SIM Database Hack Gave U.S. and British Spies Access to Billions of Phones

As reported by Reuters: U.S. and British spies hacked into the world's biggest maker of phone SIM cards, allowing them to potentially monitor the calls, texts and emails of billions of mobile users around the world, an investigative news website reported.

The alleged hack on Gemalto, if confirmed, would expand the scope of known mass surveillance methods available to U.S. and British spy agencies to include not just email and web traffic, as previously revealed, but also mobile communications.

The Franco-Dutch company said on Friday it was investigating whether the U.S. National Security Agency (NSA) and Britain's GCHQ had hacked into its systems to steal encryption keys that could unlock the security settings on billions of mobile phones.

The report by The Intercept site, which cites documents provided by former NSA contractor Edward Snowden, could prove an embarrassment for the U.S. and British governments. It opens a fresh front in the dispute between civil liberties campaigners and intelligence services which say their citizens face a grave threat of attack from militant groups like Islamic State.

It comes just weeks after a British tribunal ruled that GCHQ had acted unlawfully in accessing data on millions of people in Britain that had been collected by the NSA.

A spokesman for GCHQ (Government Communication Headquarters) said on Friday that it did not comment on intelligence matters. The NSA could not be immediately reached for comment.
The Intercept report (bit.ly/19E0KUK) said the hack was detailed in a secret 2010 GCHQ document and allowed the NSA and GCHQ to monitor a large portion of voice and data mobile communications around the world without permission from governments, telecom companies or users.

"We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such sophisticated techniques," said Gemalto, whose shares sunk by as much as 10 percent in early trading on Friday, following the report.
The report follows revelations from Snowden in 2013 of the NSA's Prism programme which allowed the agency to access email and web data handled by the world's largest Internet companies, including Google, Yahoo and Facebook.


SURVEILLANCE
The new allegations could boost efforts by major technology firms such as Apple Inc and Google to make strong encryption methods standard in communications devices they sell, moves attacked by some politicians and security officials.

Leaders including U.S. President Barack Obama and British Prime Minister David Cameron have expressed concern that turning such encryption into a mass-market feature could prevent governments from tracking militants planning attacks.

Gemalto makes SIM (Subscriber Identity Module) cards for phones and tablets as well as "chip and pin" bank cards and biometric passports. It produces around 2 billion SIM cards a year and counts Verizon, AT&T Inc and Vodafone among hundreds of wireless network provider customers.

The GCHQ spybase in the UK.

The Intercept, published by First Look Media, was founded by the journalists who first interviewed Snowden and made headlines around the world with reports on U.S. electronic surveillance programmes.

It published what it said was a secret GCHQ document that said its staff implanted software to monitor Gemalto's entire network, giving them access to SIM card encryption keys. The report suggested this gave GCHQ, with the backing of the NSA, unlimited access to phone communications using Gemalto SIMs.

French bank Mirabaud said in a research report the attacks appeared to be limited to 2010 and 2011 and were aimed only at older 2G phones widely used in emerging markets, rather than modern smartphones. It did not name the source of these assertions.

Some analysts argued that if a highly security-conscious company like Gemalto is vulnerable, then all of its competitors are as well.

Gemalto competes with several European and Chinese SIM card suppliers. A spokesman for one major rival, Giesecke & Devrien of Germany, told Reuters: "We have no signs that something like that happened to us. We always do everything to protect our customers' data."
But while security experts have long believed spy agencies in many countries have the ability to crack the complex mathematical codes used to encrypt most modern communications, such methods remain costly, limiting their usefulness to targeted hijacking of individual communications.

Iowa Wants to Let You Carry Your Drivers License on Your Phone

As reported by Forbes: There’s now a technology to replace almost everything in your wallet. Your cash, credit cards, and loyalty programs are all on their way to becoming obsolete. Money can now be sent via app, text, e-mail – it can even be sent via Snapchat. But you can’t leave your wallet home just yet. That’s because there is one item that remains largely unchanged: your drivers license.

If the Iowa Department of Motor Vehicles has its way, that may no longer be the case. 

According to an article in Des Moines Register, the agency is in the early stages of developing mobile software for just this purpose. The app would store a resident’s personal information, whatever is already on the physical licenses, and also include a scannable bar code. The plans are for the app to include a two-step verification process including some type of biometric or pin code. At this time, it appears that specific implementation details are still being worked out.

The governments of United Kingdom and United Arab Emirates had both previously announced their own attempts to experiment with the concept. It’s becoming increasingly common to see mobile versions of other documents. Over 30 states now allow motorists to show electronic proof of insurance. It only follows that the drivers license would be next. But the considerations around that document are different – it is perhaps the most regulated and important document that a person carries.

