Re: serious threat models

2006-02-08 Thread Peter Gutmann
Steven M. Bellovin [EMAIL PROTECTED] writes: What makes this interesting is how it was done: software was installed on the switch that diverted calls to a prepaid phone. Think about who could manage that. Just in case people think the answer is The MIB, it's actually Any kid with a bit of

Re: serious threat models

2006-02-04 Thread Matt Blaze
Yes, it's not at all clear from these stories just what was going on or how high tech the attack would have to be. What does diverting to a prepaid mobile mean? Here's a possibility: they social engineered or otherwise compromised the target account to assigned it a new telephone number and

Re: serious threat models

2006-02-04 Thread Perry E. Metzger
Steven M. Bellovin [EMAIL PROTECTED] wrote: I hate to play clipping service, but this story is too important not to mention. Many top Greek officials, including the Prime Minister, and the U.S. embassy had their mobile phones tapped. What makes this interesting is how it was done:

Re: serious threat models

2006-02-04 Thread Travis H.
On 2/3/06, Jaap-Henk Hoepman [EMAIL PROTECTED] wrote: could this be done using phone conference facilities? Good guess! http://www.schneier.com/blog/archives/2006/02/phone_tapping_i.html ``The code tapped into the conference call system. It conference called phone calls to 14 prepaid mobile

Re: serious threat models

2006-02-04 Thread Anne Lynn Wheeler
Perry E. Metzger wrote: All phone switches, thanks to the US government's CALEA rules, are equipped with software that makes espionage easy. Whether that software was abused in this instance, I do not know, but I will point out that any switch sold in the US -- which is to say most switches

Re: serious threat models

2006-02-04 Thread Sidney Markowitz
Matt Blaze wrote: Yes, it's not at all clear from these stories just what was going on or how high tech the attack would have to be. What does diverting to a prepaid mobile mean? There is more information in Bruce Scheier's blog entry and his links to blog and news articles. It hit slashdot

Re: serious threat models

2006-02-03 Thread Jaap-Henk Hoepman
I wondered about that too. Do commonly used mobile phone switches have built-in functionality to divert (or rather split) calls to another phone; could this be done using phone conference facilities? or could you easily use lawfull interception fucntionality...? In other words, could it be done

serious threat models

2006-02-02 Thread Steven M. Bellovin
I hate to play clipping service, but this story is too important not to mention. Many top Greek officials, including the Prime Minister, and the U.S. embassy had their mobile phones tapped. What makes this interesting is how it was done: software was installed on the switch that diverted