesn't need the marketing. Everyone in infosec knows who they are and if they say they found this I'd say it's legit.
  - lawnchair_larry 7y ago
    If one is getting paid to find bugs for a company, they aren’t writing articles like this about that company. Also, I’ve been in infosec almost 20 years and have never heard of this company. Also, there is no such thing as a company that doesn’t need marketing.

Aloha 7y ago

Access to CDR's is the worst kept secret in the telecom world - so many layers have access - and by any measure have to. Remember, you don't own your call detail records, the telco does, its not legally your data and never has been. (in the United States anyhow)

andai 7y ago
Can anyone comment on how this works in the EU? Does GDPR apply to this sort of data?
- patrickhogan1 7y ago
  CDR records are kept in every telco switch in every geo. Its required for it to work and to do billing. But the article is quite misleading in the data they contain. https://en.wikipedia.org/wiki/Call_detail_record https://en.wikipedia.org/wiki/Call_detail_record
- M2Ys4U 7y ago
  >Does GDPR apply to this sort of data? The GDPR applies to any information about an identified or identifiable natural person. So, in a word, yes. However: Data ownership is a red herring. It doesn't matter who owns what data, what matters is if they have the legal authority to process that data.
  - C1sc0cat 7y ago
    Which telcos do
    - tremon 7y ago
      Which telcos don't, except for billing purposes. Yes, they have a legal obligation to collect and store that data for law enforcement, but they are still bound by the GDPR for everything else.
      - 7y ago

noselasd 7y ago

Note that the term "CDR" is used for many types of records collected in the telco network, not just for "call"(voice). Collected in a mobile network, there's usually a record for each event of a mobile phone. Authenticating to the network, attaching to the network. Doing a location update, sending/receiving an SMS, switching routing/tracking area, handover between cells and so on.

matthewdgreen 7y ago

Does anyone remember the first year after the iPhone shipped on AT&T, and people (including myself) were getting detailed paper bills that included every single HTTP object we requested [1]? My guess is that the CDR data is much more granular than you think. This doesn't get exposed on customer bills anymore, but I'd bet it's available within the system. [1] https://en.wikipedia.org/wiki/300-page_iPhone_bill https://en.wikipedia.org/wiki/300-page_iPhone_bill

ronsor 7y ago
Not anymore because of HTTPS
- dotancohen 7y ago
  HTTPS encrypts the contents of the request. The things requested still happen in plain text.
  - tialaramex 7y ago
    Most of the request is encrypted. Suppose you type https://foo.example.com/bar?baz#quux https://foo.example.com/bar?baz#quux into your browser Most TLS (TLS up to 1.2) will tell anybody who is watching that you visited foo.example.com including the SNI foo.example.com your browser sent to tell the server which name it was looking for and the certificate the server provided to prove it is really foo.example.com. But it will encrypt bar and baz and quux isn't sent over the wire it's just used internally by the browser and any Javascript. That's the difference between "dotancohen looked at webMD" and "dotancohen looked at this article about sexually transmitted infections in men who have sex with men". In TLS 1.3 the certificate is encrypted, a snooper can still see you asked for foo.example.com but not whether this server in fact presented a certificate for that name. eSNI (currently under active development as an addition to TLS 1.3) encrypts that part where your browser asks for foo.example.com, since your browser also did a DNS lookup for foo.example.com we need to encrypt that too for it is make any real difference which is being done under DPRIVE.
    - 7y ago