5 ms·

Firstly, I'm amazed that a large global corporation has put out a press release saying it has "reasonable grounds to believe that an operation by NSA and GCHQ p

by r0h1n 12y ago

Firstly, I'm amazed that a large global corporation has put out a press release saying it has "reasonable grounds to believe that an operation by NSA and GCHQ probably happened." Wow. That said, I wonder if Gemalto really had any other option than to say its keys weren't stolen. What might be the cost of replacing all affected SIM cards?

RexRollman 12y ago
The SIM cards aren't going to be replaced even if true. I just don't see that happening.
- mike_hearn 12y ago
  As they point out, SIM churn is not an uncommon thing especially in the poorer countries these agencies were targeting. Even in the worst case scenarios where every SIM had to be replaced, they'd probably just allow natural rollover to occur over a multi-year period. But it seems like that isn't really needed because the stolen keys were mostly replaced already anyway. Anyone who suspects they might be a person of interest can always just request a new one from their carrier.
  - toyg 12y ago
    > Anyone who suspects they might be a person of interest can always just request a new one from their carrier. I doubt SIMs are manufactured just-in-time for each individual customer; more likely, carriers order batches of hundreds/thousands/millions SIMs. Without a recall program, it will take years before you can be confident that your freshly-acquired SIM is not compromised. I'd say it's safe to assume that from now on, any cellphone communication can be trivially intercepted by NSA/GCHQ. The most paranoid already assumed that, but now we have confirmation.
  - higherpurpose 12y ago
    Only if you assume that the last time they stole the Gemalto keys was in 2011. The Snowden documents themselves go up to 2012.
fab13n 12y ago
> reasonable grounds to believe that an operation by NSA and GCHQ probably happened. No kidding, they've been bought, under more-than-suspicious circumstances, by [inQtel](https://www.iqt.org/ https://www.iqt.org/) and [Texas Partner Group](https://tpg.com/ https://tpg.com/), which officially are CIA proxies. I don't think they had to resort to tailored access to perform their heist, I'd rather bet that they still have enough former colleagues inside Gemalto to get whatever they want by simply entering the correct password on the correct keyboard.
- bjornsing 12y ago
  Are you serious?!? Is Gemalto wholly owned by the CIA (through well known proxies), and nobody is reporting on that...? No...
  - fab13n 12y ago
    Ostensibly, they've sold it back years ago. But that just means they don't need to officially own it anymore: Alex Mandl, Gemalto's current chairman, is among others a former board member of intQtel, which presents its mission on its web page as: We identify, adapt, and deliver innovative technology solutions to support the missions of the Central Intelligence Agency and broader U.S. Intelligence Community. So the news that nobody wants spread is: nobody cares about how much the NSA stole from Gemalto: whatever Gemalto has and NSA wants, the NSA is most likely to get by simply asking NSA affiliates installed at every interesting node in Gemalto's hierarchy. Incidentally, it's rather easy to find sources about this in French (Gemplus used to be a French company, before the fusion with Axalto which was forced by intQtel and TPG), but surprisingly hard to find in English.
    - toyg 12y ago
      > nobody cares about how much the NSA stole from Gemalto: whatever Gemalto has and NSA wants, the NSA is most likely to get by simply asking NSA affiliates This seems at odds with the leaked documents though. Why going to the trouble of compromising a company you've already social-engineered to the max?
steedsofwar 12y ago
At this point, i suspect it's damage limitation.
kbart 12y ago
They are based in Netherlands, out of reach of secret courts and national security letters, what should they be afraid of?
- wila 12y ago
  It's a commercial business, they are afraid of loosing sales. The statement made is pretty much a text book declaration of damage control. Personally I'm not buying their claims, but only they can proof it happened and they never will as the market will loose complete faith in buying from them.
- Intermernet 12y ago
  The NSLs and secret courts are great for justifying what's done to companies and individuals based in the USA. If you're based in the Netherlands, no such justification is necessary.
- chinathrow 12y ago
  They are a listed company at US stock exchanges and they have at least one office in Texas.

by r0h1n 12y ago

RexRollman 12y ago

The SIM cards aren't going to be replaced even if true. I just don't see that happening.

mike_hearn 12y ago
As they point out, SIM churn is not an uncommon thing especially in the poorer countries these agencies were targeting. Even in the worst case scenarios where every SIM had to be replaced, they'd probably just allow natural rollover to occur over a multi-year period. But it seems like that isn't really needed because the stolen keys were mostly replaced already anyway. Anyone who suspects they might be a person of interest can always just request a new one from their carrier.
- toyg 12y ago
  > Anyone who suspects they might be a person of interest can always just request a new one from their carrier. I doubt SIMs are manufactured just-in-time for each individual customer; more likely, carriers order batches of hundreds/thousands/millions SIMs. Without a recall program, it will take years before you can be confident that your freshly-acquired SIM is not compromised. I'd say it's safe to assume that from now on, any cellphone communication can be trivially intercepted by NSA/GCHQ. The most paranoid already assumed that, but now we have confirmation.
- higherpurpose 12y ago
  Only if you assume that the last time they stole the Gemalto keys was in 2011. The Snowden documents themselves go up to 2012.

fab13n 12y ago

> reasonable grounds to believe that an operation by NSA and GCHQ probably happened. No kidding, they've been bought, under more-than-suspicious circumstances, by [inQtel](https://www.iqt.org/ https://www.iqt.org/) and [Texas Partner Group](https://tpg.com/ https://tpg.com/), which officially are CIA proxies. I don't think they had to resort to tailored access to perform their heist, I'd rather bet that they still have enough former colleagues inside Gemalto to get whatever they want by simply entering the correct password on the correct keyboard.

bjornsing 12y ago
Are you serious?!? Is Gemalto wholly owned by the CIA (through well known proxies), and nobody is reporting on that...? No...
- fab13n 12y ago
  Ostensibly, they've sold it back years ago. But that just means they don't need to officially own it anymore: Alex Mandl, Gemalto's current chairman, is among others a former board member of intQtel, which presents its mission on its web page as: We identify, adapt, and deliver innovative technology solutions to support the missions of the Central Intelligence Agency and broader U.S. Intelligence Community. So the news that nobody wants spread is: nobody cares about how much the NSA stole from Gemalto: whatever Gemalto has and NSA wants, the NSA is most likely to get by simply asking NSA affiliates installed at every interesting node in Gemalto's hierarchy. Incidentally, it's rather easy to find sources about this in French (Gemplus used to be a French company, before the fusion with Axalto which was forced by intQtel and TPG), but surprisingly hard to find in English.
  - toyg 12y ago
    > nobody cares about how much the NSA stole from Gemalto: whatever Gemalto has and NSA wants, the NSA is most likely to get by simply asking NSA affiliates This seems at odds with the leaked documents though. Why going to the trouble of compromising a company you've already social-engineered to the max?

steedsofwar 12y ago

At this point, i suspect it's damage limitation.

kbart 12y ago

They are based in Netherlands, out of reach of secret courts and national security letters, what should they be afraid of?

wila 12y ago
It's a commercial business, they are afraid of loosing sales. The statement made is pretty much a text book declaration of damage control. Personally I'm not buying their claims, but only they can proof it happened and they never will as the market will loose complete faith in buying from them.
Intermernet 12y ago
The NSLs and secret courts are great for justifying what's done to companies and individuals based in the USA. If you're based in the Netherlands, no such justification is necessary.
chinathrow 12y ago
They are a listed company at US stock exchanges and they have at least one office in Texas.