Exploits of "lawful access" interfaces, such as the Chinese attack reported today by the WSJ, appeared almost immediately after they became standardized in the 90's. The most famous example is the case known as "the Athens Affair" https://spectrum.ieee.org/the-athens-affair .
It was a bad idea then, and still a bad idea now.
Mandated wiretap interfaces and cryptographic backdoors are *expensive*, both in terms of money and, more importantly, exposure to risk. Worse, those burdens are borne inequitably.
Overall, almost no one is the subject of a lawful wiretap, even in places where wiretapping is an important investigative tool. Most people aren't suspects. But these mandates degrade security (and impose other costs) for *everyone*, the vast majority of whom will never be wiretapped.
Also, these wiretapping systems have become so bloated and complicated (a security risk in and of itself) that there are now intermediate service providers that act as a buffer between carriers and law enforcement. Compromise one of them, and you've hit the interception jackpot.
I wouldn't be surprised if that's what happened here.
“The purpose of a system is what it does.” 🤷🏻♂️
@mattblaze
Also no one ever remembers when post 9/11 AT&T, Sprint and Verizon had employees in the FBI anti-terror office with terminals to do quicker lookups. Pretty quickly the minimal paperwork was dispensed with and FBI agents would just write down phone numbers on post-it notes and hand it to them to get chains
Before the office of inspector general report came out, Obama's DoJ retroactively legalized it.
Backdoors don't just get hacked, they get abused.
Matt Blaze
Coach Pāṇini ®
Ryan Singel