Hackers use Congressman’s iPhone to demo ability to listen into calls, monitor texts, track location

9 to 5 Mac ^ | April 18, 2016 | By Ben Lovejoy

[Swordmaker]

CBS correspondent Sharyn Alfonsi, left, with hacker Karsten Nohl

Update: Rep. Ted Lieu has now written to the Chairman of the House Committee on Oversight and Government Reform requesting a formal investigation into the vulnerability. In his letter, the Congressman says that the flaw threatens ‘personal privacy, economic competitiveness and U.S. national security.’ The full text of his letter can be found at the bottom of the piece.

Apple may take iOS security so seriously that it’s willing to do battle with the FBI over it, but German hackers have demonstrated that all phones – even iPhones – are susceptible to a mobile network vulnerability that requires nothing more than knowing your phone number. Armed with just that, hackers can listen to your calls, read your texts and track your position.

60 Minutes invited the hackers to prove their claims by giving a brand new iPhone to Congressman Ted Lieu – who agreed to participate in the test – and telling the hackers nothing more than the phone number. The hackers later replayed recordings they’d made of calls made on that iPhone …

Rep. Ted Lieu said that he was shocked by what the hackers had been able to achieve.

Last year, the president of the United States called me on my cellphone. And we discussed some issues. So if the hackers were listening in, they would know that phone conversation [and the President’s mobile number]. And that’s immensely troubling.

Nohl said that the SS7 vulnerability was well-known in some quarters, and that there was a reason it hasn’t yet been fixed.

The ability to intercept cellphone calls through the SS7 network is an open secret among the world’s intelligence agencies — -including ours — and they don’t necessarily want that hole plugged.

Lieu said that this was totally unacceptable.

The people who knew about this flaw and saying that should be fired. You cannot have 300-some million Americans – and really, right, the global citizenry – be at risk of having their phone conversations intercepted with a known flaw, simply because some intelligence agencies might get some data. That is not acceptable.

While the court battle between Apple and the FBI is over, they will again face off in Congress tomorrow. Apple general counsel Bruce Sewell and FBI executive assistant director Amy Hess will testify on separate panels before House Energy and Commerce subcommittee. Separately, two members of the Senate Intelligence Committee have proposed a bill to force tech companies to decrypt devices for law enforcement, though one Senator has vowed to block the legislation with a filibuster.

[DBrow]

I agree but let’s control all the variables to make a good experiment. What if they tweaked a phone to enable certain things that a COTS phone would not have enabled?

And let’s see more than one phone.

I run experiments all the time (pays the rent) and this is the sort of thing a peer reviewer would catch right off the bat.

[Swordmaker]

And let’s see more than one phone.

I run experiments all the time (pays the rent) and this is the sort of thing a peer reviewer would catch right off the bat.

Usually, when you see Apple in the headlines, it's because it will garner more headline views and clicks. No one clicks on a headline that says "Hackers use Congressman’s Android phone to demo ability to listen into calls, monitor texts, track location". Just as no one would click on a headline that says "Hackers use Congressman’s Windows PC to demo their ability to install malware." It's sort of an expected thing, a "Dog bites Man" headline.