NSA likely culprit in "sophisticated attack": SIM firm

Chip producer Gemalto have reasonable grounds to believe that the company was victim to "sophisticated attacks" by the British Government Communications Headquarters (GCHQ) and the American National Security Agency (NSA) in 2010 and 2011. This is based on the results of an investigation into these reported hackings, which Gemalto announced in a press release today. During the investigation the company detected two sophisticated intrusions that could be related to the NSA and GCHQ operation. In June 2010 there was suspicious activity in one of Gemalto's French sites. A third party was trying to spy on the office network, the network used by employees to communicate with one another and the outside world. Gemalto immediately took action to counter the threat. In July 2010 fake emails were sent to one of the company's mobile operator customers, which contained a attachment which downloaded malicious code. The customer was informed and the relevant authorities notified. There were also several attempts to access the computers of Gemalto employees who regularly had contact with customers. Gemalto emphasizes that the attacks only breached the office networks. This means that a massive theft of SIM encryption keys could not have been stolen as the encryption keys and other general customer data are not stored in these networks. If the secret services managed to steal any encryption keys, the would only have been able to spy on second generation 2G mobile networks - 3G and 4G networks have additional encryption that make them invulnerable to this type of attack. The 2G SIM cards in service at the time of the attacks were also mostly prepaid SIM cards with a short life cycle of between 3 and 6 months. None of Gemalto's other products, such as bank cards and passports, were affected by these attacks.