Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.
According to German authorities, the “data leak” was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.
The exact mode of dial-in is “still being clarified”, Germany has said.
“I think that’s a good lesson for everybody: never use hotel internet if you want to do a secure call,” Germany’s ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.
Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.
Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption “if you use the app itself”.
But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it’s now supposed, were ready to pounce.
Should have used jitsi… It’s free too!
an especially secure, certified version
Bwahahahahahhahahahhahahhaa
This doesnt add up… If the software was properly encrypted they shouldn’t have been able to carry out a man in the middle attack right?
yes, one side has to automatically or manually accept a fake certificate/key to MITM end to end encryption. you know, like when your browser says “certificate error” and you click on advanced->accept anyway or something like that. if the software always accepts or he manually accepted one, the MITM guy can substitute his own encryption key/cert and decrypt and re-encrypt on the fly.
In this case shit software. For a secure conference software there should be no possibility for the user to accept invalid certificates.
The developer always has to plan with what we call a DAU in germany (Dümmster anzunehmender User = dumbest user possible), and even that user should have no possibility to accidentally share a secure conference. So as a developer I would: Lock the user to certificates and encryption keys I deem secure and hook into the low level OS functions to grab the screen and disable them to prevent accidental sharing via software like Anydesk and the like which the user forgot to close. This would even interrupt the functions of a simple trojan on the PC.
Of course a dedicated attacker with physical or admin access to the device could always break these. But then you have another big security breach.
If you’re looking at who is allowed to issue trusted root certificates in common browsers and operating systems, nobody needs to accept nothing to have every possible man in the middle from every major country’s intelligence services already in there.
But that also depends on the issuer that WebEx used. If this really was a MITM without someone fucking up and bypassing a warning, whoever the root CA is issuing for WebEx can no longer be trusted.
More likely they dialed in via mobile rather than use “Computer Audio” and that is easily defeated using a Stingray-type device.
Maybe he dialed in by telephone? It would be a complete boomer move, but I’ve seen people do it.
A researcher in cryptography in Berlin, Henning Seidler, believes the most likely theory is that the officer dialled in via his mobile phone and the call was picked up by spies’ antenna who can also “forward” the traffic onto the main, official antenna.
Seems like the more likely theory
Bad article
Isn’t like very basic security advice to not use random connections for sensitive information? But than again it’s Germany, pretty sure he has his password written down on a sticky note.
