Tag Archive for Telephony

Scary SS7 Flaw Strikes Banks

Scary SS7 Flaw Strikes BanksLost in last month’s hub-bub over WannaCry ransomware was the revelation that hackers had successfully exploited the SS7 “flaw” in January 2017. In May reports surfaced that hackers were able to remotely pilfer German bank accounts by taking advantage of vulnerabilities in Signaling System 7 (SS7). SS7 is a standard that defines how to public phone system talks to itself to complete a phone call.

Telephone system Signaling System 7 The high-tech heist was initially reported by the German newspaper Süddeutsche Zeitung (auf Deutsch). The attack was  a sophisticated operation that combined targeted phishing emails and SS7 exploits to bypass two-factor authentication (2FA) protection. This is the first publicly known exploit of SS7 to intercept two-factor authentication codes sent by a bank to confirm actions taken by online banking customers.

According to ars technica the attack began with traditional bank-fraud trojans. These trojans infect account holders’ computers and steal the passwords used to log in to bank accounts. From there, attackers could view account balances, but were prevented from making transfers without the one-time password the bank sent as a text message. After stealing the necessary login details via phishing emails, the perpetrators leveraged the SS7 flaw to intercept the associated mTAN (mobile transaction authentication numbers) authentication codes sent to the victims — messages notifying them of account activity — to validate the transactions and remain hidden, investigators say.

Central office equipmentGerman Telecommunications giant O2-Telefonica confirmed details of the SS7-based cyber attacks to the newspaper. Ars says, in the past, attackers have obtained mTANs by obtaining a duplicate SIM card that allows them to take control of the bank customer’s phone number. SS7-facilitated compromises, by contrast, can be done remotely on a much larger quantity of phone numbers.

O2 Telefonica confirmed to Help Net Security that the attackers were able to gain access to the network of a foreign mobile network operator in January 2017. The attackers likely purchased access to the foreign telecommunications provider – this can apparently be done for less than 1,000 euros – and have set up call and SMS forwarding.

Ford Road CO in Dearborn Mi is the Oregon officeTwo-factor authentication (2FA) is a security process in which the user provides two authentication factors to verify they are who they say they are.  2FA provides an extra layer of security and makes it harder for attackers to gain access to a person’s devices and online accounts, because knowing the victim’s password alone is not enough to pass the authentication check. Two-factor authentication has long been used to control access to sensitive systems and data, and online services are increasingly introducing 2FA to prevent their users’ data from being accessed by hackers who have stolen a password database or used phishing campaigns to get users’ passwords.

News of the incident prompted widespread concern online. Security advocates railed against the popular and continuous use of text messages to authenticate account information while growing evidence suggests that SS7 is an unsafe channel to deliver such data. Security experts told ars that the same SS7-centric hacking techniques used against German banks will become increasingly prevalent in the future, forcing organizations to reconsider how they authenticate user activity.

Cris Thomas, a strategist at Tenable Network Security warns in the article:

Two-factor authenticationWhile this is not the end of 2FA, it may be the end of 2FA over SS7, which comprises a majority of 2FA systems … Vulnerabilities in SS7 and other cellular protocols aren’t new. They have been presented at security conferences for years … there are other more secure protocols available now that systems can switch to…

Cyber security researchers began issuing warning about this flaw in late 2014 about dangerous flaws in SS7. I wrote about the SS7 flaw in September of 2016  and in March 2107. Maybe this will be the wake up call for the carriers. One industry insider quipped:

This latest attack serves as a warning to the mobile community about what is at stake if these loopholes aren’t closed … The industry at large needs to go beyond simple measures such as two-factor authentication, to protect mobile users and their data, and invest in more sophisticated mobile security.

man-in-the-middle attackIn 2014 security researchers first  demonstrated that SS7 could be exploited to track and eavesdrop on cell phones. This new attack is essentially a man-in-the-middle attack on cell phone communications. It exploits the lack of authentication in the communication protocols that run on top of SS7.

Developed in 1975, today, over 800 telecommunications companies around the world, including AT&T (T) and Verizon (VZ), use SS7 make sure their networks interoperate. This technology has not kept up with modern times.  In May 2017, Wired published an article which explains some of the ways to secure SS7. Overcoming SS7 insecurity requires implementing a series of firewalls and filters that can stop the attacks. Researchers Wired spoke to suggest that adding encryption to SS7 would shield network traffic from prying eyes and bolster authentication. Both of these changes are unpopular with the carriers, because they cost money and can impact the network core, so don’t expect any network changes to address the SS7 flaw anytime soon.

Carriers should use SS7 firewall to secure the SS7 networkThe Register reports that the FCC’s Communications Security, Reliability and Interoperability Council found that the proposed replacement for SS7 on 5G networks, dubbed the Diameter protocol has security holes too.

In March 2017, Oregon Sen. Ron Wyden and California Rep. Ted Lieu sent a letter to Homeland Security’s John Kelly requesting that DHS investigate and provide information about the impact of SS7 vulnerabilities to U.S. companies and governmental agencies. Kelly has not responded to the letter, according to the Wired article.

Of course the TLA’s would never use this “flaw” in SS7 to spy on us.

The Guardian says that given that the SS7 vulnerabilities reside on systems outside of your control, there is very little you can do to protect yourself beyond not using the services.

PoliticianThey recommend for text messages, avoiding SMS and instead using encrypted messaging services such as Apple’s (AAPL) iMessage, Facebook‘s (FB) WhatsApp or the many others available will allow you to send and receive instant messages without having to go through the SMS network to protect your messages from surveillance.

