infosec – Page 13 – Stilgherrian

08 March 201508 March 2015

Weekly Wrap 248: Logic, rants, and a pleasing balance

My week of Monday 2 to Sunday 8 March 2015 was productive, although not everything happened in the sequence that I’d intended, and not everything has appeared yet.

Articles

Australian lawmakers can’t use phones, will vote on data retention, ZDNet Australia, 3 March 2015. It’s kind of a rant, but now that the internet has been commercially available in Australia for 20 years, such ignorance is inexcusable.

I also wrote a feature story and another column for ZDNet Australia, but they’re both still working their way through the production pipeline.

Podcasts

“The 9pm Shut Up It’s Called Logic”, being The 9pm Edict episode 38. It’s also available on SoundCloud. This is another hour-long episode, which took about 10 hours to produce, what with all the ancillary tasks.
I also wrote up the results of “The 9pm Summer Scrounge”, the rather half-based subscriber drive for The 9pm Edict.

5at5

There were actually six editions of 5at5 this week, on Monday, Tuesday, Wednesday, Thursday, Friday and Saturday. You should subscribe, you know.

Media Appearances

On Monday I was quoted at Telecom Ramblings by Don Sambandaraksa:

Gemalto 3G/4G SIMs must be “…ultra-mega super-magical. With extra cyber unicorns,” ZDNet Australiaâ€™s Stilgherrian said of its ability to be secure even though keys were compromised.
On Tuesday night, I spoke about various tech stories on ABC 702 Sydney, but there’s no recording.
On Thursday, I spoke about Airpnp and sharing economy on ABC 105.7 Darwin.

Corporate Largesse

I received a copy of the second novel in John Birminghamâ€™s new series, Resistance: A Dave Hooper Novel 2, which is rather lovely. I’ll be reading it soon, because I really liked the first book in this series.

The Week Ahead

Monday will be a day of communication and planning, wrapping up with drinks and, I suspect, dinner with friends in Katoomba. Tuesday is not yet allocated to anything specific.

Wednesday will see a day trip to Sydney for a lunchtime briefing by MuleSoft. Thursday will probably see another long commute for a morning briefing by Deloitte, although I may just dial in instead. Somewhere in there, I’ll write a column for ZDNet Australia.

Friday through Saturday are unplanned at this stage. But since I didn’t visit Albion Park today to watch Qantas land their Boeing 747, I may visit the Historical Aircraft Restoration Society (HARS) for one its open days — which can be any of those three days. I’ll have to figure out which would work best, given the rest of my schedule.

Further Ahead

I’ll be in Melbourne from Tuesday 17 to Sunday 22 March for the Cisco LIVE event and then a couple days of meetings and the like. If you feel the need to catch up, or any other urges, please let me know.

[Photo: Downpour at Katoomba station, photographed on 1 March 2015. Technically that’s outside the timespan covered by this post, but I’m beyond caring any more.]

26 February 2015

Talking Gemalto’s response to ‘hack’ on ABC Radio’s AM

ABC logo So SIM card manufacturer Gemalto has responded to the claims that America’s NSA and Britain’s GCHQ had hacked their network in 2010 and 2011 and stolen SIM card encryption keys. I spoke about that response on ABC Radio’s AM this morning.

You can read Gemalto’s full press statement, but The Wall Street Journal has a good summary, and The Intercept has various infosec experts disputing Gemalto’s analysis.

If nothing else, it seems unlikely that Gemalto could have conducted a thorough forensic investigation in just six days — although they may have just dig out a report they’d prepared earlier.

Here’s how AM introduced the story today:

Overnight the world’s largest SIM card manufacturer has responded to allegations it was hacked by American and British spies. Dutch company Gemalto confirmed it was the target of sophisticated hacks in 2010 and 2011, and most likely the US National Security Agency and their British counterparts were responsible. Last week, documents from Edward Snowden alleged spies stole encryption keys from Gemalto, giving them potential to monitor mobile communications. But Gemalto denies there was mass theft of encryption keys and says their products are secure.

And here’s the full report from journalist Sarah Sedghi.

Podcast: Play in new window | Download (1.8MB)

25 February 2015

Talking SIM cards, spooks and hacks on 1395 FIVEaa

Third time’s the charm, right? My third radio spot on The Great SIM Heist was for 1395 FIVEaa in Adelaide on Wednesday afternoon.

Again, I won’t repeat the background, because it’s all in my first post on the subject. But I will say that this is the most detailed conversation about it so far, because presenter Will Goodings and I spoke for 13 minutes.

That said, there’s not much more information than we had yesterday. Gemalto isn’t due to hold its press conference until late this evening Australian time, so we’ll know more tomorrow.

