Expired Ericsson cert causes UK and Japan mega outages

Telco kit giant Ericsson is scrambling to fix a software issue that's killed mobile data service for tens of millions of subscribers on Britain's O2 and Japan's Softbank networks.

The Swedish equipment vendor has released a statement on the problem, saying it had "identified an issue in certain nodes in the core network resulting in network disturbances for a limited number of customers in multiple countries using two specific software versions of the SGSN–MME (Serving GPRS Support Node – Mobility Management Entity)."

Ericsson is a key partner of Telstra, including for the rollout of its 5G network. A Telstra spokesperson told iTnews that the Ericsson software issue did not impact the telco.

The root cause of the problem is an expired certificate in the software versions installed with the affected customers, Ericsson said.

The company would not name which customers are affected, but UK telco O2 confirmed via social media that it had been hit by the problem, and Ericsson was working to restore services.

Mobile virtual network operators such as Giffgaff, Sky Mobile and others that use O2's wholesale services were affected, meaning around 32 million subscribers in the UK were cut off.

In Japan, the software problem caused a nationwide outage for tens of millions of Softbank Mobile customers.

SoftBank通信障害発生中#ソフトバンク圏外 pic.twitter.com/zkr8nxsesd

— ʜᴏᴍᴏᴄʜᴀɴ®︎�� (@SilentkillerNo7) December 6, 2018

Retail shops closed early after the outage started yesterday afternoon, leaving them unable to service customers during normal trading hours.

The expired certificate issue had security experts in stitches, pointing out that the lack of automated digital credentials management meant that updating the network devices would be a long and painful process.

Each Ericsson device at every location needs to be manually upgraded to latest release to get around certificate issue ����

— ���� Kevin Beaumont ���� (@GossiTheDog) December 6, 2018