Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.

According to German authorities, the “data leak” was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.

The exact mode of dial-in is “still being clarified”, Germany has said.

“I think that’s a good lesson for everybody: never use hotel internet if you want to do a secure call,” Germany’s ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.

Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.

Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption “if you use the app itself”.

But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it’s now supposed, were ready to pounce.

    • Natanael@slrpnk.net
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      You don’t even need a VPN if the software uses proper TLS encryption or equivalent

      • azertyfun@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 months ago

        TLS downgrade attacks are a thing, and can enable MITM attacks. There are server-side mitigations (such as only allowing TLS 1.2+ which should be the case but often isn’t because the server has to support a niche user or application that only supports TLS 1.1), and since you usually don’t know which TLS version you are using, for very sensitive connections it should be assumed that TLS is not enough.

        Don’t even get me started on the non-security of standard mobile/landline calls. They’re basically transparent for an attacker with means like Russia’s.

        Proper E2E encryption and/or a VPN should be mandatory for a call to be considered secure, period.

        • Toine@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          0
          ·
          7 months ago

          If WebEx is susceptible to MITM attacks, it shouldn’t be used for sensitive calls. It’s better to use a VPN, but something like this should not happen at all, even without VPNs.

        • Maggoty@lemmy.world
          link
          fedilink
          English
          arrow-up
          0
          ·
          7 months ago

          I like the American option. We just built an entire second Internet and air-gapped it.

    • FuzzChef@feddit.de
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      These VPN an campaigns are incredibly detrimental to people’s understanding of security mechanisms in the internet.

      • RealJoL@feddit.de
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 months ago

        How would this not have helped out in this case? I imagine the Bundeswehr must have an organization-wide VPN which would render any MITM in a local Wifi network impossible, barring user error.

  • anticurrent@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    How is it possible to accomplish a man in the middle attack on a TLS secure connection ? Hotel wifi or not, unless something major like Singaporean gov interfered with the connection, forced forged certificates into his phone, I don’t see how this was put off by compromising the connection .

    I bet they are covering for the Fact that one of them has downloaded malware into his device to masturbate to a hot girl living next to him kinda ad. and then malware shared back that data to Russia. or they have a spy among them and Germany isn’t ready to admit having its defense forces compromised with Russian assets.

    • ErwinLottemann@feddit.de
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      they were using an insecure method to connect with webex, so something like a dial-in number for using it without a computer i guess. that is probably not encrypted. the meeting could have been a fax anyway

        • anticurrent@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          0
          ·
          7 months ago

          but the audio in the hands of the Russians sounds crystal clear! and you can hear all the participants very clearly, which means it has been captured from one of the involved devices.

      • Maggoty@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 months ago

        Everyone forgets the old school stuff. It doesn’t matter how well your connection is encrypted if the GRU has the room next to you.

  • AngryCommieKender@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    7 months ago

    EvE Online should be mandatory training for anyone with a security clearance. Minimum of six months in Goonswarm, Pandemic Horde, Fraternity, or The Initiative.

    https://cad-comic.com/comic/one-of-us/

    That’s only a slight exaggeration. I had a “chat” with one of our intel officers at one point due to a IRL purchase of PLEX.

    Edit: maybe just Goonswarm. They do the intelligence and spy stuff the best.

  • Blackmist@feddit.uk
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    I don’t see how it matters if you use hotel WiFi or mobile if the mobile mast you connect to is controlled by a hostile government.

    What matters is what you were sending wasn’t secured at source.

    Although Wikipedia tells you the range and I’m pretty sure even Russia have access to maps and a compass.

  • LifeBandit666@feddit.uk
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    This happened because of an unintended backdoor into an end to end encrypted conversation.

    The British Government are actively trying to get back doors put into end to end encryption by law.

    They are doing this so they can spy on their own citizens to ostensibly make Britain safer.

    But as you can see, it actually would make it less safe.

  • sepiroth154@feddit.nl
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    7 months ago

    This doesnt add up… If the software was properly encrypted they shouldn’t have been able to carry out a man in the middle attack right?

    • vzq@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      Maybe he dialed in by telephone? It would be a complete boomer move, but I’ve seen people do it.

      • zaphod@feddit.de
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 months ago

        He most likely did, at least from what I can deduce from the published recording.

