According to The Intercept, which has received the Snowden documents, the NSA and the GCHQ have managed to infiltrate one of the biggest SIM manufacturers in the world, called Gemalto, and steal all of its SIM card encryption keys. This gives the NSA and the GCHQ the ability to decrypt all phone calls or SMS messages in real-time. It also allows the two agencies to decrypt any conversations that have been previously collected.
“Key theft enables the bulk, low-risk surveillance of encrypted communications," the ACLU's Chris Soghoian said. "Agencies can collect all the communications and then look through them later. With the keys, they can decrypt whatever they want, whenever they want. It's like a time machine, enabling the surveillance of communications that occurred before someone was even a target."
Gemalto is a multinational incorporated in the Netherlands that operates in 85 countries and has more than 40 manufacturing facilities. Gemalto's clients include Verizon, AT&T, Sprint, T-mobile and 450 other carriers. The company's motto, perhaps a little ironically in this case, is "Security to be Free."
According to The Intercept, Gemalto's employees were "cyberstalked" by the GCHQ, which hacked into the employees' email and Facebook accounts in order to find a way back into the company's systems.
The biggest danger of this SIM encryption key heist is that the NSA and the GCHQ can spy on anyone in the world who uses a Gemalto SIM, without ever needing a warrant and without being detected. With hacking, there's usually some evidence of tampering. It's much more difficult to discover that someone is decrypting the conversation with the key.
The long term solution to stop such heists from happening again would be for carriers and SIM makers to use Perfect Forward Secrecy (PFS), a security feature that could rotate the encryption keys after every conversation. This would make mass surveillance (in this particular way) drastically more difficult. Spy agencies would have to get the key for each conversation, rather than for each SIM card.
If you don't want your private conversations intercepted by spy agencies or other hackers who may have stolen the keys as well, the best way to protect yourself against this type of surveillance right now is to only use encrypted applications such as Signal/RedPhone, Silent Phone, Silent Text (which uses end-to-end encryption and can't be decrypted by any third party).
Applications protected by TLS encryption such as Hangouts or Skype can also work, but they can be decrypted by the companies themselves or with a court order from authorities.
Follow us @tomshardware, on Facebook and on Google+.
