Malware
malware:vodafone_greece_wiretapping_malware
Also: rogue program, rogue software, wiretapping virus
Unnamed rogue executable software installed on Vodafone Greece AXE exchanges to covertly activate wiretapping and conceal its activity.
Unnamed rogue executable software installed on Vodafone Greece AXE exchanges to covertly activate wiretapping and conceal its activity.
“Ericsson came to the conclusion this is malware”
“This rogue program that was on this telecom switch”
“This malware was really stealthy”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Ericsson | Explicit | 64 |
| outgoing | USES | Remote-control equipment subsystem | Explicit | 64 |
| outgoing | USES | shadow phones | Explicit | 64 |
| outgoing | USES | covert backdoor | Explicit | 64 |
| outgoing | USES | log tampering | Explicit | 64 |
| incoming | INVOLVES | Vodafone Greece wiretapping affair | Explicit | 64 |
| incoming | USES | National Security Agency | Attributed | 64 |
Vodafone Greece wiretapping affair INVOLVES Vodafone Greece wiretapping malware
The affair involved deeply embedded rogue software that Ericsson identified as malware.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Ericsson came to the conclusion this is malware, deeply imbedded, sophisticated rogue software”
Vodafone Greece wiretapping malware DISCOVERED_BY Ericsson
Ericsson discovered the unusual executable files and determined that they constituted malware.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Ericsson had some big news for Vodafone Greece. They’d been digging around on these devices”
“Ericsson came to the conclusion this is malware”
Vodafone Greece wiretapping malware USES Remote-control equipment subsystem
The malware secretly activated and used Ericsson’s RES subsystem to conduct wiretaps.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“the malware was using Ericsson’s own lawful intercept technology installed on Vodafone Greece’s systems to carry out the wiretaps.”
Vodafone Greece wiretapping malware USES shadow phones
The malware sent intercepted-call metadata and audio through shadow phones rather than directly to a law-enforcement interface.
Explicit Confidence 98% · Jack Rhysider EP 64 Details
“the data was sent to shadow cell phones instead”
Vodafone Greece wiretapping malware USES covert backdoor
The malware included a back door that enabled later access and changes to the exchange switches.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“They included a back door so they could always get back in and make changes or updates.”
Vodafone Greece wiretapping malware USES log tampering
The malware could shut down transaction logs and silence alarms, hiding the wiretapping activity.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“It shut down the exchange’s transaction logs and silenced any alarms”
National Security Agency USES Vodafone Greece wiretapping malware
In James Bamford’s account, the NSA operation involved obtaining malware, placing it in Vodafone, and exfiltrating intercepted communications; the attribution is not officially established in the episode.
Attributed Confidence 84% · James Bamford EP 64 Details
“you’ve got the agreement of the government, you’ve got the inside person, you’ve got the malware”
“then you exfiltrate the intercepting communications to these untraceable cell phones and then that puts it into NSA.”