Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.
According to German authorities, the “data leak” was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.
The exact mode of dial-in is “still being clarified”, Germany has said.
“I think that’s a good lesson for everybody: never use hotel internet if you want to do a secure call,” Germany’s ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.
Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.
Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption “if you use the app itself”.
But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it’s now supposed, were ready to pounce.
TLS means dick if you have a nation-state that can mint a cert that would be trusted by your browser. Unless you’re using a site that does cert pinning (which is basically a list your browser has of URLs and expected cert fingerprints as published by the site owners) or the fuckery that Google gets up to in chrome (they monitor and immediately ping the mother ship if a Google property is detected using an unauthorized cert), you can’t really stop or detect it as an end user.
Your computer trusts so many companies to vouch for other sites’ legitimacy that it’s not out of the realm of possibilities that they leaned on a CA and minted a cert to let them MITM the connection. You’re still connecting to a “trusted” cert, even if it isn’t the legitimate one.