      • fluxion@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 months ago

        A researcher in cryptography in Berlin, Henning Seidler, believes the most likely theory is that the officer dialled in via his mobile phone and the call was picked up by spies’ antenna who can also “forward” the traffic onto the main, official antenna.

        Seems like the more likely theory

          • WhatAmLemmy@lemmy.world
            link
            fedilink
            English
            arrow-up
            0
            ·
            7 months ago

            “Intelligence” services cost taxpayers billions a year, so the billion dollar question is why is it possible to dial in to “official” military communications over insecure channels at all?

            Why doesn’t the government run their own signal or matrix infra? Why are they paying Cisco, and introducing the numerous attack vectors of a proprietary optionally-encrypted service?

            The threat of surveillance capitalism isn’t just in the dragnet surveillance of the population. It’s in the profiteering of “partnerships” between private and public — the drive of corrupt and incompetent political and military leadership to direct funds to sub-optimal proprietary services and protocols, instead of leveraging public funding to contribute to open-source and make hardened systems ubiquitous.

              • lad@programming.dev
                link
                fedilink
                English
                arrow-up
                0
                ·
                7 months ago

                Probably the client runs poorly on the cutting edge Nokia 3310s those generals use

              • WhatAmLemmy@lemmy.world
                link
                fedilink
                English
                arrow-up
                0
                ·
                7 months ago

                That’s what I’m getting at. This ultimately isn’t the fault of some technobozo who dialled in from hotel wifi. If the system were fit for purpose, technobozo could dial in over any network.

                The is the fault of German politicians, military, and “intelligence”. This type of compromise should not exist as a matter of circumstance. It should only be possible when an end users device is directly compromised.

          • SkippingRelax@lemmy.world
            link
            fedilink
            English
            arrow-up
            0
            ·
            7 months ago

            We are talking about the person/department that has ensured that they run an especially secure, certified, version of webex losing their job right?

            As much as I’d like to think that senior military people have some basic awareness about security, this is really a tool that was considered secure by the organisation. Sounds like a big gaping whole letting dialin enabled for anyone to use.

            • sepiroth154@feddit.nl
              link
              fedilink
              English
              arrow-up
              0
              ·
              edit-2
              7 months ago

              I meant the officier using his mobile internet losing their job. Of course this won’t happen but it was meant as a joke.

              • SkippingRelax@lemmy.world
                link
                fedilink
                English
                arrow-up
                0
                ·
                7 months ago

                Vut it shouldnt even happen. They were in Singapore at the time that, they had to join in remotely. There is a whole department responsible for running the infrastructure and make sure its secure, this is, hardly the end users fault.

      • the_wise_wolf@feddit.de
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 months ago

        Yes, it is a boomer move. But don’t let Cisco off the hook. What kind of specially certified security feature is that, if it can be turned off so easily by accident.

    • Nightwatch Admin@feddit.nl
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      Yes, it’s not the 90s anymore. The network is hostile. If it’s not, nice but you’d be a fool to trust even your own. Encryption all the way!

    • Jagermo@feddit.de
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      It they used the client, yes. But in you dial in via sip, that opens up so many ways to screw up. Old software, open wifi, legacy hardware, you name it.

    • the_wise_wolf@feddit.de
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      Sounds like the encryption is automatically tuned off if someone calls in via phone. So technically e2e encryption is supported, but it’s a shit design just waiting for someone to accidentally misuse it.

      • SkippingRelax@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        edit-2
        7 months ago

        It sounds like this especially secure, certified, version of webex should probably not allow dial in via phone should it?

    • lurch (he/him)@sh.itjust.works
      cake
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      yes, one side has to automatically or manually accept a fake certificate/key to MITM end to end encryption. you know, like when your browser says “certificate error” and you click on advanced->accept anyway or something like that. if the software always accepts or he manually accepted one, the MITM guy can substitute his own encryption key/cert and decrypt and re-encrypt on the fly.

        • Macros@feddit.de
          link
          fedilink
          English
          arrow-up
          0
          ·
          edit-2
          7 months ago

          In this case shit software. For a secure conference software there should be no possibility for the user to accept invalid certificates.

          The developer always has to plan with what we call a DAU in germany (Dümmster anzunehmender User = dumbest user possible), and even that user should have no possibility to accidentally share a secure conference. So as a developer I would: Lock the user to certificates and encryption keys I deem secure and hook into the low level OS functions to grab the screen and disable them to prevent accidental sharing via software like Anydesk and the like which the user forgot to close. This would even interrupt the functions of a simple trojan on the PC.

