NSA, GCHQ Can Decrypt Calls And SMS In Real-Time With Stolen SIM Encryption Keys

According to The Intercept, which has received the Snowden documents, the NSA and the GCHQ have managed to infiltrate one of the biggest SIM manufacturers in the world, called Gemalto, and steal all of its SIM card encryption keys. This gives the NSA and the GCHQ the ability to decrypt all phone calls or SMS messages in real-time. It also allows the two agencies to decrypt any conversations that have been previously collected.

“Key theft enables the bulk, low-risk surveillance of encrypted communications," the ACLU's Chris Soghoian said. "Agencies can collect all the communications and then look through them later. With the keys, they can decrypt whatever they want, whenever they want. It's like a time machine, enabling the surveillance of communications that occurred before someone was even a target."

Gemalto is a multinational incorporated in the Netherlands that operates in 85 countries and has more than 40 manufacturing facilities. Gemalto's clients include Verizon, AT&T, Sprint, T-mobile and 450 other carriers. The company's motto, perhaps a little ironically in this case, is "Security to be Free."

According to The Intercept, Gemalto's employees were "cyberstalked" by the GCHQ, which hacked into the employees' email and Facebook accounts in order to find a way back into the company's systems.

The biggest danger of this SIM encryption key heist is that the NSA and the GCHQ can spy on anyone in the world who uses a Gemalto SIM, without ever needing a warrant and without being detected. With hacking, there's usually some evidence of tampering. It's much more difficult to discover that someone is decrypting the conversation with the key.

The long term solution to stop such heists from happening again would be for carriers and SIM makers to use Perfect Forward Secrecy (PFS), a security feature that could rotate the encryption keys after every conversation. This would make mass surveillance (in this particular way) drastically more difficult. Spy agencies would have to get the key for each conversation, rather than for each SIM card.

If you don't want your private conversations intercepted by spy agencies or other hackers who may have stolen the keys as well, the best way to protect yourself against this type of surveillance right now is to only use encrypted applications such as Signal/RedPhone, Silent Phone, Silent Text (which uses end-to-end encryption and can't be decrypted by any third party).

Applications protected by TLS encryption such as Hangouts or Skype can also work, but they can be decrypted by the companies themselves or with a court order from authorities.

Follow us @tomshardware, on Facebook and on Google+.

Lucian Armasu
Lucian Armasu is a Contributing Writer for Tom's Hardware US. He covers software news and the issues surrounding privacy and security.
  • Mike Coberly
    What about TextSecure? From the same maker as RedPhone.
    Reply
  • washmc
    Yeah add Text Secure
    Reply
  • f-14
    too big to fail, this is why you simple have to anti trust bust anything like this.
    Reply
  • If they want to listen to me talk to my wife about what food to buy at the shop or read my text messages to my brother about his friends computer not working then go right ahead, really who cares they can do this?... Your private conversations are not as important as you think.
    Reply
  • spentshells
    Is there a reason the people of the USA allow these laws to be broken?
    Reply
  • dstarr3
    If they want to listen to me talk to my wife about what food to buy at the shop or read my text messages to my brother about his friends computer not working then go right ahead, really who cares they can do this?... Your private conversations are not as important as you think.

    99% of Americans have nothing to hide, either. Saying "Go ahead and spy on me, I'm innocent" is like saying that privacy is a right reserved only for criminals.
    Reply
  • someguynamedmatt
    99% of Americans have nothing to hide, either. Saying "Go ahead and spy on me, I'm innocent" is like saying that privacy is a right reserved only for criminals.
    The alternative is to freely allow those same criminals to operate with all the privacy they could possibly need under protection of the government. Has the NSA personally caused you problems in some way? If so, you've been doing something you seriously shouldn't have. If not, then why are you complaining?
    Reply
  • yyk71200
    99% of Americans have nothing to hide, either. Saying "Go ahead and spy on me, I'm innocent" is like saying that privacy is a right reserved only for criminals.
    The alternative is to freely allow those same criminals to operate with all the privacy they could possibly need under protection of the government. Has the NSA personally caused you problems in some way? If so, you've been doing something you seriously shouldn't have. If not, then why are you complaining?
    If you don't care about privacy so much, why don't you post your credit card numbers, bank account numbers, social security number here on the forums?

    Or how about this, let NSA put a fiber optics in your bathroom? After all you may hide something bad in there. If you have nothing to hide, why not?
    Reply
  • achoo2
    I don't really follow cellular tech., so please excuse me if this is a dumb question... but, cellular calls aren't generally end-to-end encrypted, are they? That is, who cares if the government can decode the signal between your handset and the tower - they already have direct access at the trunks. If and when it becomes possible to encrypt a cellular call end-to-end, a la STU, I seriously doubt the encryption keys of choice will be hardcoded into the third-party SIM card.
    Reply
  • CKKwan
    No, it is China! Not US! US will never do this kind of shity anti-privacy human rights job.
    Reply