Investigation uncovers two sophisticated telecom surveillance campaigns

Security researchers have uncovered two separate spying campaigns that are abusing well-known weaknesses in the global telecoms infrastructure to track people’s locations. The researchers say these two campaigns are likely a small snapshot of what they believe to be widespread exploitation of surveillance vendors seeking access to global phone networks.

On Thursday, the Citizen Lab, a digital rights organization with more than a decade of experience exposing surveillance abuses, published a new report detailing the two newly identified campaigns. The surveillance vendors behind them, which Citizen Lab did not name, operated as “ghost” companies that pretended to be legitimate cellular providers, and would piggyback their access to those networks to look up the location data of their targets.

The new findings reveal continued exploitation of known flaws in the technologies that underpin the global phone networks.

One of them is the insecurity of Signaling System 7, or SS7, a set of protocols for 2G and 3G networks that for years has been the backbone of how cellular networks connect to each other and route subscribers’ calls and text messages around the world. Researchers and experts have long warned that governments and surveillance tech makers can exploit vulnerabilities in SS7 to geolocate individuals’ cell phones, as SS7 does not require authentication nor encryption, leaving the door open for rogue operators to abuse it.

The newer protocol, Diameter, designed for newer 4G and 5G communications, is supposed to replace SS7 and includes the lacking security features of its predecessor. But as the Citizen Lab highlights in this report, there are still ways to exploit Diameter, as cell providers do not always implement the new protections. In some cases, attackers can still fall back to exploiting the older SS7 protocol.

The two spy campaigns have at least one thing in common: Both abused access to three specific telecom providers that repeatedly acted “as the surveillance entry and transit points within the telecommunications ecosystem.” This access gave the surveillance vendors and their government customers behind the campaigns the ability to “hide behind their infrastructure,” as the researchers explained.

According to the report, the first one is Israeli operator 019Mobile, which researchers said was used in several surveillance attempts. British provider Tango Networks U.K. was also used for surveillance activity over several years, the researchers say. The third cellphone provider, Airtel Jersey, an operator on the Channel Island of Jersey now owned by Sure, a company whose networks have been linked to prior surveillance campaigns.

Sure CEO Alistair Beak told TechCrunch that the company “does not lease access to signalling directly or knowingly to organisations for the purposes of locating or tracking individuals, or for intercepting communications content.”

019Mobile and Tango Networks did not respond to TechCrunch’s request for comment. Gil Nagar, the head of IT and security and 019Mobile sent a letter to Citizen Lab. Nagar said that the company “cannot confirm” that the alleged 019Mobile infrastructure, identified by Citizen Lab as being used by the surveillance vendors, belongs to the company.

According to the Citizen Lab, the first surveillance vendor facilitated spying campaigns spanning several years against different targets all over the world, and using the infrastructure of several different cellphone providers. “The evidence shows a deliberate and well-funded operation with deep integration into the mobile signaling ecosystem,” the researchers wrote.

Gary Miller, one of the researchers who investigated these attacks, told TechCrunch that some clues point to an “Israeli-based commercial geo-intelligence provider with specialized telecom capabilities,” but did not name the surveillance provider.

The second spy campaign used different methods. In this case, the other surveillance vendor behind it relied on sending a special type of SMS message to one specific “high-profile” target. These are text-based messages designed to communicate directly with the target’s SIM card, without showing any trace of them to the user. The surveillance vendor instead sent commands that essentially turned the target’s phone into a location tracking device. This type of attack was dubbed SIMjacker by mobile cybersecurity company Enea in 2019.

“I’ve observed thousands of these attacks through the years, so I would say it’s a fairly common exploit that’s difficult to detect,” said Miller. Miller made it clear that these two campaigns are just the tip of the iceberg. “We only focused on two surveillance campaigns in a universe of millions of attacks across the globe,” he said.