          Of course a dedicated attacker with physical or admin access to the device could always break these. But then you have another big security breach.

      • trollercoaster@feddit.de
        link
        fedilink
        English
        arrow-up
        0
        ·
        edit-2
        7 months ago

        If you’re looking at who is allowed to issue trusted root certificates in common browsers and operating systems, nobody needs to accept nothing to have every possible man in the middle from every major country’s intelligence services already in there.

        • 4am@lemm.ee
          link
          fedilink
          English
          arrow-up
          0
          ·
          7 months ago

          But that also depends on the issuer that WebEx used. If this really was a MITM without someone fucking up and bypassing a warning, whoever the root CA is issuing for WebEx can no longer be trusted.

          More likely they dialed in via mobile rather than use “Computer Audio” and that is easily defeated using a Stingray-type device.

          • trollercoaster@feddit.de
            link
            fedilink
            English
            arrow-up
            0
            ·
            7 months ago

            Yes, in that case, it most likely was using an insecure channel to directly dial into the conference. Still, the entire certificate infrastructure is mere security theater, unless you’re actually going through the trouble of checking every individual certificate yourself.

            • anlumo@feddit.de
              link
              fedilink
              English
              arrow-up
              0
              ·
              7 months ago

              That’s the open secret of the Web, all security on it is just fake. The list of root certificates is way too long to provide any security.

                • anlumo@feddit.de
                  link
                  fedilink
                  English
                  arrow-up
                  0
                  ·
                  7 months ago

                  Public WiFi is the main problem, anybody connected to the same WiFi could potentially intercept all of your Web traffic. You could use a VPN to avoid that one.

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    This is the best summary I could come up with:


    He sounds relaxed on the line as he chats with two colleagues about the “mega” view from his room, and how he’s just come back from a drink at a nearby hotel where there’s an incredible swimming pool.

    Over the next 40 minutes, the group appear to touch upon highly sensitive military issues, including the ongoing debate over whether Germany should send Taurus cruise missiles to Ukraine.

    The four participants discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv - a contentious issue in Germany.

    “You have to choose a certain kind of disguise for this disaster,” says Mr Kiesewetter, who’s also worked at the Nato military alliance and is a member of Germany’s opposition conservative CDU party.

    But German government figures find suggestions that they are somehow soft on Russia increasingly irritating, particularly because Berlin has donated more weapons aid to Ukraine than any other nation in Europe.

    It’s further exposed domestic divisions about whether to send Taurus missiles to Ukraine and prompted a wider discussion about the country’s perceived defence and security weaknesses.


    The original article contains 1,075 words, the summary contains 187 words. Saved 83%. I’m a bot and I’m open source!

  • gapbetweenus@feddit.de
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    Isn’t like very basic security advice to not use random connections for sensitive information? But than again it’s Germany, pretty sure he has his password written down on a sticky note.

  • Knasen@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    How the f*ck do you think you can have a “secure” call over uncontrolled networks, devices and locations?

    The stupidity!

    • Jagermo@feddit.de
      link
      fedilink
      English
      arrow-up
      0
      ·
      7 months ago

      Called in via SIP or unencrypted mobile network, i bet. Probably because the client via VPN was “too slow”

      • Knasen@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        edit-2
        7 months ago

        Sensitive conversations on government level are preferably held in controlled environments, https://en.m.wikipedia.org/wiki/Sensitive_compartmented_information_facility , or offices that are fit for the purpose. Not hotel rooms.

        Depending on the what information level , technology can be present but in that case controlled technology that users can’t screw up by connecting to insecure wifi networks or even use if they are tampered with.

        You don’t have sensetive conversations over customer grade cellphones with a encrypted app.

        Consumer grade cellphones are generally considered insecure and uncontrollable.

        Even hints to it in the article:

        ““I think that’s a good lesson for everybody: never use hotel internet if you want to do a secure call,” Germany’s ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late. Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.”

        A normal WebEx connection is encrypted but not the the level of government use. Encryption and certificates isn’t a 100% guarantee that things are secure enough on a government level.

        Likely use of a uncontrolled device over a uncontrolled connection in a uncontrolled environment or one of them.

  • Linkerbaan@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    7 months ago

    Yeah blame it on hotel internet, not their shitty communication service that’s not encrypted.