0

In a recent tweet, a prominent UK journalist has claimed to have witnessed a European police force accessing content on a mobile phone just by using the telephone number.

https://twitter.com/krishgm/status/1388072994296184832

Are there any known technology or attacks that could do such a thing?

Edit

For clarity, here is the full thread of the tweet referenced in my original question. As pointed out in the comments to this question, the following tweet does add further context. I believe that the original question about the existence of technologies or attacks that would do such a thing remains vaild.

Original tweet thread

8
  • 3
    "... just by using the telephone number" - that is not what was claimed. To cite: "... If you have somebody’s number you can read everything on their phone with the right equipment.". Details are non-existing in the post, but in the past there were for example security issues where specifically designed MMS could be used to exploit the issue and achieve deep remote code execution on the device. Also, just because it was observed once by the journalist does not mean it is a universal attack applicable against any phones. May 1 at 12:36
  • That tweet is not correct, both Signal and WhatsApp are end to end encrypted. End to end encryption can only be broken at the handset level, they would need to compromise the phone.
    – defalt
    May 1 at 13:05
  • @defalt: Isn't your argument based on the assumption that knowledge of the phone number alone is not sufficient to compromise the phone at the handset level? At least in the past there were security issues which allowed exactly this, like MMS based exploits. May 1 at 13:12
  • My assumption is that they have to compromise a phone in some way. A centralised system that can target all OEMs' devices is not possible. There's too much fragmentation in the market of ARM devices. Even tripple letter agencies have to physically possess the device to extract messages.
    – defalt
    May 1 at 13:50
  • 1
    @defalt: "Even tripple letter agencies have to physically possess the device to extract messages" - physically possessing the device is not needed for this. The device can still be in the possession of the original user, but agencies could have used a security issue (or physical possession for some short time) to create a permanent backdoor on it. That's the way it usually works when continuous observation instead of post-mortem analysis is the goal. May 1 at 14:01
3

Such an assertion sounds conspirational and not founded in reality. However:

  • The SMS system has many known security issues. Network operators and state actors can locate mobile phones via a “silent SMS” or “stealth ping”. Network operators can associate a new SIM card with the number. SMS can easily be re-routed to a different recipient (without the intended recipient noticing). Since such attacks are possible at low cost, SMS is not a suitable mechanism for two-factor authentication or as a account recovery channel.
  • Unencrypted data transfers can be analyzed by anyone in a MITM position, such as network operators and state actors. In particular, SMS lacks encryption. However, all popular messaging apps use transit encryption.
  • Especially older phones have many known security vulnerabilities. For example, MMS handling is highly vulnerable under old Android versions due to the Stagefright bugs. This could be leveraged by an attacker to perform a no-click attack. As a high-profile example, Saudi Arabia allegedly hacked Jeff Bezos' iPhone via a malicious video file sent over Whatsapp in 2018.
  • Some countries (including the UK) allow devices to be actively hacked for security purposes. However, this can only work if there are vulnerabilities such as the one discussed above. In some cases, installation of surveillance software might require physical access.

However, exfiltration of data from a device necessarily requires more than just knowledge of the number – it generally requires physical access to the device, or an exploit to install malware on the device that will then send data from the phone to the attackers. However, that necessarily requires an active network connection.

There are more theoretical approaches for exfiltrating data from a device, such as side-channel attacks that monitor electromagnetic radiation from the device. However, these generally require close physical proximity to the device to work in lab settings.

So what is that tweet about? Clarification comes in a follow-up tweet from the author:

To be clear: I’m talking about messaging not apps such as banking or a Word document on your phone. The Italian police told me they could listen to and read any message traffic in real time

– @krishgm, https://twitter.com/krishgm/status/1388082271815671808

This indicates they are talking about interception of SMS, which is trivial, especially if the mobile network operator cooperates – which they might be legally required to do. SMS have next to no security guarantees like Confidentiality, Integrity, or Authenticity. This is in stark contrast to all mainstream messaging apps that do use transport encryption, or even end-to-end encryption. For example, it is exceedingly unlikely that Italian police have cracked Signal encryption. For messaging services with transit encryption but without E2EE, the messaging provider (such as Facebook or Telegram) does have the plaintext messages and could be compelled to hand them over to the police.

4
  • 1
    "This indicates they are talking about interception of SMS" - The tweet before the one you cite clearly says "... Including WhatsApp and signal". So the claim is not about SMS only. May 1 at 13:00
  • 1
    @SteffenUllrich I'd be inclined to attribute that to Hanlon's razor: the journalist in question most likely did not understand what they are seeing. Surely they're not knowingly spreading FUD for some reason. Here they claim that messages were intercepted without a malware implant which does not square with Whatsapp/Signal E2EE. If the Italian police were to have such capabilities (and were flaunting them with such weak opsec) this would indicate that all classical crypto is over.
    – amon
    May 1 at 13:09
  • I agree. There got probably several information snippets mixed up and simplified in the wrong way due to an insufficient technical understanding. May 1 at 13:38
  • Yes, I agree also that it is most likely that Guru-Murthy would have considered Signal and WhatsApp to be "messaging". May 2 at 8:10
-1

Attackers wishing to take over control of a phone would use an IMSI catcher. This operates as a fake mobile tower, so this is a MITM attack. Some countries do not have encrypted phone traffic, in others IMSI-catchers are used by law enforcement and intelligence agencies. It is possible to downgrade the GSM/LTE protocol so that mutual authentication between network and phone does not work.

When travelling through foreign airports, it is best not to switch on your phone until clear of the airport.

4
  • 1
    Reading traffic to a phone does not mean " take over control of a phone ". You've expanded the threat beyond reality.
    – schroeder
    May 1 at 18:33
  • I recently dealt with an incident like this. "Stingray (IMSI catcher] equipment could operate in both active and passive modes, in the first case the device simulates the behavior of a wireless carrier cell tower, in the second case it actively interferes with cellular devices performing operations like data exfiltration." resources.infosecinstitute.com/topic/…
    – Klaatu
    May 1 at 18:50
  • And that still isn't "taking over control of a phone". Please read the article you linked. Until you can connect the dots between "IMSI-catchers" and "control", this is fiction.
    – schroeder
    May 1 at 19:00
  • It requires another step - hidden SMS.
    – Klaatu
    May 3 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.