June 27, 2018 By Grant Gross 3 min read

It’s the mobile vulnerability that won’t go away: Security concerns about Signaling System 7 (SS7), a set of four-decade-old telephony signaling protocols, have flared up in recent weeks after a U.S. senator reported that an unnamed mobile carrier had been breached.

Mobile security experts have long recognized vulnerabilities in the SS7 protocol, which can enable cybercriminals to gain access to smartphones’ data, locations, calls and texts.

On May 29, 2018, Sen. Ron Wyden wrote in a letter to the Federal Communications Commission (FCC) that SS7 is “riddled with long-standing cybersecurity vulnerabilities that pose a major national security threat.” Criminals and foreign governments can use SS7 vulnerabilities to “prey on unsuspecting consumers,” Wyden wrote.

Wyden had previously raised his concerns with Christopher Krebs, the president’s nominee for Undersecretary of the National Protection and Programs Directorate (NPPD) within the Department of Homeland Security (DHS). In a May 22, 2018 letter to Wyden, Krebs acknowledged that threat actors might have exploited SS7 to target U.S. residents’ communications.

Government and Industry Players Address the SS7 Flaw

According to Ian Eyberg, CEO of virtual machine vendor NanoVMs, cybercriminals have been targeting SS7 for 25 years.

“There are companies that sell cell tracking packages based on SS7 flaws — that’s how bad it has gotten,” Eyberg said. “What’s disturbing is that year after year, security researchers find more and more things wrong with the protocol.”

While Wyden is pushing the FCC and DHS to address SS7 flaws, some influential players in the mobile industry have already moved to protect against smartphone attacks. CTIA, a U.S. trade group representing carriers, worked with the FCC on SS7 vulnerabilities following a 2016 “60 Minutes” special that detailed how cybercriminals can track phone owners and intercept calls and text messages.

U.S. mobile operators have endorsed several FCC recommendations, including monitoring and filtering signaling interconnections.

“The wireless industry is committed to safeguarding consumer security and privacy and collaborates closely with the DHS, FCC and other stakeholders to combat evolving threats that could impact communications networks,” a CTIA spokesman said.

Attacks Persist Despite Better Mobile Security Tools

Many mobile security experts still see avenues of attack, however. Positive Technologies, a security monitoring firm, found that a whopping 100 percent of SS7-based SMS interception attacks that took place on European and Middle Eastern mobile phone networks during 2016 and 2017 were successful.

“Virtually every network allowed eavesdropping on conversations and reading incoming text messages,” the company asserted in a March 2018 press release accompanying the report. “Use of SMS for two-factor authentication means that if a hacker is able to access a subscriber’s text messages, they can go on to compromise accounts for online banks, stores, government services and much more.”

The researchers noted a decrease in successful SS7-based attacks between an earlier study in 2015 and 2017. This drop could be due to the proliferation of ready-made mobile security solutions in the market, they suggested. Still, all of the mobile networks studied in 2017 were susceptible to SS7-based attacks looking for subscriber information, subscriber traffic interception and subscriber denial-of-service (DoS) attacks.

How Can Consumers Protect Themselves?

According to Dan Tara, executive vice president of Positive Technologies, there are no significant actions mobile customers can take.

“Attacks on the SS7 network are conducted from the outside and are aimed at extracting or modifying data in the network devices of the operator infrastructure,” Tara said. “Subscribers cannot resist these attacks in any way because they’re outside of the SS7 network perimeter.” Instead, carriers must embrace comprehensive security protections, including SS7 firewalls, he said.

Eyberg agreed that the problem is largely within the purview of mobile carriers, but customers can also help by embracing encryption, he said.

“Short of [carriers] adopting new protocols, consumers can use encrypted chat and encrypted voice applications,” Eyberg added. “However, that is not always an option for things like one-time passwords from your bank.”

Eyberg also noted that customers should pay attention when their carriers are compromised.

“I think the best individuals can do is map out the irresponsible carriers and vote with their pockets,” he said.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today