Bach Seat

There is a vulnerability in the global phone system. The flaw allows hackers to access telephone data using nothing but a phone number. The flaw is in the Signaling System 7 (PDF) or SS7. SS7 is a set of telephony signaling protocols that exchanges information on telephone networks.

The Register points out that SS7 signaling technology was developed in the 1970s. It hasn’t been updated, since the systems became accessible over the internet. The weakness in SS7 allows hackers or TLA’s to exploit the vulnerability with the phone number of the user they’re targeting. The flaw allows them to listen to phone calls, read text messages and track the user’s location.

The SS7 flaw

A white paper (PDF) by independent cyber-security company Positive Technologies explains.

The process of placing voice calls in modern mobile networks is still based on SS7 technology which dates back to the 1970s. At that time, safety protocols involved physical security of hosts and communication channels, making it impossible to obtain access to an SS7 network through a remote unauthorized host. In the early 21st century, a set of signaling transport protocols called SIGTRAN were developed. SIGTRAN is an extension to SS7 that allows the use of IP networks to transfer messages.

However, even with these new specifications, security vulnerabilities within SS7 protocols remained. As a result, an intruder is able to send, intercept and alter SS7 messages by executing various attacks against mobile networks and their subscribers.

The real-world result of the SS7 flaw as Alex Mathews, technical manager EMEA of Seoul Korea-based Positive Technologies explained is.

Chat applications such as WhatsApp, Telegram, and others use SMS verification based on text messages using SS7 signaling to verify the identity of users/numbers.

SMS authentication is one of the major security mechanisms for services like WhatsApp, Viber, Telegram, Facebook (FB), and is also part of second-factor authentication for Google (GOOG) accounts, etc. Devices and applications send SMS messages via the SS7 network to verify identity, and an attacker can easily intercept these and assume the identity of the legitimate user. Having done so, the attacker can read and write messages as if they are the intended recipient.

If chat history is stored on the server, this information can also be retrieved.

60 Minutes hacks SS7

The hack first came to light in 2014. Security researcher Karsten Nohl demonstrated the SS7 flaw at a convention in Germany according to FierceWireless. CBS 60 Minutes (rb- That’s still on?) caused a mild ripple after they ran a story on the flaw. The program engaged Mr. Nohl to demonstrate the vulnerability. He was able to track a new iPhone that had been given to U.S. Rep. Ted Lieu (D-CA).

Mr. Lieu, who holds a degree in computer science from Stanford, agreed to use the phone to talk to his staff knowing it would be hacked. From his office in Berlin, Mr. Nohl was able to access Rep. Lieu’s phone. He tracked the representative’s movements in Los Angeles, read messages, and recorded phone calls between Representative Lieu and his staff.

CBS correspondent Sharyn Alfonsi contacted representatives from CTIA for comment on the story. The CTIA said that there have been reports of SS7-related security breaches abroad. She stated, “… but (they) assured us that all U.S. cellphone networks were secure.” Despite the fact that Mr. Lieu was on a U.S. network when his phone was hacked from Germany.

An open secret

The flaw “is an open secret among the world’s intelligence agencies — including ours — and they don’t necessarily want that hole plugged,” Ms. Alfonsi reported. The four major U.S. wireless operators declined to discuss more specific questions from FierceWireless. When asked whether the flaw may threaten the privacy and security of subscribers, AT&T (T) and Verizon (VZ) deferred to CTIA. Sprint (S) and T-Mobile (TMUS) declined to discuss SS7.

Representative Lieu has called for a congressional investigation of the vulnerabilities in SS7. He wrote that “The applications for this vulnerability are seemingly limitless, from criminals monitoring individual targets to foreign entities conducting economic espionage on American companies to nation states monitoring U.S. government officials.” Lieu said the investigation should be conducted by the House Oversight and Government Reform Committee, of which he is a member.

Investigate the flaws in SS7

The Register reports that Senator Ron Wyden (D-OR) recently joined Representative Lieu to investigate the flaws in SS7. The pair plan to send an open letter [PDF] to Homeland Security. They want an update from Secretary John Kelly on DHS’s progress in addressing the SS7 design shortcomings. It also asks why the agency isn’t doing more to alert the public about the issue. The letter states in part:

We suspect that most Americans simply have no idea how easy it is for a relatively sophisticated adversary to track their movements, tap their calls, and hack their smartphones. … We are also concerned that the government has not adequately considered the counterintelligence threat posed by SS7-enabled surveillance.

 rb-

It is important to understand that the wired and wireless telephone network that your phone connects to is not secure. They probably never will be.

Telephone networks were not designed to be secure.

In the most recent draft of the new Digital Identity Guidelines requirements from NIST warns that:

Note: Out-of-band authentication using the PSTN (SMS or voice) is discouraged and is being considered for removal in future editions of this guideline.

You really have to wonder if this is related to the SS7 hole and why it is only being considered for removal. Maybe some of its TLA friends want the hole to stay in place.

I previously covered the SS7 flaw implications to SMS here.

Related articles

• How to Remotely Spy on Your iPhone Running iOS 10 (wccftech.com)

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.