5 ms·

Targeting wiretapping infrastructure may be a viable attack, but with how few details are available to the public, it's hard to estimate the impact. Just becaus

Targeting wiretapping infrastructure may be a viable attack, but with how few details are available to the public, it's hard to estimate the impact. Just because a wiretapping platform was hacked doesn't mean any data was gathered, and if it really was, we don't know what kind of data. Thanks to mobile networks, information can be anything from live internet traffic to live location information of cars and phones. However, I suspect if someone did a hack that juicy, carrier SOCs would've noticed immediately. This type of infrastructure isn't exactly hooked up to a public IP address somewhere.

OutOfHere 2y ago
[flagged]
Hizonner 2y ago
> This type of infrastructure isn't exactly hooked up to a public IP address somewhere. Snort.
A4ET8a8uTh0 2y ago
<< few details are available to the public, it's hard to estimate the impact. Would it not be a good indicator that it may not be a great idea to begin with? << carrier SOCs would've noticed immediately. I want to believe that. I do. But the longer I live in corporate, the more I think that we are experiencing a serious competency problem across the board.
- yusyusyus 2y ago
  ehh.. LI on routers has been (at least on one major vendor) designed to not be visible to end operators in the course of normal operation. there are ways to see it, but it involves either the actual LI mechanism or some esoteric debugs. And it probably wouldn't be obvious to SOCs if the implemented LI was legit or not. So, the question of competence or otherwise may be mooted by virtue of simply not having proper visibility.
  - A4ET8a8uTh0 2y ago
    Fair point. I do not know enough in that area to argue further.
  - tguvot 2y ago
    in fqct, iirc, it might be even illegal to know what wiretaps are running on the system unless you are the one who process warrant or implement the wiretap. and in case wiretap falls under fisa, than this is classified information and a whole different can of worms
hansvm 2y ago
> This type of infrastructure isn't exactly hooked up to a public IP address somewhere. It's getting from point A to point B, and probably not via sneakernet. The details will make it more or less secure, but I'd be shocked if it's going through anything other than public internet pathways.
- jeroenhd 2y ago
  The only endpoint that I can imagine travels through the internet (presumably through an encrypted VPN) is at the exit point where law enforcement agencies get access. These carriers make up the backbone of the internet, but that doesn't mean the internet is the only network they route.
runjake 2y ago
> This type of infrastructure isn't exactly hooked up to a public IP address somewhere. Without going into details, consider that sometimes they are, even with very large providers that you think should know better. Law enforcement’s got to get to them somehow. And much of the documentation for these systems is publicly available. Search for your favorite enterprise company and for “lawful intercept”.
- AmericanChopper 2y ago
  I was going to comment basically this. Everything you could possibly want to know about how LI systems work is documented by the vendors online. It’s really just network interfaces that forward intercepted traffic to aggregators. The thing about CSPs is their core business is edge routing. A majority of their core assets are going to be internet connected routers, and you’d actually be able to collect more data by owning some of those. The additional information you can get from LI (and the reason you often need a clearance to work on LI systems) is information about who law enforcement are running intercepts on. Also, LI is just a regulatory cost centre for CSPs. It’s hilarious (or scary, depending on your perspective) how poorly those systems are maintained, and how often the break.
ziddoap 2y ago
>However, I suspect if someone did a hack that juicy, carrier SOCs would've noticed immediately. We're talking real deal nation-state actors targeting an industry where for the last few decades the only downside of being breached is having to say "oh oops, sorry" and maybe providing a year of credit monitoring. Security is something taken just seriously enough to avoid a ruling of negligence, but no more. It is very optimistic to assume that carriers would immediately notice a breach by threat actors this sophisticated.
- raxxorraxor 2y ago
  The security flaws in these products were government mandated. I think the negligence case would be quite difficult here and distract from the real responsibility.
- jeroenhd 2y ago
  There's a difference between "oops, the newsletter database got leaked" and "oops, the president/senate/FBI got wiretapped". You can pay ten dollars per victim for one, but get in trouble with various law enforcement agencies with the other. If an external actor can control the wiretapping infrastructure, that doesn't just imply spying on targets; it can also cause some wiretapping evidence on terrorists/spies used by law enforcement can no longer be used.
deleted 2y ago
[deleted]
throwway120385 2y ago
I would just assume there's a cloud provider that handles all of the wiretapping services for both or all carriers. There's a single-point-of-failure for everything else nowadays anyway. Look at what happened with Crowdstrike, or Solarwinds, or any number of other big single-source providers. Nobody wants to maintain it in house, with predictable results.
- tguvot 2y ago
  there is nothing like this. the closest thing to it is something called TTP (trusted third party), that works as intermediary between telco and law enforcement agencies. they perform wiretap order processing, setups actual wiretaps, collect/bundle and ship away to agencies wiretapped information. but there is a bunch of them and you (telco) don't have to use them
  - throwway120385 2y ago
    That's actually really good, then. Thank you for explaining this.
Hikikomori 2y ago
They probably dont have a public ip but just spearfish a network engineer at these ISPs and you'll have access to the devices performing the legal intercept.

