404 — Emergency services recording tools vulnerable to hackers, experts say

Given how often secondary devices are set to go off after a primary terrorist bomb has exploded, the fact that first responder communications are easily hacked does not bring me much cheer. I tagged this as a 404 post, but I may very well use this in Death in Davos too! Check out this story from The Guardian.

A fire engine on call. The Greater Manchester Fire and Rescue Service is a user of the tool.

Emergency services recording tools vulnerable to hackers, experts say

Researchers say the technology in use worldwide is easy to exploit and could give hackers access to confidential calls

Tom Brewster

Police, paramedics and the fire service in the UK are using voice-recording technology that contains severe weaknesses and could make confidential calls vulnerable to hackers, researchers claim.

The allegedly flawed software is made by one of the world’s biggest suppliers of “lawful interception solutions”, Israel’s Nice Systems, and has led to concerns over leaking of valuable evidence.

Researchers at Austrian security firm SEC Consult said the bugs in Nice Recording eXpress were easy to exploit and could be used to turn the devices on their owners, allowing a hacker to spy on conversations.

Various critical infrastructure and emergency services are thought to be using the allegedly flawed software, including UK organisations, for their telephone recording needs.

Online documentation has shown the Greater Manchester Fire and Rescue Service is a user of the tool, and the Guardian has learned that Nice voice recording solutions may be in use at Police Scotland.

The software was reportedly acquired by Russian security for the Sochi Winter Olympics and by financial institutions for regulatory compliance, such as when traders are required to have conversations recorded. The Nice tools also help in gathering evidence.

Hackers could have an easy path to accessing those transactions, said Johannes Greil, a researcher at SEC Consult, who uncovered the alleged software weaknesses.

“The vulnerabilities enable state-sponsored or criminal hackers to take administrative control of the system and gain access to voice recordings. Besides other illegal purposes, the vulnerabilities can be used for comprehensive surveillance of the target organisation,” said Greil.

Greil recommended anyone using the software should cease doing so immediately, until a thorough security review has been carried out and the flaws are fixed.

A total of nine vulnerabilities were claimed by Greil and his team, including the use of a backdoor account, which could easily be compromised, he said.

Certain sensitive files on the devices required no password to access, while “low-privileged users” could access voice recordings, making a hacker’s job considerably easier.

Greil claims he contacted Nice about the vulnerabilities back in December. In March and April, some of the flaws were fixed in a software update, but Greil believes at least three serious problems remain.

Last week, the national Computer Emergency Response Teams in Austria and Germany were notified of the claimed critical weaknesses.

A spokesperson for Nice said: "External consulting firms often conduct such tests on our behalf, or on behalf of our customers, and we welcome these activities. If an issue is brought to our attention, we actively address it, as we have done in this instance. In accordance with our regular communications, we are in touch with our customers and partners about all product updates.

The spokesman said the company had addresses all the issues raised by SEC Consult.

"We have been addressing the issues based on priority, and can confirm that we have already resolved almost all of them, and expect the remaining fixes to be completed shortly. We do not believe any of our customers have been impacted by the items raised in this report, as these systems are deployed in a very secure environment and are not accessible outside of the organisation."

Eric King, head of research at Privacy International, said the findings were “a serious concern”, given the status of Nice as one of the largest surveillance suppliers in the world.

“Governments should be thinking twice before mandating such vulnerabilities into the networks we all use every day,” King said.

“Lawful interception systems by definition create backdoors to listen into our private conversations. For years privacy advocates and security experts have warned that these ‘features’ result in the technical weakening of our communications infrastructure and could be exploited by attackers.”

Greil expressed concern not just about the vulnerabilities being exploited for theft of recordings, but for tampering of potential evidence too. “The affected product… also has checksums for all recordings in order to detect potential manipulation of the recordings. The problem is, with the flaws… an attacker can alter those files and check sums within the database.”

He was also worried about the ease of exploiting the weaknesses once a hacker has discovered where the Nice technology is being used.

“Exploitation of our identified security deficiencies is easy. For instance, for one flaw you can exploit the backdoor account in order to gain administrative access to the web interface and therefore all recorded calls. In another case you won't need any authentication at all to compromise the whole database [by sending malicious commands to the database].”