{"id":74591,"date":"2016-06-06T12:00:05","date_gmt":"2016-06-06T11:00:05","guid":{"rendered":"https:\/\/www.transcend.org\/tms\/?p=74591"},"modified":"2016-06-04T16:26:42","modified_gmt":"2016-06-04T15:26:42","slug":"for-us-20m-these-israeli-hackers-will-spy-on-any-phone-on-the-planet","status":"publish","type":"post","link":"https:\/\/www.transcend.org\/tms\/2016\/06\/for-us-20m-these-israeli-hackers-will-spy-on-any-phone-on-the-planet\/","title":{"rendered":"For US$ 20M, These Israeli Hackers Will Spy on Any Phone on the Planet"},"content":{"rendered":"

\"Thomas-Fox-Brewster_avatar_1421266835-400x400\"<\/a>31 May 2016 – <\/em>With just a few million dollars and a phone number, you can snoop on any call or text that phone makes \u2013 no matter where you are or where the device is located.<\/p>\n

That\u2019s the bold claim of Israel\u2019s Ability Inc, which offers its set of bleeding-edge spy tools to governments the world over. And it\u2019s plotting to flog\u00a0its kit to\u00a0American cops in the coming months.<\/p>\n

Unlimited spying<\/strong><\/p>\n

Ability\u2019s most startling product, from both technical and price perspectives, is the Unlimited Interception System (ULIN). Launched in November last year, it can cost as much as $20 million, depending on how many targets the customer wants to surveil. All a ULIN customer requires is the target\u2019s phone number or the IMSI<\/a> (International Mobile Subscriber Identity), the unique identifier for an individual mobile device. Got those? Then boom \u2013 you can spy on a target\u2019s location, calls and texts.<\/p>\n

This capability is far more advanced than that of IMSI-catchers (widely known as StingRays), currently used by police departments in the United States<\/a>. IMSI-catchers can help acquire a target\u2019s IMSI number<\/a>, as well as snoop on mobiles, but only if the target is within range.<\/p>\n

ULIN has no such geographic limitation. A quarterly update document posted only on May 2<\/a>, spells out the tech\u2019s power: \u201cULIN enables interception of voice calls, SMS messages and call-related information of GSM\/UMTS\/LTE phones, without the need to be close to the intercepted phone and without the consent of mobile network operators [emphasis by FORBES] <\/strong>and requires only the mobile device\u2019s phone number or IMSI. Customers can use ULIN to intercept calls, and gather other information, from anywhere in the world.\u201d<\/p>\n

\"Anatoly<\/a>

Anatoly Hurgin, CEO and co-founder of Ability, provider of cutting-edge surveillance technology. He gave FORBES a rare interview about a tool that exploits weaknesses in global telecoms infrastructure. Image from Anatoly Hurgin\u2019s Google+ account.<\/p><\/div>\n

Ability\u2019s service \u2013 it is the sole licensee from an unknown third party \u2013 exploits a weakness resident in SS7<\/a>, the Signalling System No. 7. A core part of the world\u2019s shared networking infrastructure, SS7 helps route calls between different carriers and switching centers. Service providers often use SS7 to support communications in areas where the customer\u2019s normal network isn\u2019t available, such as when the user is abroad. For instance, when a Verizon user is holidaying in Spain, local carriers will use SS7 to \u201cspeak\u201d with the customer\u2019s operator to determine who provides its service.<\/p>\n

Hackers, however, use weaknesses in the SS7 network for a number of nefarious purposes. For instance, to forward calls heading to voicemail to their own devices. They can do this because wireless networks do not have the necessary safeguards to block these attacks. Concerns around\u00a0SS7 have led House Democrat Ted Lieu to demand a Congressional investigation and the Federal Communications Commission has launched its own probe<\/a>.<\/p>\n

Previously, government contractors selling SS7 exploitation tools had to work with wireless service providers to access the \u00a0SS7 network. These tools, according to a Washington Post<\/a> report in 2014, were only able to detect users\u2019 locations, not intercept communication. Ability, however, can do much more.<\/p>\n

According \u00a0to documents seen by FORBES, one of which was leaked by an anonymous source (published below and on Document Cloud<\/a>), Ability\u2019s ULIN service allows it to locate targets and snoop on calls and texts \u2013 without any assistance from the cellular networks. According to whitehat hacker Drew Porter from security consultancy Red Mesa<\/a>, this is technically feasible, and could be done in\u00a0two ways: by hacking the SS7 network or by leasing a system from a carrier that has the ability to \u201ctalk\u201d to large parts of the network.<\/p>\n

