{"id":1932,"date":"2022-02-16T23:28:29","date_gmt":"2022-02-17T06:28:29","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=1932"},"modified":"2022-02-16T23:43:49","modified_gmt":"2022-02-17T06:43:49","slug":"2fa-provider-secretly-also-provides-surveillance-through-telecommunications-network","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/02\/16\/2fa-provider-secretly-also-provides-surveillance-through-telecommunications-network\/","title":{"rendered":"2FA provider secretly also provides surveillance through telecommunications network"},"content":{"rendered":"\n

Twitter appears to be distancing themselves from their two-factor authentication provider, Mitto AG, following recent controversy regarding Mitto AG\u2019s COO selling access to their network to surveillance companies.<\/p>\n\n\n\n\n\n\n\n

Mitto AG is a communications company, lucrative for their expansive network spanning across over 100 countries gained through deals with companies already established in these countries. They\u2019ve had many high profile customers such as Google, WhatsApp, Twitter, TikTok, and Telegram. Many of their work involves the delivery of two-factor authentication through SMS messages. If you\u2019ve set up 2FA with any of the aforementioned companies then chances are you\u2019ve witnessed Mitto\u2019s work without realising.<\/p>\n\n\n\n

\"\"
An example of 2FA codes being received, possibly through Mitto’s network courtesy of TBIJ<\/a>.<\/figcaption><\/figure>\n\n\n\n

The Switzerland based communications company is currently facing allegations of running a secret surveillance service, allowing surveillance companies to exploit the vast telecommunications network they have access to. Using custom software, people with this access could track someone\u2019s location, or even access one\u2019s call logs through vulnerabilities present in the outdated protocol \u201cSignaling System 7\u201d that many networks use.<\/p>\n\n\n\n

Mitto claims that this cartel wasn\u2019t a company scheme, but rather the work of a few select people with chief operating officer Ilja Gorelik<\/strong> as the ringleader. Evidence of this has piled up since the collaborative investigation carried out by Bloomberg News<\/a> and Bureau of Investigative Journalism<\/a>, with the final nail in the coffin being Gorelik\u2019s resignation. Twitter’s decision to distance themselves from Mitto only further solidifies this.<\/p>\n\n\n\n

Although it isn\u2019t fully known how much surveillance has been carried out through Mitto, we can get a general idea. Possible clients include but are not limited to: an unnamed national spy agency based in the Middle East, and Cyprus-based firm “TRG Research and Development” who offer surveillance services to intelligence contractors. It is possible that a senior U.S. State Department official was targeted in 2019, although it is unclear who the client was.<\/p>\n\n\n\n

What does this mean for us?<\/h3>\n\n\n\n

Judging from the information so far we could come to the conclusion that as long as we didn\u2019t use the phone number based 2FA system of any of Mitto\u2019s clients we should be safe, right? Wrong<\/em>. Mitto\u2019s surveillance is done through its access to many major telecommunications networks, their 2FA services only gives them the reputation to gain access to many of these networks. If you\u2019re a part of any of the numerous networks Mitto has access to, Mitto could very well just scoop up your location and call logs.<\/p>\n\n\n\n

\"\"
An illustration of how surveillance would be carried out courtesy of Bloomberg<\/a>.<\/figcaption><\/figure>\n\n\n\n

\u201cThe private sector surveillance industry is growing fast, but it\u2019s operating in the dark, without any accountability or transparency, and there have been real human rights implications because of that\u201d<\/p>Jonathon Penney, a research fellow at Citizen Lab<\/cite><\/blockquote>\n\n\n\n

For us plebeians, we probably don\u2019t need to worry since the chances of a surveillance company having an interest in us at an individual level is akin to the idea of an FBI man tracking our every move. However, regardless of whether or not we\u2019ve been directly affected, there is still a massive breach of privacy at play here. The fact that there is the potential<\/em> that we\u2019ve been tracked is very concerning.<\/p>\n\n\n\n

\n\n\n\n

Sources:<\/p>\n\n\n\n