IEEE Spectrum July, 2007 - 19
location L." The software goes to location L
and executes the instructions it finds there,
that is, Z. In other words, a software patch
works by replacing an instruction at the
area of the code to be fixed with an instruc-
tion that diverts the program to a memory
location in the correction area containing
the new version of the code.
The challenge faced by the intruders was
to use the RES's capabilities to duplicate
and divert the bits of a call stream without
using the dialog-box interface to the IMS,
which would create auditable logs of their
activities. The intruders pulled this off by
installing a series of patches to 29 separate
blocks of code, according to Ericsson offi-
cials who testified before the Greek par-
liamentary committee that inves-
tigated the wiretaps. This rogue
software modified the central
processor's software to directly
initiate a wiretap, using the RES's
capabilities. Best of all, for them,
the taps were not visible to the
operators, because the IMS and its
user interface weren't used.
The full version of the software
would have recorded the phone
numbers being tapped in an offi-
cial registry within the exchange.
And, as we noted, an audit could
then find a discrepancy between
the numbers monitored by the
exchange and the warrants active
in the IMS. But the rogue software
bypassed the IMS. Instead, it cleverly stored
the bugged numbers in two data areas that
were part of the rogue software's own mem-
ory space, which was within the switch's
memory but isolated and not made known
to the rest of the switch.
That by itself put the rogue soft-
ware a long way toward escaping detec-
tion. But the perpetrators hid their own
tracks in a number of other ways as well.
There were a variety of circumstances by
which Vodafone technicians could have
discovered the alterations to the AXE's
software blocks. For example, they could
have taken a listing of all the blocks, which
would show all the active processes run-
ning within the AXE-similar to the task
manager output in Microsoft Windows
or the process status (ps) output in Unix.
They then would have seen that some pro-
cesses were active, though they shouldn't
have been. But the rogue software appar-
ently modified the commands that list
the active blocks in a way that omitted
certain blocks-the ones that related to
intercepts-from any such listing.
In addition, the rogue software might
have been discovered during a software
upgrade or even when Vodafone techni-
cians installed a minor patch. It is stan-
dard practice in the telecommunications
industry for technicians to verify the
existing block contents before performing
an upgrade or patch. We don't know why
the rogue software was not detected in this
way, but we suspect that the software also
modified the operation of the command
used to print the checksums-codes that
create a kind of signature against which
the integrity of the existing blocks can be
validated. One way or another, the blocks
appeared unaltered to the operators.
Finally, the software included a back
door to allow the perpetrators to control
it in the future. This, too, was cleverly
constructed to avoid detec-
tion. A report by the Hellenic
Authority for the Information
and Communication Security
and Privacy (the Greek abbre-
viation is ADAE) indicates
that the rogue software modi-
fied the exchange's command
parser-a routine that accepts
commands from a person with
system administrator status-
so that innocuous commands
followed by six spaces would
deactivate the exchange's
transaction log and the alarm
associated with its deactiva-
tion, and allow the execution
of commands associated with
the lawful interception subsystem. In effect,
it was a signal to allow operations associ-
ated with the wiretaps but leave no trace of
them. It also added a new user name and
password to the system, which could be
used to obtain access to the exchange.
Software that not only alters operat-
ing system code but also hides its tracks
is called a "rootkit." The term is known
to the public-if at all-because of one
that the record label Sony BMG Music
Entertainment included on some music
CDs released in 2005. The Sony rootkit
restricted copying of CDs; it burrowed into
the Windows operating system on PCs and
then hid its existence from the owner. (Sony
stopped using rootkits because of a gen-
eral public outcry.) Security experts have
also discovered other rootkits for general-
purpose operating systems, such as Linux,
Windows, and Solaris, but to our knowl-
edge this is the first time a rootkit has been
observed on a special-purpose system, in
this case an Ericsson telephone switch.
the rogue
software
stored
bugged
phone
numbers
in its own
memory
space
www.spectrum.ieee.org
wiTh all of This sophisTicaTed subterfuge,
how then was the rogue software finally
discovered? On 24 January 2005, the perpe-
trators updated their planted software. That
upgrade interfered with the forwarding of
text messages, which went undelivered.
These undelivered text messages, in turn,
triggered an automated failure report.
At this point, the hackers' abilities to
keep their modifications to the switch's
AXE software suite secret met their limits,
as it's almost impossible to hide secrets in
somebody else's system.
The AXE, like most large software sys-
tems, logs all manner of network activity.
System administrators can review the log
files, and any events they can't account for
as ordinary usage can be investigated.
It's impossible to overstate the impor-
tance of logging. For example, in the 1986
Cuckoo's Egg intrusion, the wily network
administrator, Clifford Stoll, was asked
to investigate a 75 U.S. cents account-
ing error. Stoll spent 10 months looking
for the hacker, who had penetrated deep
into the networks of Lawrence Livermore
National Laboratory, a U.S. nuclear weap-
ons lab in California. Much of that time
he spent poring over thousands of log
report pages.