Porter noted the first option is \u201cpreferred because you really don\u2019t need any carrier cooperation.\u201d The second would require some kind of contract, which would be \u201cless ideal,\u201d he added, as it may allow interested parties to trace the interception back to the true spy or surveillance vendor. Ability could also have built its own infrastructure that can send messages across\u00a0the network.<\/p>\n

Regardless of how Ability is able to spy on mobiles over SS7, it has its hands on a powerful product. Direct hacks on mobile devices typically require the use of malware and exploitation of software vulnerabilities \u2013 themselves a costly commodity<\/a> \u2013 and run the risk of detection. Accessing a mobile device through SS7, however, can provide access to much of the same information with little danger of detection by the \u00a0target.<\/p>\n

\u201cHaving access to SS7 is really a golden key of surveillance, I\u2019m not surprised [Ability] capitalized on it,\u201d said Claudio Guarnieri, a security and human rights advocate who this week helped launch a map of attacks on journalists and activists<\/a>, as well as the surveillance vendors facilitating global spying. He plans to add Ability to the map this week.<\/p>\n

Karsten Nohl, a German whitehat hacker from Security Research Labs who has frequently highlighted security shortcomings in SS7, said the intercept capabilities that SS7 provides \u201care probably the most powerful currently available.\u201d<\/p>\n

For privacy activists, this is a real concern. \u201cOur devices, services and national and international communications infrastructure should be safe and not betray us in this manner,\u201d said Privacy International technologist Dr. Richard Tynan. \u201cThis is particularly concerning as most countries\u2019 laws discriminate against foreigners and provide a lower standard of protection when it comes to surveillance. Any country that purchases or makes surveillance equipment must be aware that their citizens are also vulnerable to the very same kit used by someone else; yet they seem to choose their offensive capabilities over our safety time and time again without any apparent mandate from the public for doing so.\u201d<\/p>\n

SS7 exploit services have created \u00a0anxieties around a lack of oversight over their use. Until last year, cops in the United States used Stingrays without warrants. Following complaints from civil rights bodies, the Department of Justice mandated warrants<\/a>, but the invasive tool had already been deployed\u00a0and the damage done.<\/p>\n

The same could happen with tools like ULIN, warned\u00a0Nathan Wessler, staff attorney at the American Civil Liberties Union. \u201cThis system means that law enforcement will have the ability to conduct wiretaps and location tracking without anybody scrutinising what they\u2019re doing, and nobody may have the opportunity to push back and demand appropriate legal process,\u201d Wessler told FORBES.<\/p>\n

While U.S. law enforcement officers are able to get phone records from carriers with the right warrant, the Ability service means they don\u2019t need to get such permission, he added. \u201cThere is a significance to cutting the phone companies out of that transaction, because it makes it trivially easy to totally bypass the legal protections that are required under the U.S. Constitution and federal law.\u201d<\/p>\n

\"Ability<\/a>

Ability Unlimited Interception System logo, from the company manual.<\/p><\/div>\n

Meet the CEO<\/strong><\/p>\n

American cops may soon be paying big bucks for Ability\u2019s tech. The Israeli company is planning a significant expansion in America this year and is currently looking for a partner to help it sell to U.S. law enforcement, says Ability\u2019s CEO, Anatoly Hurgin, who I spoke with as he was driving to his office in Tel Aviv on Thursday morning and later that afternoon from his company HQ.<\/p>\n

\u201cYou cannot just ignore such a huge market. It\u2019s about half of the world market for our kind of technology,\u201d he said. An SEC filing<\/a> detailing Ability\u2019s merger with Cambridge Capital Acquisition Corporation, which helped the Israeli company go public, indicates the market is indeed blowing up; the U.S. lawful intercept industry worth $3.8 billion in 2015 is expected to hit $6.3 billion in 2020. That same document valued Ability at $225 million, though it\u2019s current market cap is down at $71.1M.<\/p>\n

Hurgin\u2019s tools may allow for easy snooping on others, but he told me\u00a0he cares about his own privacy. There\u2019s very little public information about him. His LinkedIn profile reveals nothing beyond his position at Ability. His Google+ and Skype avatars show a thin man, grey hair, sunglasses. Hurgin says he started Ability with its equally enigmatic Russian co-founder Alexander Aurovsky after a long stint in the Israeli Defense Forces, but he won\u2019t tell me what division. He says it wasn\u2019t the noted Unit 8200<\/a> or Shin Bet. \u201cI started as an electronic engineer,\u201d is all he says.<\/p>\n

