Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.
According to German authorities, the “data leak” was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.
The exact mode of dial-in is “still being clarified”, Germany has said.
“I think that’s a good lesson for everybody: never use hotel internet if you want to do a secure call,” Germany’s ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.
Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.
Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption “if you use the app itself”.
But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it’s now supposed, were ready to pounce.
Yeah blame it on hotel internet, not their shitty communication service that’s not encrypted.
It probably is, but they didn’t disable the feature that allows you to dial in on a phone line for audio. That’s my guess.
“I think that’s a good lesson for everybody: never use hotel internet if you want to do a secure call,” Germany’s ambassador to the UK, Miguel Berger, told the BBC this week.
…
The exact mode of dial-in is “still being clarified”, Germany has said.
OK, well the exact mode kinda fucking matters before you just scapegoat a hotel.
This smells like a coverup.
deleted by creator
Oh no. They’re not referring to a specific hotel. Seriously never use hotel Internet on a sensitive device or for sensitive business. You will regret it.
End to end encryption
USE IT
In a world where I can deploy end to end encrypted comms servers to an old computer in my house, the fucking military of any country should, at a minimum, require encryption to join meetings where military strategy is being discussed.
Yes
The simplest and most straightforward answer is usually the correct one: The hotel room was probably bugged.
an especially secure, certified version
Bwahahahahahhahahahhahahhaa
This is what happens without E2EE.
What an amazing feat of incompetence! They’d be better off just using Signal…
They’d be quantum proof as well 😅 https://signal.org/blog/pqxdh/
They even have their own Matrix Messenger they could have used…
Yeah def this is what they should’ve been using.
I love Signal but military should use their own messenging service (and they do).
Yeah agree, just saying it would’ve bedn better then the hot garbage they were using.
It is fine if you use unprotected wifi and then connect to a VPN.
You don’t even need a VPN if the software uses proper TLS encryption or equivalent
TLS downgrade attacks are a thing, and can enable MITM attacks. There are server-side mitigations (such as only allowing TLS 1.2+ which should be the case but often isn’t because the server has to support a niche user or application that only supports TLS 1.1), and since you usually don’t know which TLS version you are using, for very sensitive connections it should be assumed that TLS is not enough.
Don’t even get me started on the non-security of standard mobile/landline calls. They’re basically transparent for an attacker with means like Russia’s.
Proper E2E encryption and/or a VPN should be mandatory for a call to be considered secure, period.
If WebEx is susceptible to MITM attacks, it shouldn’t be used for sensitive calls. It’s better to use a VPN, but something like this should not happen at all, even without VPNs.
Sure, but when you demonstrably don’t have a handle on E2E encryption using a VPN should be the FIRST step because it is very easy to implement, secure, and enforce. Virtually every private company does it.
Conversely E2E encryption is hard, lots of popular apps disable it by default or in some cases because it breaks a lot of useful things (like search). I agree it SHOULD still be mandated, but it’s several orders of magnitude more expensive to switch the communication tool than mandating a VPN so for me that immediately pushes it second to VPN on the priority list.
I like the American option. We just built an entire second Internet and air-gapped it.
These VPN ad campaigns are incredibly detrimental to people’s understanding of security mechanisms in the internet.
How would this not have helped out in this case? I imagine the Bundeswehr must have an organization-wide VPN which would render any MITM in a local Wifi network impossible, barring user error.
The data still has to go through the man in the middle. It doesn’t matter if it’s encrypted by the VPN or the App.
How is it possible to accomplish a man in the middle attack on a TLS secure connection ? Hotel wifi or not, unless something major like Singaporean gov interfered with the connection, forced forged certificates into his phone, I don’t see how this was put off by compromising the connection .
I bet they are covering for the Fact that one of them has downloaded malware into his device to masturbate to a hot girl living next to him kinda ad. and then malware shared back that data to Russia. or they have a spy among them and Germany isn’t ready to admit having its defense forces compromised with Russian assets.
The easiest explanation is the room was bugged and the general stayed there.
Everyone forgets the old school stuff. It doesn’t matter how well your connection is encrypted if the GRU has the room next to you.
they were using an insecure method to connect with webex, so something like a dial-in number for using it without a computer i guess. that is probably not encrypted. the meeting could have been a fax anyway
Do you think Webex doesn’t reject insecure connections ? it is the bare minimum for any web app.
but the audio in the hands of the Russians sounds crystal clear! and you can hear all the participants very clearly, which means it has been captured from one of the involved devices.
not sure how they would check a landline call for security 🤷
All the data goes to the man in the middle. Worse, there’s nothing stopping a user from connecting for other things. So a man in the middle can act like a trusted source while sending malware to the device. If they compromised the phone/computer then the encrypted tunnel is moot. It has to be decrypted at some point, even if the malware literally just creates a recording.
TLS means dick if you have a nation-state that can mint a cert that would be trusted by your browser. Unless you’re using a site that does cert pinning (which is basically a list your browser has of URLs and expected cert fingerprints as published by the site owners) or the fuckery that Google gets up to in chrome (they monitor and immediately ping the mother ship if a Google property is detected using an unauthorized cert), you can’t really stop or detect it as an end user.
Your computer trusts so many companies to vouch for other sites’ legitimacy that it’s not out of the realm of possibilities that they leaned on a CA and minted a cert to let them MITM the connection. You’re still connecting to a “trusted” cert, even if it isn’t the legitimate one.
EvE Online should be mandatory training for anyone with a security clearance. Minimum of six months in Goonswarm, Pandemic Horde, Fraternity, or The Initiative.
https://cad-comic.com/comic/one-of-us/
That’s only a slight exaggeration. I had a “chat” with one of our intel officers at one point due to a IRL purchase of PLEX.
Edit: maybe just Goonswarm. They do the intelligence and spy stuff the best.
Bad article
Isn’t like very basic security advice to not use random connections for sensitive information? But than again it’s Germany, pretty sure he has his password written down on a sticky note.
günther2
Should have used jitsi… It’s free too!
deleted by creator
The point of encryption and signature is to allow just that.
deleted by creator
For all we know, they were on speaker & the room was bugged
Called in via SIP or unencrypted mobile network, i bet. Probably because the client via VPN was “too slow”
