1

I know that, in most of the world, phone conversations are transmitted as digital data (whether frames in circuit switched protocols or packets). I know that several companies offer products which will convert GSM conversation data to VOIP at the base station or MSC level. I assume this data is not archived or saved anywhere (unless requested from authorities to the phone company). I think (but am not sure if this reflects today's world) this data is not encrypted for most of the travel from A to B (in GSM it's actually encrypted from the handset to the base station). I do know that most of the network infrastructure is reachable via IP from inside the owner company for management purpose.

My question is: is it technically possible for bad guys (or governments) to infiltrate from outside the routing infrastructure (without the phone company's knowledge) and archive / copy not just metadata, but conversations of one or more specific persons? Has this happened in the real world so far?

  • Hey @Giankun, I've found that people are lazy and will click "back" rather than read a giant wall of text. I've removed as much as I can without changing the core of your question (I hope). Feel free to edit your question if you think you can condense it further, or if you think I've removed something important. – Mike Ounsworth Dec 2 '15 at 14:30
  • I will add, as a comment, that this question is partially inspired by the infamous attacks on the Target POS infrastructure: I mean I was surprised both by the ability to hack hardware which was apparently well protected, not very powerful and unconnected like the pos card readers, and by the fact that Target did not apparently imagine something like that could happen until notified by authorities: now telecom infrastructure is surely more capable and more connected than card readers in a supermarket are (but more protected, I would hope). – Giankun Dec 2 '15 at 15:09
  • 1
    Yes, this happened in greece 2004: en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305 – Steffen Ullrich Dec 2 '15 at 16:30
  • Steffen, thank you. That pretty much solves my question. I was aware of a lot of cases in which the carrier was spying on someone without legal authorization, but I had not noticed news about a similar 0wn of the switching infrastructure. Thank you – Giankun Dec 2 '15 at 17:39
5

Giankun, this story by The Intercept says that it has already happened, as Steffen Ullrich said in the comments to your question. The link i provided above tells the long story about it. This second link talks about the greek incident and about another one that occurred in Italy.

There lots of articles about these incidents. Search for the names of dead engineers and results will pop up. There is also this blog entry titled "Who's murdering NSA whistleblowers?".

As you will note, officially, the mentioned institutions have no relation with the reported deaths, but the articles show that your question is already a reality.

  • Ok thanks, this is the kind of scenario I had in mind when I asked the question. Especially the Greek case as the Italian incident had been reported here, but it was said to have been orchestrated by people inside the phone company (so it means it would not be a real outside attack). – Giankun Dec 2 '15 at 17:42
  • I just read the story about the Greek case (which I admit I was not aware of), and it seems it's also strongly suspected of being an inside job (at least that is what Ericsson says). It does look like it's technically the kind of think I had in mind (meaning, it's based on someone being able to 0wn the routing infrastructure from outside - kind of). – Giankun Dec 2 '15 at 17:49
3

Yes. One of the more famous examples of this happening is phone phreak Kevin Mitnick. 20 years ago Mitnick was able to break into the telephone network, and tap the phone conversations of the very agents trying to catch him. Security is (hopefully) a bit better now, but there's no real reason to believe it's not possible to do this now.

  • Ok, I was aware of Mitnick, but he used social hacking and got access to company tools - basically phone numbers and codes (also maybe at the time phone conversations were still analogue? Or maybe not...). I was looking into some other kind of attack, like people owning routing infrastructure and stealing the streams itself. – Giankun Dec 2 '15 at 15:08
  • @Giankun That's basically what the NSA does. Though they 0wn the routing infrastructure, not own it. – Steve Sether Dec 2 '15 at 15:59
  • Steve yes... 0wn was what I meant. – Giankun Dec 2 '15 at 17:43
-1

The short answer - yes and yes. It's been done before by governments by breaking into ISP infrastructure, wiretapping at traffic aggregation points etc (just say smth about terrorists or child porn and you're free to break any law you want).

The longer answer about GSM: all the means of "over the air" interception I now of can be (in theory) detected by mobile operator if they carefully monitor their network for anomalies (flood of RACH disabling the cell, heavy radio interference, appearance of unknown cell in mobile reports etc). In practice - I doubt they bother.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.