Comment by jdbernard | Hacker News Reader

Comment by jdbernard | Hacker News Reader

Parent Full thread

I want to chime in to offer the counter. I used to work for Gemalto. I'm not exactly sure which keys you are talking about, but when I was there Gemalto's standard practice for the transfer of the keys mentioned in the article--individual SIM embedded keys--was to use AllynisConnect (which I only mention because it's easily found on Google) to facilitate the transfer of individual SIM keys to the customer. Obviously I'm not going to comment on the details of the cryptography involved, but it was much more considered than "simple encryption methods or no encryption at all."

Notably this mechanism would not protect the keys against an attacker who was inside Gemalto's or the customer's secure network, as seems to be the case here.

I'd be interested in knowing which keys specifically you are talking about.

In many cases you have specific procedures in place for security-conscious MNOs, but some of these procedures are such a pain that you inevitably end up finding workarounds to get the business going, e.g. email or USB tokens between various people who are not supposed to have those keys. Of course security officers and other officials are not aware of this. Dig through any sales mailbox and you will find CSV files (usually called output files) containing Ki encrypted with simple DES. I let you ask around to learn which DES key is most often used. Disclaimer: this is not specific to Gemalto.

Unfortunately that is very possible, and of course I can't speak for other companies. I will say that Gemalto has internal access protection for these and other information.

Of course, there are lots of things I didn't have visibility on and it is possible that I am overly optimistic.

Why does there have to be any key transfer at all? Why are they not generated in a more decentralized manner, at the manufacturer for example? Why are there servers for the NSA to hack where they can exfiltrate the keys in the first place?

Information minimization and avoiding single points of failures could have prevented this.

Because that's how you make money before thinking about security. Centralize and cash in.

My understanding is that the root of the SIM cards are always "owned" by the company sourcing them.

https://allynisconnect1.gemalto.com/jsp/tp_logon.jsp

Great - on the open net. No 2FA visible in the first peek.

Way to fuck your customers customers privacy.

Reply on news.ycombinator.com