Phone switch rootkit in Greek surveillance (Re: RISKS-24.72)

[Peter G. Neumann]

Jeremy Kirk, Greek spying case uncovers first phone switch rootkit, 12 Jul 2007
http://news.yahoo.com/s/infoworld/20070712/tc_infoworld/90154

A highly sophisticated spying operation that tapped into the mobile phones
of Greece's prime minister and other top government officials has
highlighted weaknesses in telecommunications systems that still use
decades-old computer code, according to a report by two computer scientists.

The spying case, where the calls of around 100 people were secretly tapped,
remains unsolved and is still being investigated. Also complicating the case
is the questionable suicide in March 2005 of a top engineer at Vodafone
Group in Greece in charge of network planning.

A look into how the hack was accomplished has revealed an operation of
breathtaking depth and success, according to an analysis on IEEE Spectrum
Online, the Web site of the Institute of Electrical and Electronics
Engineers.

The case includes the "first known rootkit that has been installed in an
[phone] exchange," said Diomidis Spinellis, an associate professor at the
Athens University of Economics and Business, who authored the report with
Vassilis Prevelakis, an assistant professor of computer science at Drexel
University in Philadelphia.

A rootkit is a special program that buries itself deep into an OS for some
malicious activity and is extremely difficult to detect. The rootkit enabled
a transaction log to be disabled and allow call monitoring on four switches
made by Telefonaktiebolaget LM Ericsson within Vodafone's equipment. The
software enabled the hackers to monitor phone calls in the same way law
enforcement would, minus the required court order. The software allowed for
a second, parallel voice stream to be sent to another phone for monitoring.

The intruders covered their tracks by installing patches on the system to
route around logging mechanisms that would alert administrators that calls
were being monitored. "It took guile and some serious programming chops to
manipulate the lawful call-intercept functions in Vodafone's mobile
switching centers," the authors wrote.

The secret operation was finally discovered around January 2005 when the
hackers tried to update their software and interfered with how text messages
were forwarded, which generated an alert. Investigators found hackers had
installed 6,500 lines of code, an extremely complex coding feat.

"The size of the code is not something that somebody could hack in a
weekend," Spinellis said. "It takes a lot of expertise and time to do that."

The investigation, which included a Greek parliamentary inquiry, netted no
suspects, due in part to key data that was lost or destroyed by Vodafone,
the authors wrote. It's not known if the hack was an inside job.

Vodafone may have been able to discover the scheme sooner through
statistical call analysis that could have linked the calls of those being
monitored to calls to phones used to monitor the conversations, they wrote.
Carriers already do that sort of analysis, but more for marketing than
security.

But the defense against rogue code, viruses and rootkits is complicated due
to how telecom infrastructure has developed. "Complex interactions between
subsystems and baroque coding styles (some of them remnants of programs
written 20 or 30 years ago) confound developers and auditors alike," the
report said.

------------------------------