At first thought, the idea seems rife with potential security and privacy issues. It is well known at this point that nothing is unhackable; and if a project is made on a government contracting schedule, the likelihood of a breach is only greater. There’s already a contentious legal debate regarding law enforcements’ abilities to search your devices. Everywhere there is growing concern about what else apps, once installed, can be used to collect or carry out in the future.

Questions of security, however, must take into account context – and there, it can be argued that our current regimes of physical documents have been an enormous failure. Having every state choose their own approach for issuing IDs has led to patchwork regulations and glaring weak points in the system that criminals have repeatedly taken advantage of. Drivers licenses today are regularly forged, stolen, and compromised – it’s far from a secure situation.

There have been major advancements in the technologies that are readily available to consumers. New phones now come standard with features like Near Field Communication (for systems like Apple Pay and Google Wallet), and increasingly, biometric scanners (to use your face or thumbprint to unlock your home screen). In combination with existing practices like using end-to-end encryption, smart cards, and PIN codes, a technological solution may be feasible, theoretically. How these systems perform in real world conditions, on this scale, remains to be seen.

Chris Wiesinger, President of Trace Intercept, a consultancy focused on issues related to digital identity, sees the upside to adopting new technologies as far greater than the potential risks. Wiesinger argues that we are “awash in a world of credentials.” It’s become far too much for individuals to properly manage. He explains that with the inclusion of systems like Apple’s Touch ID, there is a unique opportunity to leverage a new security infrastructure, “I believe all the technologies to make this a high-security operation are already in play, and just need to be orchestrated effectively.”

Having viable digital counterparts to the physical documents and cards we use will allow us to lessen the severity of issues like fraud. But Wiesinger believes that the larger issue that needs to be addressed is the way we approach identity as a whole. What he is advocating for is a larger change in empowering individuals to gain agency over what personal information and attributes are shared, and in what context. Digital drivers licenses, as well as all the other credentials, could play an important role in making this ecosystem possible.

In Iowa, the success of their pilot study will likely depend more on issues of policy and execution than technological performance. Current plans allow for digital drivers licenses to be used at airports – it would be wise to restrict security-related use cases till the implementation is much farther along. The state should work with the private sector to start by letting residents use their digital licenses for low-level transactions like verifying age with alcohol and checking into a hotel. It is still too soon to allow a digital license the same authority as the physical one. Although, that day may come down the line.

Some have argued that this discussion will soon become irrelevant because of the amount that is already known about us. When our objects, devices, and institutions know not just who we are, but extremely specific details of our behaviors, the function of a legal identification document becomes unnecessary. It’s true that we are quickly losing our ability to choose when and by whom we are identified.

Despite that, it is unlikely that we will ever see physical documents completely replaced. Throughout history identification documents have been used to signify recognition. A paper document is proof of your existence in the world, it’s an acknowledgement by the government that you have legal rights. There are few forms of control as powerful as the ability to issue or confiscate someone’s identification paperwork. For that reason, don’t expect physical documents to ever go away – their symbolic value will exist long past their day-to-day utility.

Apple Appears to be Building an Apple Car. Is that as Crazy as it Sounds?

As reported by the Vox: We've known since last week that Apple was working on some sort of car-related project. The big question was whether Apple was working on a line of car accessories — perhaps expanding on its existing CarPlay platform — or whether the company was going to start building its own cars.

New reporting from 9to5Mac provides strong evidence that Apple is working on an Apple Car.

Cars are complicated, and building one requires skills that a high-tech company like Apple doesn't normally have. According to 9to5Mac, Apple has been snapping up engineers with expertise in motors, transmissions, drive trains, car interiors, and so forth.

The list includes four people with experience at Ford, four who previously worked at Tesla, a former CEO of Mercedes-Benz, and a General Motors employee. Apple has also hired an engineer from auto-part maker EMCO Gears and multiple engineers from A123 Systems, which makes batteries for hybrid and electric cars (A123 has sued Apple over these hires).

It's unlikely that Apple would hire people like this if it were only working on car accessories. And it wouldn't hire hundreds of people just to work on a pilot project. Granted, Apple CEO Tim Cook could still decide to cancel it if the results aren't up to Apple's standards. But there's a good chance we'll see some kind of Apple Car in the next few years.

Apple is well-positioned to create a new kind of car

Apple may be better positioned to jump into the car business than almost any other Silicon Valley company. Most tech companies focus on one relatively narrow piece of the technology "stack." You've got Intel and AMD making computer chips, Dell and Samsung building devices, Google and Microsoft developing software, and so forth.

Apple is virtually alone in building its own products from top to bottom. An iPhone is based on an Apple-designed chip and runs Apple-designed software. This philosophy makes Apple particularly good at re-inventing product categories, as it did with the iPod, iPhone, and iPad. It can build exactly the right hardware to support its software, and vice versa, creating a seamless user experience.

