All of the gulf nation states make use of ZTE, Huawei and other Chinese phone system 'core' equipment for SS7, SMS, and for their mobile carriers' LTE networks. The "lawful intercept" abilities built into these systems, being designed for sale both domestically in China and to authoritarian governments around the world, are quite thorough.
Not that the intercept abilities in Alcatel/Lucent/Nokia/Ericsson equipment is much less robust, it's just not as commonly used in these environments.
Here's a really old but reasonably well documented instance of the same type of event:
In the case originally referenced, I would be totally unsurprised that some other nation-state has inserted an advanced persistent threat into the SMS core infrastructure of Qatar's telecoms. One of the reasons why proper end to end crypto (Signal, etc) is so important. At least if you can be reasonably assured of the security and OS of the endpoint devices, you don't have to trust the network in between them.
Comments
All of the gulf nation states make use of ZTE, Huawei and other Chinese phone system 'core' equipment for SS7, SMS, and for their mobile carriers' LTE networks. The "lawful intercept" abilities built into these systems, being designed for sale both domestically in China and to authoritarian governments around the world, are quite thorough.
Not that the intercept abilities in Alcatel/Lucent/Nokia/Ericsson equipment is much less robust, it's just not as commonly used in these environments.
Here's a really old but reasonably well documented instance of the same type of event:
https://spectrum.ieee.org/telecom/security/the-athens-affair
https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...
https://www.schneier.com/blog/archives/2006/06/greek_wiretap...
In the case originally referenced, I would be totally unsurprised that some other nation-state has inserted an advanced persistent threat into the SMS core infrastructure of Qatar's telecoms. One of the reasons why proper end to end crypto (Signal, etc) is so important. At least if you can be reasonably assured of the security and OS of the endpoint devices, you don't have to trust the network in between them.