Though predictably guarded, he did let slip some more details about ULIN. He says the tool can sell for anywhere between $5 million and $20 million, as confirmed in the quarterly update. The price depends on where a suspect is based and how many targets a customer wants to snoop on. Those targets can be based anywhere in the world, he says, indicating widespread access to the SS7 network.\u00a0He declined to tell me how the firm accesses the SS7 network without going through operators, only noting Ability uses \u201cevery possible way.\u201d<\/p>\n

\u201cULIN, being combined with other cyber solutions, will open a new era in data interception. What you can do today with Wi-Fi interception systems from distance less than 100m, you will be able to do without distance limitation at all,\u201d he added\u00a0over a Skype message sent after our conversation.<\/p>\n

Despite the bold claims, Ability\u2019s tool may not be as \u201cunlimited\u201d as advertised. Kohl notes that some operators have already deployed firewalls that prevent SS7 attacks. Many more will do so this year, he claimed, noting he is helping a handful of unnamed operators set up those firewalls. \u201cSS7 firewalls block messages types that are clearly abusive and also some other possibly abusive messages from strange senders. A few firewall rules go a long way to solve 90 per cent of the SS7 security issue.\u201d<\/p>\n

Is Hurgin concerned about his pricey product becoming obsolete? \u201cThis concern does exist. But talking about [fixing the networks] and doing something are different things.\u201d<\/p>\n

And while $20 million might seem like a high price, Porter believes it\u2019s more than reasonable. \u201cI have not seen a system with a more polished user interface as theirs,\u201d he added, after reviewing\u00a0the ULIN manual obtained by FORBES. \u201cAt $20 million, to locate and intercept almost anyone\u2019s cell phone seems like good deal to me.\u201d<\/p>\n

\"The<\/a>

The user interface of Ability\u2019s ULIN spy technology.<\/p><\/div>\n

Ability shares tank<\/strong><\/p>\n

Thanks to all that expensive surveillance gadgetry, Hurgin\u2019s company, founded in 1994, has posted some positive financials. This month, it claimed revenue growth of 143 per cent from 2014 to 2015, with overall revenue hitting $52.2 million. Overall net income was $14.8 million, compared to $3.1 million in 2014. It benefited from a $6.1 million deal with an unnamed intelligence agency in Asia made sometime in 2015. Other recent customers include a prison authority in Latin America and an intelligence agency in a Nato member country.<\/p>\n

But this month, the company suddenly found itself under threat of legal action from its own investors. Having started trading publicly on the Nasdaq in December, Ability had a steady start, but in May shares started tanking. Though Hurgin put a positive spin on profits, they masked a glaring issue: Ability had been compelled to restate its results for 2015, 2014, 2013 and 2012 as it had failed to report money owed to an unnamed third-party vendor across two of those years and had improperly reported allocation and timing of revenue.<\/p>\n

On May 2, the day it announced those errors, the price of Ability\u2019s common stock fell 33 per cent to close at $4.90 per share. It continued to fall through the month, hitting a low of $2.70 on May 24.<\/p>\n

As a result of the aberrations, two law firms last week opened<\/a> class action lawsuits<\/a> on behalf of investors, alleging Ability had violated the Securities Exchange Act by overstating its income and had weak\u00a0internal controls for its\u00a0financial reporting. Ability has brought in a contractor to bolster those controls.<\/p>\n

Hurgin isn\u2019t exactly concerned. \u201cNot at all. What really matters is business itself. Results, numbers, sales, orders, revenue, income,\u201d he said. \u201c[Lawsuits come] automatically to any company after the restatement. Never mind.\u201d<\/p>\n

Scary new Ability?<\/strong><\/p>\n

How better to get the company back on track than with even more powerful spy kit? Further updates to the Ability\u2019s product will allow cops and intel agents to harvest multimedia texts, according to the ULIN manual. That document indicates ULIN already allows for live wiretapping and the ability to listen to calls in real-time through a web browser. The tool can even grab the location of whoever the target is interacting with.<\/p>\n

