The company has conducted an investigation following a report by The Intercept based on documents leaked by whistleblower Edward Snowden. The documents said the US National Security Agency (NSA) and the UK’s GCHQ hacked into Gemalto to steal encryption keys used to protect the privacy of mobile phone communications.
However, the company said the attacks breached its office networks and could not have resulted in a massive theft of Sim encryption keys, as claimed by The Intercept report.
The operation aimed to intercept the encryption keys as they were exchanged between mobile operators and their suppliers globally, but according to Gemalto it had widely deployed a secure transfer system with its customers by 2010.
According to a Gemalto investigation, only rare exceptions to this scheme could have led to theft.
Read more about security breaches
- Cyber criminals compromised more than a billion data records in 2014 in more than 1,500 breaches, according to the latest breach report from Gemalto
- The alleged hacking of Sim maker Gemalto by UK and US spy agencies to steal mobile communication encryption keys is not a huge surprise, according to a Europol adviser on cyber security
“In the case of an eventual key theft, the intelligence services would only be able to spy on communications on second-generation 2G mobile networks. 3G and 4G networks are not vulnerable to this type of attack,” said Gemalto. “None of our other products were impacted by this attack.”
The company said the best counter-measures to these type of attacks are the systematic encryption of data when stored and in transit, the use of the latest Sim cards and customised algorithms for each operator.
Gemalto experienced many attacks
Gemalto confirmed that during the period covered by the documents from the NSA and GCHQ the company experienced many attacks. “In particular, in 2010 and 2011, we detected two particularly sophisticated intrusions which could be related to the [NSA and GCHQ] operation,” said the company.
In June 2010, Gemalto noticed suspicious activity in one of its French sites where a third party was trying to spy on the office network, which is used by employees to communicate with each other and the outside world. “Action was immediately taken to counter the threat,” the company said.
Our network architecture is designed like a cross between an onion and an orange – it has multiple layers and segments which help to cluster and isolate data
In July 2010, a second incident was identified by Gemalto’s security team. This involved fake emails sent to one of its mobile operator customers spoofing legitimate Gemalto email addresses. The fake emails contained an attachment that could download malicious code.
“We immediately informed the customer and also notified the relevant authorities both of the incident itself and the type of malware used,” Gemalto said.
During the same period, the company’s security team also detected several attempts to access the PCs of Gemalto employees who had regular contact with customers.
“At the time we were unable to identify the perpetrators but we now think that they could be related to the NSA and GCHQ operation,” said Gemalto.
But, the investigation found these intrusions affected only the outer parts of Gemalto’s networks that were in contact with the outside world.
“The Sim encryption keys and other customer data in general, are not stored on these networks. It is important to understand that our network architecture is designed like a cross between an onion and an orange – it has multiple layers and segments which help to cluster and isolate data,” the company said.
According to Gemalto, no breaches were found in the infrastructure running its Sim activity or in other parts of the secure network which manage its other products such as banking cards, ID cards or electronic passports.
“Each of these networks is isolated from one another and they are not connected to external networks,” the investigation report said.
Intelligence services targeted data as it was transmitted
The report said it is extremely difficult to remotely attack a large number of Sim cards on an individual basis. “This fact, combined with the complex architecture of our networks explains why the intelligence services instead, chose to target the data as it was transmitted between suppliers and mobile operators,” it said.
The investigation report claimed the risk of the data being intercepted as it was shared with its customers was greatly reduced with the “generalisation of highly secure exchange processes” that had been implemented before 2010.
The report from The Intercept indicates attacks were targeted at mobile operators in Afghanistan, Yemen, India, Serbia, Iran, Iceland, Somalia, Pakistan and Tajikistan. It also states that when operators used secure data exchange methods the interception technique did not work. In particular, it "failed to produce results against Pakistani networks", according to the report.
Gemalto has confirmed the transmission of data between Pakistani operators and Gemalto used the highly secure exchange process at that time. However, the company said that in 2010, these data transmission methods were not universally used and certain operators and suppliers had opted not to use them. “In Gemalto's case, the secure transfer system was standard practice and its non-use would only occur in exceptional circumstances,” the company said.
The investigation report notes that analysis of the leaked spy agency documents shows the NSA and GCHQ targeted numerous parties beyond Gemalto.
“As the leader in the market, Gemalto may have been the target of choice for the intelligence services in order to reach the highest number of mobile phones. However, we can see in the document that many aspects do not relate to Gemalto,” the company said.
As an example, the report said Gemalto has never sold Sim cards to four of the 12 operators listed in the documents, in particular to the Somali carrier where a reported 300,000 keys were stolen.
Most operators in targeted countries still using 2G
The Gemalto investigation points out that in 2010-2011 most operators in the targeted countries were still using 2G networks.
According to the investigation report, the security level of this second-generation technology was initially developed in the 1980s and was already considered weak and outdated by 2010.
Even if the encryption keys were intercepted by the intelligence services, they would have been of limited use
“If the 2G SIM card encryption keys were to be intercepted by the intelligence services, it would be technically possible for them to spy on communications when the Sim card was in use in a mobile phone. This is a known weakness of the old 2G technology and for many years we have recommended that operators deploy extra security mechanisms," the report said.
“However, even if the encryption keys were intercepted by the intelligence services, they would have been of limited use. This is because most 2G Sims in service at that time in these countries were prepaid cards which have a very short life cycle, typically between three and six months."
Gemalto pointed out that this known weakness in the original 2G standards was removed with the introduction of proprietary algorithms, which are still used as an extra level of security by major network operators.
The security level was further increased with the arrival of 3G and 4G technologies which have additional encryption. “If someone intercepted the encryption keys used in 3G or 4G Sims, they would not be able to connect to the networks and consequently would be unable to spy on communications," the report said.
“Therefore, 3G and 4G cards could not be affected by the described attack. However, though backward compatible with 2G, these newer products are not used everywhere around the world as they are a bit more expensive and sometimes operators base their purchasing decision on price alone.”
Gelmalto products designed to ensure "highest degree of security"
Gemalto said its security products, infrastructure and processes are designed to ensure the highest degree of security in a global, open, and commercial environment.
“These are regularly audited and certified by third-party private and public organisations," said the company.
"Nevertheless, we are conscious that the most eminent state agencies, especially when they work together, have resources and legal support that go far beyond that of typical hackers and criminal organisations. And, we are concerned that they could be involved in such indiscriminate operations against private companies with no grounds for suspicion.”
Gemalto said any organisaton could be subject to a cyber attack, and therefore it is important to follow security best practices and adopt the most recent technologies.
“These include advanced data encryption, so that even if networks are breached, third parties cannot access any of the stolen information,” the company said.
The investigation report concludes by saying Gemalto will continue to monitor its networks and improve its processes.