1/12
It has been confirmed that the #Taurus interception was done via “a non-secure line”. Below is my opinion of one way in which it *might* have been done, taking into account the situation and #Russia's previous history.
Essentially it involves using #SS7 interception.
🧵
2/12
First step is that we assume the call intercepted was generated by a German mobile device, roaming into Singapore. In the press release we are not told for certain it was a mobile. So could have been a mobile or a hotel line (or wifi)
1/11
Today, we’re releasing details of a small but interesting mobile #vulnerability called MMS Fingerprint, reportedly used by #NSOGroup.
How this might work, and how we found it, is a bit unusual.
@EneaAB @josephfcox @rj_gallagher @campuscodi @lorenzofbenea.com/insights/dusti…
2/11
After a WhatsApp vulnerability exploited in 2019 #WhatsApp/#Facebook sued NSO Group. As part of its evidence there was a contract between a NSO Group reseller and a telecom regulator.
Within that contract was a list of features, including something called #MMSFingerprint
@RowlandCorr and I cover what may happen in the future. In particular we look at the little-known Russian separatist Mobile Operators Phoenix (Фенікс) and Lugacom (Лугаком)
blog.adaptivemobile.com/the-mobile-net…
2/10
The unlicensed Phoenix (Фенікс) & Lugacom (Лугаком) opcos were formed from the separatist seizure of Ukrainian Mobile Operator equipment after 2014 invasion of the #Donbas
They have been growing as the licensed Ukrainian Operators have pulled out
🧵A good recent example of #Ukraine contesting the Mobile Network / InfoSec battlespace.
Multiple #SIMBox seizures as part of an "enemy bot farm" network were announced yesterday by the Security Service of Ukraine. 1/6 ssu.gov.ua/novyny/z-pocha…
Technically this is a much bigger setup that the #SIMBox relay discovery from 2 weeks ago, (see my previous thread) which is not surprising as these are more traditional ‘bot farms’ used for signups for social media 2/6
1/5 Another significant capture in #Ukraine. Reported discovery today of a #SIMBox being used to relay Voice calls & SMS and other info to Russian forces (including top leadership of Russian army) & other individuals in #Ukraine. I will explain what this is and how it works.
2/5
First the system is comprised of 3 main parts, 1) the SIM Box server - in this case a Hypertone SMB-128 . This handles the control of up to 128 SIM Cards, cycles them when detected etc , and co-ordinates interaction with the #GSM Gateways hybertone.com/en/pro_detail.…
