Computer Weekly reveals for the first time how French cyber spies hacked EncroChat phones, used by organised crime groups, in 2020. In the first of two major articles, we describe how a Czech spyware company rehacked the French hack and found that French malware – described as a national security secret – had been copied from popular code-sharing platform GitHub.
The Czech rehack uncovered digital fingerprints matching French evidence sent across Europe, proving how messages had been copied.
The exposure of the French method, British lawyers say, is likely to restart a critical case into the legality of police tactics in EncroChat in Britain’s Investigatory Powers Tribunal, which has been adjourned for more than two years, awaiting a finding on how the hack was carried out.
The secret French state hacking group that broke into tens of thousands of encrypted secure phones in Europe used an Android exploit first spotted in 2017, CW can reveal. For two years, a fatal security vulnerability, known as the Bad Binder bug, was left unpatched inside 2.5 billion phones, leaving users at maximum risk. The exploit allowed cyber spies to take complete control of infected phones and copy or change users’ data, programs and files at will.
A “groundbreaking” report by Czech researchers, obtained by Computer Weekly, combined with expert analysis of intercepted material has revealed how the French “implant” relied on Bad Binder – and that its code was poorly written, prone to repeated failure, and lacked elementary countermeasures to avoid detection. Implant code, recovered by reverse engineering – working out program instructions from compiled code to see how it operates – shows that intercepted messages being transmitted inside targeted phones were “hooked” and copied almost immediately to police investigators. British lawyers say that if the full facts had been disclosed when trials started in 2020, it would be “open to question whether courts were properly informed”.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: www.computerweekly.com.