Podcast: Play in new window | Download (18.4MB)

25 February 201525 February 2015

Talking SIM cards, spooks and hacks on 2UE

The second radio spot I did on The Great SIM Heist — or perhaps I should say the claimed heist, or even the alleged heist — was for the Sydney talk radio station 2UE on Tuesday afternoon.

I won’t repeat all the background. See my previous post for that. But I will say that it’s always interesting to hear the different questions asked and concerns raised by different presenters. And of course my responses differ in content and style to match the style of the program and the radio station.

Here’s the full seven-minute chat with drive presenter Justin Smith. At the end, we seem to have invented a new regular segment. And at least this time I pronounced Gemalto correctly.

Podcast: Play in new window | Download (7.0MB)

25 February 201510 March 2015

Talking SIM cards, spooks and hacks on The World Today

ABC logo On Friday, The Intercept published some astounding claims under the headline The Great SIM Heist: How spies stole the keys to the encryption castle. The story claims that Five Eyes spooks had achieved a major breakthrough in their ability to monitor mobile communications.

American and British spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden…

With these stolen encryption keys, intelligence agencies can monitor mobile communications without seeking or receiving approval from telecom companies and foreign governments. Possessing the keys also sidesteps the need to get a warrant or a wiretap, while leaving no trace on the wireless provider’s network that the communications were intercepted. Bulk key theft additionally enables the intelligence agencies to unlock any previously encrypted communications they had already intercepted, but did not yet have the ability to decrypt.

The company in question is Gemalto. With headquarters in Amsterdam, and 28 “personalisation facilities” around the world that burn the encryption keys into SIM cards, it has nearly 30% of the market — making it an obvious target for spooks.

The story started to filter through to the mainstream media on Monday in the US, or Tuesday Australian time, and I’ve already done two radio spots on the topic — and doubtless there’ll be more to come.

The first spot was an interview for ABC Radio, and parts of it ended up in this report on The World Today.

[The three Australian mobile network operators] Telstra, Vodafone and Optus have all confirmed that Gemalto has supplied their SIM cards. Sarah Sedghi reports.

This is the full five-minute report.

Podcast: Play in new window | Download (Duration: 4:59 — 2.3MB)

22 February 201522 February 2015

Weekly Wrap 246: Tired, hollow, but oh so productive

My week of Monday 16 to Sunday 22 February 2015 has been busy, productive and exhausting. And it’s still going. If only my life lately were about more than just trying to be busy and productive. Sigh.

Podcasts

“The 9pm Malcolm and the Cnuts”, being The 9pm Edict episode 37. I hadn’t planned to do an episode of the Edict this week, but on Friday I had an encounter with Malcolm Turnbull, and one thing led to another… But I am getting more efficient. This episode only took six hours to produce, although it did omit a couple of regular segments.
Corrupted Nerds Extra: Malcolm Turnbull opens NICTA Techfest 2015, being the full audio of Turnbull’s speech and subsequent doorstop press conference.

Articles

Stop monkeying around with our metadata laws, prime minister, ZDNet Australia, 19 February 2015. I’ve had an incredible reaction to this story about Australia’s plans for mandatory telecommunications data retention. The Prime Minister makes his major statement on national security tomorrow. He’s wanting to rush this legislation through parliament before the end of March. But as this article and this week’s Download This Show explain, even some law enforcement folks are concerned about this unseemly haste.
Lenovo screwed by the Superfish: a cybersecurity nightmare, Crikey, 20 February 2015.

5at5

There were four editions of 5at5 this week, on Monday, Wednesday, Friday, and an off-schedule 7at7 on Sunday morning. You might want to subscribe so you receive them all as they’re released. Subscribe. Just subscribe.

Media Appearances

None.

Corporate Largesse

On Friday, I went to NICTA’s Techfest at Australian Technology Park, where I was fed and watered.
Sunday is the first day of the Tech Leaders Forum, formerly known as Kickstart, at the Fairmont Resort. The event continues on Monday, so I’ll post the full list of largesse next week.

The Week Ahead

Monday is the second and final day of the Tech Leaders Forum, after which I shall collapse and have an early night.

On Tuesday and Wednesday, I’m writing a feature for ZDNet Australia.

On Thursday, I’m heading to Sydney for the next step in my treatment program for sleep apnoea — which I have yet to blog about in any detail — as well as some errands and then, at 1615 AEDT, a television spot on ABC News24.

On Friday, I’ll probably be writing my usual column for ZDNet Australia.

Saturday is unplanned. Place your bids now.

On Sunday, I’ll be producing an episode of The 9pm Edict podcast. Because I am an idiot.

[Photo: Log. Termites had eaten out the core of this tree at Bunjaree Cottages, and it had filled with water — much to the surprise of the chain-saw wielding chap who felled it. A shame I wasn’t there to see it. Photographed on 20 February 2015.]