News

Greek mobile network illegal tapping: more data leaks out

More details have emerged on how Vodafone's Greek network was bugged three years ago to spy on top government officials.

To recap one of the most extraordinary wiretapping scandals of the post-Cold War era: eavesdroppers tapped the mobile phones of Greek Prime Minister Costas Karamanlis, cabinet ministers and security officials for about nine months between June 2004-Mar 2005 around the time of the Athens Olympics.

The mobile phones of about 100 people, whose ranks include journalists and Arabs living in Greece, as well as the country's political and security elite and a US embassy worker, were monitored after snooping software was illegally installed on the systems of Vodafone Greece.

The spyware diverted phone conversations from Vodafone subscribers to 14 'shadow' pay-as-you-go mobile phones, allowing calls to be monitored and - probably - recorded.

The Greek government reportedly first learned of the spying in March 2005, following a tip-off from Vodafone Greece after the cellco traced problems receiving text messages in January 2005 to eavesdropping software. But for this bug, introduced after the eavesdropping software was modified, the snooping might have gone on for years undetected.

The case is being investigated by the Greek government, which is expected to point the finger at likely culpits. A report is due shortly, according to the New York Times

Part of the government's investigation will re-examine the supposed suicide of Kostas Tsalikidis, 39, Vodafone Greece’s head of network design. He was found hanged in his Athens flat on March 9 2005, days after Vodafone Greece confirmed its network was bugged.

No arrests have been made in the case and speculation on who was responsible has focused, perhaps inevitably, on foreign intelligence agencies, mostly notably the NSA, the US's signals intelligence agency.

The July issue of IEEE Spectrum, the normally dry journal of the Institute of Electrical and Electronics Engineers, carries an article based on testimony in from parliamentary committee hearings about on the scandal and freedom of information requests. The piece, by computer scientists Vassillis Prevelakis and Diomidis Spinellis, is called The Athens Affair and makes for a very interesting read.

Software extensions in the Ericsson AXE switching equipment that permitted the "lawful interception" of mobile messages and calls by law enforcement agencies were apparently subverted to create the shadow accounts used the hack, the researchers discovered. The Ericsson exchange ran software modules needed to target and clone mobile phones but not the optional control interface software, which might have been used as an auditing tool to detect rogue wiretaps.

The same approach could equally be applied to monitoring fixed-line phones, so the fact that mobile devices were targeted in this case is - technically, at least - beside the point.

Skilled infiltrators - who probably had physical access to the switches' control terminals at several exchanges - used these modules to implement the eavesdropping operation.

Their presence on the system was hidden from Vodafone Greece technicians. Rootkit-style software was used to run the monitoring process. It is likely that the check-sum process used when technicians perform maintenance upgrades was also subverted. The software in four mobile switching exchanges was altered to plant back-doors that enabling snoopers to perform wiretap-related tasks without leaving a trace.

The hack was achieved using 6,500 lines of code, written in the specialist PLEX language, and planted on AXE Exchanges. Much of Ericsson's software development for the AXE has been outsourced over the last 15 years to Intracom Telecom, a Greek firm based in Athens, so the esoteric skills needed to perform the hack certainly exists locally.

Once Vodafone discovered the eavesdropping, after referring text message delivery problems to Ericsson, it bungled its own investigation - and frustrated those of others that might follow - by erasing crucial log data and destroying visitor sign-in books at one exchange in July 2005.

It also erased rogue software and accounts instead of monitoring what was taking place. The firm was fined €76m by Greek regulators last December.

The IEEE authors criticise the response of Greek law enforcement officials who, they say, failed to secure vital evidence. During the course of the investigation, police began to treat Ericsson and Vodafone as suspects rather than victims of a sophisticated hack.

The case raised questions about the security of other phone networks and the extent to which they are penetrated by intelligence agencies or other extremely well resourced and dedicated entities. Although the technical details of how the Vodafone Greece attack took place are now known, the destruction of crucial evidence means that the motives and identities of the perpetrators might be hidden forever.

The IEEE article has more details on the hack of the century here

Also see:

© Copyright The Register®  2007