The AXE, like most sophisticated sys-
tems nowadays, can help operators find
the nuggets of useful information within
the voluminous logs it generates. It is pro-
grammed to report anomalous activity on
its own, in the form of error or failure
reports. In addition, at regular intervals
the switching center generates a snapshot
of itself-a copy, or dump, of all its pro-
grams and data.
Dumps are most commonly consulted
for recovery and diagnostic purposes, but
they can be used in security investigations.
So when Ericsson's investigators were called
in because of the undelivered text messages,
the first thing they did was look closely at
the periodic dumps. They found two areas
containing all the phone numbers being
monitored and retrieved a list of them.
The investigators examined the dumps
more thoroughly and found the rogue pro-
grams. What they found though, was in the
form of executable code-in other words,
code in the binary language that micro-
processors directly execute. Executable
code is what results when a software
compiler turns source code-in the case
of the AXE, programs written in the PLEX
language-into the binary machine code
that a computer processor executes. So the
investigators painstakingly reconstructed
an approximation of the original PLEX
source files that the intruders developed.
It turned out to be the equivalent of about
6500 lines of code, a surprisingly substan-
tial piece of software.
July 2007 | IEEE Spectrum | NA
31
http://www.spectrum.ieee.org
Table of Contents for the Digital Edition of IEEE Spectrum July, 2007
IEEE Spectrum July, 2007 - Cover1
IEEE Spectrum July, 2007 - Cover2
IEEE Spectrum July, 2007 - 1
IEEE Spectrum July, 2007 - 2
IEEE Spectrum July, 2007 - 3
IEEE Spectrum July, 2007 - 4
IEEE Spectrum July, 2007 - 5
IEEE Spectrum July, 2007 - 6
IEEE Spectrum July, 2007 - 7
IEEE Spectrum July, 2007 - 8
IEEE Spectrum July, 2007 - 9
IEEE Spectrum July, 2007 - 10
IEEE Spectrum July, 2007 - 11
IEEE Spectrum July, 2007 - 12
IEEE Spectrum July, 2007 - 13
IEEE Spectrum July, 2007 - 14
IEEE Spectrum July, 2007 - 15
IEEE Spectrum July, 2007 - 16
IEEE Spectrum July, 2007 - 17
IEEE Spectrum July, 2007 - 18
IEEE Spectrum July, 2007 - 19
IEEE Spectrum July, 2007 - 20
IEEE Spectrum July, 2007 - 21
IEEE Spectrum July, 2007 - 22
IEEE Spectrum July, 2007 - 23
IEEE Spectrum July, 2007 - 24
IEEE Spectrum July, 2007 - 25
IEEE Spectrum July, 2007 - 26
IEEE Spectrum July, 2007 - 27
IEEE Spectrum July, 2007 - 28
IEEE Spectrum July, 2007 - 29
IEEE Spectrum July, 2007 - 30
IEEE Spectrum July, 2007 - 31
IEEE Spectrum July, 2007 - 32
IEEE Spectrum July, 2007 - 33
IEEE Spectrum July, 2007 - 34
IEEE Spectrum July, 2007 - 35
IEEE Spectrum July, 2007 - 36
IEEE Spectrum July, 2007 - 37
IEEE Spectrum July, 2007 - 38
IEEE Spectrum July, 2007 - 39
IEEE Spectrum July, 2007 - 40
IEEE Spectrum July, 2007 - 41
IEEE Spectrum July, 2007 - 42
IEEE Spectrum July, 2007 - 43
IEEE Spectrum July, 2007 - 44
IEEE Spectrum July, 2007 - 45
IEEE Spectrum July, 2007 - Cover3
IEEE Spectrum July, 2007 - Cover4
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1217
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1117
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1017
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0917
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0817
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0717
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0617
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0517
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0417
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0317
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0217
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0117
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1216
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1116
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1016
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0916
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0816
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0716
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0616
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0516
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0416
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0316
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0216
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0116
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1215
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1115
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1015
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0915
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0815
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0715
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0615
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0515
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0415
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0315
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0215
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0115
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1214
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1114
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1014
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0914
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0814
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0714
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0614
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0514
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0414
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0314
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0214
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0114
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1213
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1113
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1013
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0913
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0813
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0713
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0613
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0513
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0413
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0313
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0213
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0113
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1212
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1112
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1012
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0912
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0812
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0712
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0612
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0512
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0412
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0312
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0212
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0112
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1211
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1111
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1011
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0911
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0811
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0711
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0611
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0511
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0411
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0311
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0211
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0111
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1210
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1110
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1010
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0910
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0810
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0710
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0610
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0510
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0410
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0310
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0210
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0110
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1209
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1109
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1009
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0909
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0809
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0709
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0609
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0509
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0409
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0309
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0209
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0109
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1208
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1108
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1008
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0908
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0808
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0708
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0608
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0508
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0408
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0308
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0208
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0108
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1207
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1107
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_1007
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0907
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0807
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0707
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0607
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0507
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0407
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0307
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0207
https://www.nxtbook.com/nxtbooks/ieee/spectrum_na_0107
https://www.nxtbookmedia.com