PCMag Asia Software & Services Security
Security-Focused SMS Company Reportedly Helped Surveil Users
The company, Mitto AG, provides text messaging services used by the likes of Google and Twitter to send one-time passwords to their users.
Dec. 6, 2021, 11:30 p.m.
The co-founder of a company that provides text messaging services to businesses looking to send one-time passwords, appointment reminders, and discount codes to their customers reportedly helped governments conduct surveillance by selling access to the company's network.
The Bureau of Investigative Journalism and Bloomberg report that Mitto AG co-founder Ilja Gorelik sold that access so his clients would be able to "secretly locate people via their mobile phones." Gorelik reportedly provided that information to surveillance companies that contracted with government agencies—the report doesn't say which ones—so they could spy on people.
Access to Mitto AG's network would provide information about countless people: TBIJ and Bloomberg say the company has "relationships with telecom operators in more than 100 countries" that allow it to provide its services to Google, Twitter, WhatsApp, TikTok, Alibaba, Tencent, and LinkedIn, as well as other popular businesses that rely on SMS in some fashion.
Several of those services have more than a billion users. Not all of them will use SMS-based multi-factor authentication to access their accounts, however, which should cap the number of people affected by any surveillance efforts. (Although users who do have multi-factor authentication enabled are probably more likely to be upset about this invasion of privacy.)
In at least one case the access to Mitto AG's networks was used to surveil "a senior US State Department official," TBIJ and Bloomberg say, "according to documents reviewed by the Bureau and a cybersecurity analyst familiar with the incident." That surveillance was said to have been conducted in 2019, which suggests that Mitto AG has been compromised for years.
"That Mitto's networks were also being used for surveillance work was not shared with the company's technology clients, or the mobile networks Mitto works with to spread its text messages and other communications," the report says, "according to former Mitto employees."
Gorelik reportedly "installed custom software at Mitto that could be used to target certain people," and former Mitto AG employees told TBIJ and Bloomberg "there was virtually no oversight of surveillance carried out using Mitto's systems, creating potential opportunities for misuse." (At least keeping the program secret would limit potential abuse by Mitto AG workers.)
Here's Mitto AG's response to TBIJ and Bloomberg:
"We are shocked by the assertions against Ilja Gorelik and our company. To be clear, Mitto does not, has not, and will not organise and operate a separate business, division, or entity that provides surveillance companies access to telecom infrastructure to secretly locate people via their mobile phones, or other illegal acts. Mitto also does not condone, support, and enable the exploitation of telecom networks with whom the company partners to deliver service to its global customers."
Mitto AG is also said to have told TBIJ and Bloomberg that it launched an investigation into their claims "to determine if our technology and business has been compromised" and would "take corrective action if necessary."
Google, Twitter, and Microsoft didn't immediately respond to requests for comment.
Stolen Credit Card Vendors Retire With $358 Million in Crypto
Don't Plug It In! How to Prevent a USB Attack
Amazon Web Services Patches 'Superglue' Vulnerability
About Nathaniel Mott
Nathaniel Mott is a writer and editor who has contributed to The Guardian, Tom's Hardware, and several other publications in varying capacities since 2011. You can follow him on Twitter: @nathanielmott.
More From Nathaniel Mott
FTC Reportedly Leads Antitrust Probe Into Oculus
Google Meet Rolls Out Live Translations