OutOfHere 2y ago

[flagged]

Hizonner 2y ago

> This type of infrastructure isn't exactly hooked up to a public IP address somewhere. Snort.

A4ET8a8uTh0 2y ago

<< few details are available to the public, it's hard to estimate the impact. Would it not be a good indicator that it may not be a great idea to begin with? << carrier SOCs would've noticed immediately. I want to believe that. I do. But the longer I live in corporate, the more I think that we are experiencing a serious competency problem across the board.

yusyusyus 2y ago
ehh.. LI on routers has been (at least on one major vendor) designed to not be visible to end operators in the course of normal operation. there are ways to see it, but it involves either the actual LI mechanism or some esoteric debugs. And it probably wouldn't be obvious to SOCs if the implemented LI was legit or not. So, the question of competence or otherwise may be mooted by virtue of simply not having proper visibility.
- A4ET8a8uTh0 2y ago
  Fair point. I do not know enough in that area to argue further.
- tguvot 2y ago
  in fqct, iirc, it might be even illegal to know what wiretaps are running on the system unless you are the one who process warrant or implement the wiretap. and in case wiretap falls under fisa, than this is classified information and a whole different can of worms

hansvm 2y ago

> This type of infrastructure isn't exactly hooked up to a public IP address somewhere. It's getting from point A to point B, and probably not via sneakernet. The details will make it more or less secure, but I'd be shocked if it's going through anything other than public internet pathways.

jeroenhd 2y ago
The only endpoint that I can imagine travels through the internet (presumably through an encrypted VPN) is at the exit point where law enforcement agencies get access. These carriers make up the backbone of the internet, but that doesn't mean the internet is the only network they route.

runjake 2y ago

> This type of infrastructure isn't exactly hooked up to a public IP address somewhere. Without going into details, consider that sometimes they are, even with very large providers that you think should know better. Law enforcement’s got to get to them somehow. And much of the documentation for these systems is publicly available. Search for your favorite enterprise company and for “lawful intercept”.

AmericanChopper 2y ago
I was going to comment basically this. Everything you could possibly want to know about how LI systems work is documented by the vendors online. It’s really just network interfaces that forward intercepted traffic to aggregators. The thing about CSPs is their core business is edge routing. A majority of their core assets are going to be internet connected routers, and you’d actually be able to collect more data by owning some of those. The additional information you can get from LI (and the reason you often need a clearance to work on LI systems) is information about who law enforcement are running intercepts on. Also, LI is just a regulatory cost centre for CSPs. It’s hilarious (or scary, depending on your perspective) how poorly those systems are maintained, and how often the break.

ziddoap 2y ago

>However, I suspect if someone did a hack that juicy, carrier SOCs would've noticed immediately. We're talking real deal nation-state actors targeting an industry where for the last few decades the only downside of being breached is having to say "oh oops, sorry" and maybe providing a year of credit monitoring. Security is something taken just seriously enough to avoid a ruling of negligence, but no more. It is very optimistic to assume that carriers would immediately notice a breach by threat actors this sophisticated.

raxxorraxor 2y ago
The security flaws in these products were government mandated. I think the negligence case would be quite difficult here and distract from the real responsibility.
jeroenhd 2y ago
There's a difference between "oops, the newsletter database got leaked" and "oops, the president/senate/FBI got wiretapped". You can pay ten dollars per victim for one, but get in trouble with various law enforcement agencies with the other. If an external actor can control the wiretapping infrastructure, that doesn't just imply spying on targets; it can also cause some wiretapping evidence on terrorists/spies used by law enforcement can no longer be used.

deleted 2y ago

[deleted]

throwway120385 2y ago

I would just assume there's a cloud provider that handles all of the wiretapping services for both or all carriers. There's a single-point-of-failure for everything else nowadays anyway. Look at what happened with Crowdstrike, or Solarwinds, or any number of other big single-source providers. Nobody wants to maintain it in house, with predictable results.

tguvot 2y ago
there is nothing like this. the closest thing to it is something called TTP (trusted third party), that works as intermediary between telco and law enforcement agencies. they perform wiretap order processing, setups actual wiretaps, collect/bundle and ship away to agencies wiretapped information. but there is a bunch of them and you (telco) don't have to use them
- throwway120385 2y ago
  That's actually really good, then. Thank you for explaining this.

Hikikomori 2y ago

They probably dont have a public ip but just spearfish a network engineer at these ISPs and you'll have access to the devices performing the legal intercept.