This kind of tight integration between hardware and software will be particularly important for cars, where reliability and energy-efficiency are major priorities. Apple's work on iPhones, iPads, and MacBooks also means the company has experience with batteries and power management, which are also crucial to building electric cars.

Indeed, this could be a weakness for Google, which has traditionally created software that runs on other peoples devices. Combining Google's self-driving software with a conventional car might produce a less appealing product than having one company design the whole product.

It won't be easy for Apple to catch up to Google on self-driving technology

By the time Apple brings a car to market, partially self-driving cars will be commonplace and fully autonomous vehicles may be right around the corner. To compete with Google, it will have to build its own self-driving technology. And that won't be easy.

Google has a five-year head start creating self-driving cars. It also has a fleet of Street View cars that will allow it to produce detailed 3D maps of the world's streets, which will be essential to helping self-driving cars stay on the road. Apple doesn't have a great track record with maps — Apple has struggled to produce a mapping app that rivals Google Maps.

Google also has a culture that prizes tackling difficult engineering problems — dubbed "moon shots" — like building a self-driving car. In contrast, Apple has traditionally been focused on building beautiful, user-friendly gadgets. When it has tried to expand outside of that core area — as with iCloud and its predecessors — the results have often been disappointing.

On the other hand, building a beautiful, reliable, and energy-efficient electric car would be a major feat in its own right. Even if Apple struggles to catch up on the self-driving front, it could still sell a lot of conventional vehicles before autonomous vehicles become ubiquitous.

NASA Preparing to Reassemble the International Space Station for Space Taxis

As reported by UPI: On Friday, astronauts aboard the International Space Station will initiate the station's first reassembly in several years. The station will be reconfigured to create two new docking ports for the space taxis NASA hopes to have launched by the end of 2017 as part of its Commercial Crew program.

The first of three assembly spacewalks will be conducted on Friday by NASA astronauts Barry Wilmore and Terry Virts. While outside the station, they will begin work installing cables and communications equipment for the two new berthing slips.

Wilmore and Virts won't be able to ready the two new ports without new equipment, however. Two International Docking Adapters are needed to turn what were once parking spots for NASA's Space Shuttles into docks capable of accepting future U.S. commercial crew vehicles. The two adapters will be launched by SpaceX resupply missions later this year.

"This is quite a bit of work," Mike Suffredini, NASA's ISS program manager, told Discovery News. "Our plan has always been to have a docking capability in place and operational by the end of 2015, and we're on track to do that."

NASA is anxious to have its space taxis up and operational. Since the Space Shuttle program ended in 2011, NASA has had to rely on Russia to ferry its astronauts to and from the space station. Last year, NASA awarded major contracts to Boeing and SpaceX to construct space taxis.

The combination of space taxis and reconfigured ports will not only make NASA's ISS missions more autonomous, but also bolster their size and scope.

"They will permit the standard station crew size to grow from six to seven, potentially doubling the amount of time devoted to research aboard the orbiting laboratory," NASA officials said in a recent press release.

Friday's spacewalk will be televised by NASA TV. It will be Wilmore's second career spacewalk and the first for Virts.

The Identity of Things (IDoT) is Necessary for the Internet of Things (IoT)

As reported by Virtualization Review: The Internet of Things (IoT) is a growing area of the increasingly connected universe. Its advantages are many, but with those gains come new challenges. One of the biggest is security, in particular identity management. And because this is the IT world, analyst firm Gartner Inc.  has spawned a new acronym with which to tag this challenge: IDoT -- the Identity of Things.

In the past, Gartner has used another acronym, IAM, to describe what it calls "Identity and Access Management." IAM needs to significantly evolve, reports Gartner, because typical solutions can't scale to IoT size.

"IAM leaders must reconsider how traditional approaches to cybersecurity and IAM work in a world where devices and services are so abundant, in so many different forms and positioned at so many different points within the IT ecosystem," Earl Perkins, research vice president at Gartner, said in a press release. 

   Gartner describes the rationale behind the new acronym:

The Identity of Things (IDoT) is a new extension to identity management that encompasses all entity identities, whatever form those entities take. These identities are then used to define relationships among the entities -- between a device and a human, a device and another device, a device and an application/service, or (as in traditional IAM) a human and an application/service.

New ways must be developed to handle security in the IoT, Gartner says, emphasizing the relationships between devices and objects, and not just their identities. Doing that, Perkins said, "… allows the IDoT to exist and become part of new responsibilities for IAM in the enterprise."

Gartner has previously predicted a huge spike in the IoT in 2015, with a bump of 30 percent in connected devices like automobiles, refrigerators, wearable devices and even coffee makers. This year, Gartner expects there to be about 4.9 billion "things," with a value of $69.5 billion.
The U.S. Federal Trade Commission released its own report earlier this year that addressed IoT security, listing a number of concrete steps companies developing IoT devices should take. 

