First Phone Switch Rootkit Shows Flaws in Telecommunications Systems

IDG News Service (London Bureau) — A highly sophisticated spying operation that tapped into the mobile phones of Greece's prime minister and other top government officials has highlighted weaknesses in telecommunications systems that still use decades-old computer code, according to a report by two computer scientists.

The spying case, where the calls of around 100 people were secretly tapped, remains unsolved and is still being investigated. Also complicating the case is the questionable suicide in March 2005 of a top engineer at Vodafone Group PLC in Greece in charge of network planning.

A look into how the hack was accomplished has revealed an operation of breathtaking depth and success, according to an analysis http://www.spectrum.ieee.org/jul07/5280 on IEEE Spectrum Online, the Web site of the Institute of Electrical and Electronics Engineers Inc.

The case includes the "first known rootkit that has been installed in an [phone] exchange," said Diomidis Spinellis, an associate professor at the Athens University of Economics and Business, who authored the report with Vassilis Prevelakis, an assistant professor of computer science at Drexel University in Philadelphia.

A rootkit is a special program that buries itself deep into an OS for some malicious activity and is extremely difficult to detect. The rootkit enabled a transaction log to be disabled and allow call monitoring on four switches made by Telefonaktiebolaget LM Ericsson within Vodafone's equipment. The software enabled the hackers to monitor phone calls in the same way law enforcement would, minus the required court order. The software allowed for a second, parallel voice stream to be sent to another phone for monitoring.

The intruders covered their tracks by installing patches on the system to route around logging mechanisms that would alert administrators that calls were being monitored. "It took guile and some serious programming chops to manipulate the lawful call-intercept functions in Vodafone's mobile switching centers," the authors wrote.

The secret operation was finally discovered around January 2005 when the hackers tried to update their software and interfered with how text messages were forwarded, which generated an alert. Investigators found hackers had installed 6,500 lines of code, an extremely complex coding feat.

"The size of the code is not something that somebody could hack in a weekend," Spinellis said. "It takes a lot of expertise and time to do that."

The investigation, which included a Greek parliamentary inquiry, netted no suspects, due in part to key data that was lost or destroyed by Vodafone, the authors wrote. It's not known if the hack was an inside job.

Vodafone may have been able to discover the scheme sooner through statistical call analysis that could have linked the calls of those being monitored to calls to phones used to monitor the conversations, they wrote. Carriers already do that sort of analysis, but more for marketing than security.

But the defense against rogue code, viruses and rootkits is complicated due to how telecom infrastructure has developed. "Complex interactions between subsystems and baroque coding styles (some of them remnants of programs written 20 or 30 years ago) confound developers and auditors alike," the report said.