For calls, the Guardian recommends using a service that carries voice over data rather than through the voice call network. This will help prevent your calls from being snooped on. Messaging services including WhatsApp permit calls. Silent Circle’s end-to-end encrypted Phone service or the open-source Signal app also allow secure voice communications.

protect yourself Your location could be being tracked at any stage when you have your mobile phone on. The only way to avoid it is to turn off your phone or turn off its connection to the mobile phone network and rely on Wi-Fi instead.

Related articles

Ralph Bach has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.

BYOD Obsoletes PBX

BYOD Obsoletes PBXFierceMobileIT noted a new study from RingCentral, a provider of cloud business communications systems, which claims BYOD is now threatening the traditional business phone systems. The survey of 309 professionals within organizations who make purchasing decisions on phone systems found that personal mobile devices are so prevalent in the workplace that they are rendering traditional business phone systems obsolete.

cloud business communications systemsAccording to FierceMobileIT, the survey’s key findings:

  • Half of respondents use mobile phones even while sitting at their desk, with a traditional desk phone in front of them
  • 88 percent of employees use their mobile phones for work purposes while on personal time, including evenings, breaks, weekends and vacations
  • 70 percent of respondents believe office phones will eventually be replaced by mobile phone – Millennial workers are especially likely to believe this is true

RingCentral President David Berman told the author he believes that the new wave of employee owned mobile devices are better than a premise based phone system.

Mobile devicesMobile devices are turning into true business tools and are transforming the workplace as a whole, from shifting traditional business hours to changing how employees interact via voice, video, text and other business applications. We believe that all these changes are making legacy on-premise phone systems obsolete as they do not meet modern business needs

Praful Shah, RingCentral’s VP of strategy, told FierceMobileIT that his firm has seen a “tremendous behavior change going on with BYOD.” Asked what stood out in the research to him, he says it was the degree to which employees are using their personal devices to do work. He assumed the practice to be popular, but not to the degree the survey revealed. VP Shah noted;

Eighty-eight percent of employees are using mobile phones in their personal time for work. That is a phenomenally high percentage

Traditional business phone systemsThe result is a shift in what physical telephones organizations will  need to purchase. But it will also impact the need to provide applications that enable the employee to use multiple email and telephone accounts on the device, to keep private life and professional life separate when necessary.


This study is from a firm who sells a competitive product to on-premise PBX, so they are spreading FUD for their benefit. Firms considering cloud based services should do due-diligence and question how these could based service providers are going to protect their data from government spying or it disappearing with little or not notice.

Additionally firm needs to protect its own data. They need a way to protect their data on an employees phone. That could include the ability for to completely wipe the firms and the users data from the phone.  I wrote about how BYOD can land an employee in jail here.


Employees Cutting the Corporate Cord With Smartphones: Infographic



Ralph Bach has been in IT for fifteen years and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me at Facebook and Twitter. Email the Bach Seat here.



Converting from Centrex to a PBX

Something to be aware of as you plan a migration from Centrex to PBX or VoIP. There is a potential that if the customer does not use the phone system that the LEC sells, the LEC may charge the customer for the in-house wiring.  There have been cases where the LEC was seeking over $100,000 for the wiring after the customer switched.

In some areas, regulators have allowed the LEC to carry some OSP (Outside Plant Cables) on the regulated side of the books so some projected accounting value minus the depreciation would need to be recovered by the LEC if the customer were to leave the LEC. OSP has a life expectancy of 25 years or more, especially in environmentally protected locations such as equipment rooms.

A general rule of thumb is if he cable is black jacketed it is OSP. If the cable is gray or beige it is Inside Wire or cable such as riser. In some states, at the time of the ATT break up and there after black jacketed cable is still carried on the LEC’s books while gray jacket is expensed. However, the customer should talk to the LEC OSPE (Outside Plant Engineer) as soon as possible to determine your specific situation.

The OSPE may want the customer to buy the then risers and black jacket, which may include 50-year-old black jacket, a mixture of Paper & Lead (a method of insulating conductors using paper pulp and covering in a lead jacket) as well as more current PIC (Plastic Insulated Cable).

An option would be to rebuild the complex, which could be less expensive and easier than negotiating with the OSPE to take over 50 year infrastructure which will never support any modern high-speed services.

Rebuilding the infrastructure also provides an opportunity to turn the tables on the LEC. With their own infrastructure it is possible for the Owner to tell the LEC vacate the building since they no longer provide service beyond the MDF. Maybe this is your opportunity to link the buildings with fiber and replace older copper that while it is in good shape (having been inside most of its life).Another tactic would be to convince the Telco into certifying that they had “abandoned the cable in place”. If the LEC has installed the infrastructure if they want to claim ownership to the cable then they would be responsible for removing the cable as is required by state/local building codes. In many areas, if a cable is not terminated on both ends then it is considered to be abandoned and must be removed. Removing cable is almost as expensive as installing it.

Another advantage Owners may have is that the LEC is the Centrex provider and the PBX deployment still represents an opportunity for DS-1, DS-3 and trunks sale. Another lever would be to keep a small Centrex as a backup, as part of a business continuity plan as well as ISDN services to remote locations.

One consideration is that when taking over the cable plant the LEC will have to deal with the fact that there may be customers within the facilities that were not part of the enterprise and which were customers of the LEC. We ended up having to sign a “Shared Sheath” or condominium agreement with the owner. The condominium agreement will let the LEC support their customers on the Owners riser system. The Owner will have to provide a technician to assist the LEC in mapping out cable pathways for their customers.

IP PBX to VoIP Network Interface Specified

A draft document that proposes a series of best practices to optimize the interconnection and interop between IP PBX‘s and VoIP service providers has been proposed by Cbeyond with support from Cisco (CSCO) and Avaya among others

Charlotte Wolter, IP PBX to VoIP Network Interface Specified, Phone+, April 2005, p.48