Thread by @RidT

An observation on the Taurus leak that I have not seen elsewhere (could have missed it):

The intercepted recording starts with BG Frank Graefe, in Singapore, saying "Hallo," to which the response is "Moin Moin Herr General, Hauptmann Irrgang hier." "Servus." (A common greeting)

Irrgang: "I would add you now, if you like."

Graefe: "Thank you."

Then: automated Webex voice: "You are accessing the conference now."

My interpretation: the general, from a hotel room in Singapore, likely did not join by URL, but called a staff officer to phone-connect him into the meeting. The intercept likely started before entering the Webex session. So that leaves us with two most probable scenarios:

1) The intercept happened on the general's phone line.
2) The intercept happened on the general's end point (phone).

There are other scenarios, but these are probably the most likely.

Coincidence, yes, but the day before the story broke Sen Wyden highlighted Diameter/SS7 vulns

The Taurus leak is a welcome reminder: neither governments (nor anybody else) should not allow dial-in via open, unencrypted lines into meetings, no matter the subject.

There is no good reason for Webex, Zoom, Teams not to have a bridge for WhatsApp or Signal calls into meetings

The biggest irony in all of this: the German government, including the Bundeswehr (!), are way ahead of the curve—even ahead of the US gov't—with their initiative to implement a secure, end-to-end encrypted comms platform with video conference capability🤷‍♂️ element.io/matrix-in-germ…

Worth making explicit this point by Martin here: whatever the access method, almost certainly more intercepts from this source in Singapore have been captured.

https://x.com/Dr_Machinavelli/status/1765391198565388721?s=20

Here's an very good, more technical breakdown of the SS7 intercept scenario, which indeed seems to be the most likely here.

https://x.com/mcdaidc/status/1765414543419658467?s=20

One more thing on the Taurus leak: again, as so often, a major blunder on the part of Russian intelligence to publish the call's opening sequence that allows us narrow down the options. Reminds me of GRU posting their Podesta phishing email to Wikileaks along with the entire haul