When another carrier is the source
Enea researchers say compromised infrastructure inside mobile operators carried surveillance traffic aimed principally at Taiwanese subscribers. In a November 11 report, the company traced suspicious activity to network elements at operators in at least six Asian countries. It observed targeting across a further dozen countries and territories. The findings concern the signalling that carriers exchange to locate subscribers and deliver service, an area where a subscriber has little visibility into who handled a call or message.
What the network evidence establishes
Enea initially considered whether an outsider was misrepresenting the origin of the traffic. In one carrier it observed a network element participating on both sides of the suspicious exchange, evidence that the equipment itself had been compromised. The researchers recovered traces of unauthorised access but could not analyse the suspected malicious program. They named the activity SilentAir and assessed with high confidence that a state-level actor was responsible. Their assessment of a connection to China carried low confidence.
The subscriber’s second exposure
The researchers observed verification codes arriving immediately after interception activity affecting certain targets. That sequence puts an enterprise identity team as well as a carrier security team in the picture. A carrier can investigate the path a message took, while the service that sent the code holds the record of whether a session opened or an account setting changed. The timing alone cannot settle both questions. It also limits what a clean handset examination could tell an affected subscriber about an incident upstream.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