They include a defense-in-depth strategy using multiple layers of security; monitoring connected devices throughout their expected lifecycle; and building security into devices from the beginning, instead of tacking it on at the end.

Elon Musk is Designing a Tesla Battery to Power Your Home

A Tesla Model S vehicle battery pack.  Designs for the home battery pack have not yet been released.

As reported by Quartz: In all the excitement over the looming battle for supremacy in electric cars between Tesla and Apple, some pretty important comments last week from Elon Musk were largely overlooked.

During Tesla’s quarterly earnings call, Musk said his car company is progressing with plans to sell a lithium-ion battery for energy storage in homes and businesses.

We’re going to unveil the Tesla home battery, or the sort of consumer battery that will be for use in people’s houses or businesses, fairly soon. We have the design done, and it should start going to production, probably in about six months, or so. We’re trying to figure out a date to have the product unveiling, but it’s probably in the next month or two months. And it’s really great; I’m really excited about it.

We’ve known about this for a while, of course. As I wrote last year, Tesla’s batteries could be huge—and possibly a much bigger product than its cars.

In theory, a homeowner could capture energy in a solar panel on their roof (maybe made by Solar City, which Musk chairs) and store it in a Tesla battery. This is key, because at the moment, one of the main problems with solar power is that, as The Verge neatly put it, “the sun isn’t always shining when you need power, and sometimes the sun is shining when you don’t need power.”

There’s a lot of hype about what kind of threat Tesla could pose to electricity utilities by helping people go off the grid. Morgan Stanley estimated last year that by 2028, Tesla’s US fleet of cars will have an energy storage capacity of 237GW which it said was equal to 22% of US production capacity, and nearly 10 times larger than existing US grid storage capacity. (That analysis doesn’t even take into account batteries sold separately from cars).

In reality, mass defections off the electricity grid aren’t likely. Solar City CTO and Musk’s cousin Peter Rive has said he has “no interest” in such a scenario, because “the grid is a network, and where there are networks, there are network effects.” Also, it seems to be illegal in some states.

Tesla is actually working closely with utilities on the home battery product. “There’s a lot of interest, and a lot of utilities working in this space, and we’re talking to almost all of them,” chief technology officer JB Straubel said on the conference call. More likely, the batteries will help people sell excess energy back into the grid, and save money on their electric bills.

Rive envisages a scenario where batteries with storage capacity were optimized across the grid, allowing utilities to direct clean solar electricity more efficiently, lowering costs for everyone and helping the environment. “We can do so much more working together than we can working alone.”

Smartphone Startups Handle Calls With Wi-Fi to Push Service Pricing to $5 per Month

As reported by Slashdot: two companies, Republic Wireless and FreedomPop, that reduce cellphone costs by relying on strategically placed Wi-Fi routers are at the forefront of a tantalizing communications concept that has proved hard to produce on a big scale. 

The concept championed by the two little companies in their nationwide services is surprisingly simple. They offer services that rely primarily on Wi-Fi networks, and in areas without Wi-Fi, customers can pull a signal from regular cell towers. 

"Wi-Fi first is a massive disrupter to the current cost structure of the industry," says Stephen Stokols. "That's going to be a big shock to the carriers." For $5 a month, customers of Republic Wireless can make calls or connect to the Internet solely over Wi-Fi. 

For $10 a month, they can use both Wi-Fi and a cellular connection from Sprint in Republic's most popular option. Republic Wireless's parent company, Bandwidth.com, a telecommunications provider with about 400 employees, developed a technique to move calls seamlessly between different Wi-Fi networks and cell towers. 

"You can't pretend these companies are major players by any stretch. But I think their real importance is proof of concept," says Craig Moffett. "They demonstrate just how disruptive a Wi-Fi-first operator can be, and just how much cost they can take out."

In major cities, the Wi-Fi-first network makes sense. People use smartphones frequently while sitting around their offices and apartments, and Wi-Fi can handle the job just fine. But once people start moving around, it is not so simple. 

The benefit of a cell service is that your phone can switch among multiple towers while you are on the go which wi-fi is not designed to handle. Google may be experimenting with a hybrid approach similar to the small companies'. 

A person briefed on Google's plans, who spoke on the condition of anonymity because the conversations were private, says the company wants to make use of the fiber network it has installed in various cities to create an enormous network of Wi-Fi connections that phones could use to place calls and use apps over the Internet. 

In areas out of reach, Google's network would switch over to cell towers leased by T-Mobile USA and Sprint. Still many wonder if even the biggest companies could make a Wi-Fi-based phone network work. "There are just so many places where Wi-Fi doesn't reach," says Jan Dawson "and the quality of Wi-Fi that you can find is often subpar."