\u201cThe agent can ask the system to get the location of the other party involved in the call or SMS,\u201d the document read. \u201cAll the intercepted calls and SMSs can be located on a map displayed to the agents who can access that information.\u201d<\/p>\n

\"Ability\u2019s<\/a>

Ability\u2019s ULIN surveillance tool can map targets for intel agents and cops, with a simple user interface.<\/p><\/div>\n

By September, Hurgin believes ULIN will be able to intercept internet traffic, including web and app use. He can\u2019t promise, however, it will be able to hoover up encrypted data.<\/p>\n

ULIN is a young product, and may not be in wide use. According to May\u2019s results document, Ability has sold only one ULIN product at the low end of its price scale, but has \u201creceived inquiries from a number of existing and potential customers.\u201d It will treat that first customer, who will not be doing cross-border exploitation but focusing on targets within their own country, as a beta test. Hurgin tells me the firm has customers in Europe, Asia and Latin America. Did that include the UK? \u201cLet\u2019s say we\u2019re in touch.\u201d<\/p>\n

Israeli\u00a0surveillance world domination<\/strong><\/p>\n

Israeli surveillance companies, most built by alumni of the country\u2019s various intelligence agencies, make up a huge chunk of the so-called \u201clawful interception\u201d market. Often they work in partnerships to provide even more powerful surveillance systems. Leaks from Italian police-grade spyware dealer Hacking Team, now available on Wikileaks<\/a>, revealed a host of Israeli companies looking for police-grade malware partners, including Ability<\/a>, Nice Systems<\/a>, now the owner of Elbit Systems\u2019 cyber division<\/a>, and Verint<\/a>\u00a0(previously linked with American surveillance operations<\/a>). Network surveillance vendors like those four typically locate and offer a path into a person\u2019s mobile, whilst Hacking Team and its competitors create the malware that provides complete, permanent, remote access to the device, including those critical encrypted communications.<\/p>\n

One of HackingTeam\u2019s more significant rivals, a highly-secretive Israeli company called NSO, is a partner of Ability, said Hurgin. He revealed NSO, and other unnamed government spyware creators, ride on Ability\u2019s network exploits (though not via\u00a0SS7) to deliver their spyware onto devices. NSO co-founder Omri Lavie has repeatedly declined interviews with me over the last year. His business is believed to have spyware that can work on iPhones and Androids, amongst other phones. \u201cI think it\u2019s one of the best companies in this field,\u201d Hurgin said.<\/p>\n

Ability isn\u2019t the only company to target SS7 so aggressively. Indeed, Ability didn\u2019t actually design the ULIN product, nor does it own the technology, but licenses it from an unnamed third-party. The company is investing research and development for the system, and is the only one deploying the tool on its own infrastructure, but it has relied on another firm for the core system. That other firm is only described in SEC filings as \u201ca newly established corporation with a short operating history and is still unknown in the industry.\u201d<\/p>\n

And last year, it was revealed<\/a> that Circles Bulgaria and two other Israeli companies, Rayzone and CleverSig, were selling SS7 exploit packages, though there was little detail on what exactly they offered or for how much.<\/p>\n

It\u2019s clear, though, that at least one company is happy to expose the security of the telecoms backbone for significant profit. And the surveillance is only getting more invasive. As with any technology, where one crosses the Rubicon, others will follow, regardless of the potential degradation of people\u2019s privacy.<\/p>\n

Hurgin, meanwhile, says governments need the technology to counter the rising threat of terrorism. \u201cIt is a war.\u201d<\/p>\n

ULIN Product Description \u2013 Ability<\/a> by Thomas Fox-Brewster<\/a><\/p>\n

______________________________________<\/p>\n

Thomas Fox-Brewster<\/em> – I cover crime, privacy and security in digital and physical forms. <\/em><\/p>\n

Go to Original \u2013 forbes.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

31 May 2016 – With just a few million dollars and a phone number, you can snoop on any call or text that phone makes \u2013 no matter where you are or where the device is located. That\u2019s the bold claim of Israel\u2019s Ability Inc, which offers its set of bleeding-edge spy tools to governments the world over. And it\u2019s plotting to flog its kit to American cops in the coming months.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[60],"tags":[],"class_list":["post-74591","post","type-post","status-publish","format-standard","hentry","category-whistleblowing-surveillance"],"_links":{"self":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts\/74591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/comments?post=74591"}],"version-history":[{"count":0,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts\/74591\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/media?parent=74591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/categories?post=74591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/tags?post=74591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}