Some of Russia's surveillance tech leaked data for more than a year

guest · Aug 29, 2019

Some of Russia's surveillance tech leaked data for more than a year
Security researcher finds that some of Russia's SORM wiretapping equipment had been leaking user data
August 30, 2019
https://www.zdnet.com/article/some-of-russias-surveillance-tech-leaked-data-for-more-than-a-year/

A Russian security researcher has found that hardware equipment meant to be used by Russian authorities to intercept internet traffic had been leaving data exposed on the internet.
The leaky equipment were SORM devices. These are hardware wiretaps that all Russian internet service providers and mobile telecoms must install in their data centers to comply with local legislation.

When translated from Russian, SORM stands for System for Operative Investigative Activities.
According to the specification's most recent version, SORM-3, SORM devices can log details such as IP addresses, IMEI and IMSI codes, MAC addresses, ICQ usernames, and email addresses spotted in POP3, SMTP or IMAP4 traffic, or in connections to various webmail providers.
30 SORM DEVICES HAVE LEAKED SURVEILLANCE DATA
Evdokimov said he found 30 SORM devices installed on the network of 20 Russian ISPs that were running FTP servers that were not secured with a password.
Click to expand...

mirimir · Aug 31, 2019

Damn, open FTP servers. I guess that they just weren't thinking.

guest · Sep 18, 2019

Another leak:
Documents reveal how Russia taps phone companies for surveillance
A data leak exposes SORM surveillance at Russia's top telco
September 18, 2019
https://techcrunch.com/2019/09/18/russia-sorm-nokia-surveillance/

In cities across Russia, large boxes in locked rooms are directly connected to the networks of some of the country’s largest phone and internet companies.
These unsuspecting boxes, some the size of a washing machine, house equipment that gives the Russian security services access to the calls and messages of millions of citizens.

The documents were found on an unprotected backup drive owned by an employee of Nokia Networks (formerly Nokia Siemens Networks) [...]
Chris Vickery, director of cyber risk research at security firm UpGuard, found the exposed files and reported the security lapse to Nokia. In a report out Wednesday, UpGuard said Nokia secured the exposed drive four days later.

“A current employee connected a USB drive that contained old work documents to his home computer,” said Nokia spokesperson Katja Antila in a statement. “Due to a configuration mistake, his PC and the USB drive connected to it was accessible from the internet without authentication.”
The exposed data — close to 2 terabytes in size — contain mostly internal Nokia files.
But a portion of the documents seen by TechCrunch reveals Nokia’s involvement in providing “lawful intercept” capabilities to phone and internet providers, which Russia mandates by law.
Click to expand...

TechCrunch reviewed the documents, which included several floor plans and network diagrams for the local exchanges. The documents also show that the installed SORM device on each phone network has direct access to the data that passes through each phone exchange, including calls, messages and data.
Click to expand...

UpGuard: Telecommunications Breakdown: How Russian Telco Infrastructure was Exposed

Until recently the files were hosted on a rsync server configured for public accessibility. While documents and data stemming from several major Russian telecommunications providers are present, the primary entities affected by the exposure appear to be Nokia and Mobile TeleSystems.
In addition to the risk posed by any large scale exposure related to telecommunications, the data set also includes photographs and installation instructions for SORM (System for Operative Investigative Activities), the hardware which enables communication interception and review by Russian law enforcement agencies such as the FSB.

This latest security lapse is the second involving SORM in recent months. In August, a developer found thousands of names, numbers, addresses and geolocations said to have leaked from SORM devices.
Click to expand...

mirimir · Sep 18, 2019

Until recently the files were hosted on a rsync server configured for public accessibility.
Click to expand...

Hey, what busy intelligence operative wants to remember passwords and stuff

Log in or Sign up

Some of Russia's surveillance tech leaked data for more than a year

guest Guest

mirimir Registered Member

guest Guest

mirimir Registered Member

Log in or Sign up

Some of Russia's surveillance tech leaked data for more than a year

guest Guest

mirimir Registered Member

guest Guest

mirimir Registered Member

Useful Searches