How a 40 Year Old Mobile Security Flaw Puts Consumers at Risk

[upnorth]

It’s the mobile vulnerability that won’t go away: Security concerns about Signaling System 7 (SS7), a set of four-decade-old telephony signaling protocols, have flared up in recent weeks after a U.S. senator reported that an unnamed mobile carrier had been breached. Mobile security experts have long recognized vulnerabilities in the SS7 protocol, which can enable cybercriminals to gain access to smartphones’ data, locations, calls and texts. On May 29, 2018, Sen. Ron Wyden wrote in a letter to the Federal Communications Commission (FCC) that SS7 is “riddled with long-standing cybersecurity vulnerabilities that pose a major national security threat.” Criminals and foreign governments can use SS7 vulnerabilities to “prey on unsuspecting consumers,” Wyden wrote.

Wyden had previously raised his concerns with Christopher Krebs, the president’s nominee for Undersecretary of the National Protection and Programs Directorate (NPPD) within the Department of Homeland Security (DHS). In a May 22, 2018 letter to Wyden, Krebs acknowledged that threat actors might have exploited SS7 to target U.S. residents’ communications. According to Ian Eyberg, CEO of virtual machine vendor NanoVMs, cybercriminals have been targeting SS7 for 25 years.

“There are companies that sell cell tracking packages based on SS7 flaws — that’s how bad it has gotten,” Eyberg said. “What’s disturbing is that year after year, security researchers find more and more things wrong with the protocol.” While Wyden is pushing the FCC and DHS to address SS7 flaws, some influential players in the mobile industry have already moved to protect against smartphone attacks. CTIA, a U.S. trade group representing carriers, worked with the FCC on SS7 vulnerabilities following a 2016 “60 Minutes” special that detailed how cybercriminals can track phone owners and intercept calls and text messages.

Many mobile security experts still see avenues of attack, however. Positive Technologies, a security monitoring firm, found that a whopping 100 percent of SS7-based SMS interception attacks that took place on European and Middle Eastern mobile phone networks during 2016 and 2017 were successful.

How a 40-Year-Old Mobile Security Flaw Puts Consumers at Risk