I was puzzling about the news story re: spies listening in on Trump phone calls, and in searching for the cellular protocols I found this old blog post I wrote. blog.cryptographyengineering.com/2013/05/14/a-f…
The TL;DR is that there are a ton of active attacks on cellular protocols like GSM (in which someone poses as a tower). But it’s hard to imagine China and Russia doing these and not being caught or jammed by the secret service or the FBI.
If they’re not running active attacks then that leaves some attack on the phone company infrastructure (not a wireless attack) or some passive decryption attack on the wireless signal.
Who can say about the former. The latter would depend on (1) some really bad crypto, (2) a theft of keys from a SIM or SIM card manufacturer, (3) unauthorized access to the cellular provider or nearby towers.
Hacking keys out of a tower seems like it could be possible. I’m sure the FBI et al. try to stop this kind of thing, but I’m not convinced that they’re going to succeed unless they control the hardware. The tower (SN/VLR) does have everything. 
The other possibility is that someone really screwed up the crypto. And looking at this one (possibly not adopted!) proposal for deriving cellular encryption keys, that’s not totally impossible. This is nuts.
Anyway. This all makes me nostalgic for the days when all we had to worry about was the NSA spying on everyone. I like this new world a lot less.
Related: politico.com/story/2017/10/…
Another good thread by @alexstamos on what might be happening with Trump’s phone.
Ok, the last thing I want to say about this Trump cell-phone interception story...
A few years ago a USG official asked a Microsoft rep why it mattered that consumer devices have strong encryption.
His reply: there’s no such thing as a “consumer device”. Our high-sensitivity customers (CEOs, politicians) use the same devices as everyone else.
His reply: there’s no such thing as a “consumer device”. Our high-sensitivity customers (CEOs, politicians) use the same devices as everyone else.
Now the President of the United States is putting his security, and maybe the security of the country, at the mercy of a bunch of crummy “consumer grade” telecom security protocols. Couldn’t be a better illustration of the phenomenon.
