June 27, 2018 By Grant Gross 3 min read

It’s the mobile vulnerability that won’t go away: Security concerns about Signaling System 7 (SS7), a set of four-decade-old telephony signaling protocols, have flared up in recent weeks after a U.S. senator reported that an unnamed mobile carrier had been breached.

Mobile security experts have long recognized vulnerabilities in the SS7 protocol, which can enable cybercriminals to gain access to smartphones’ data, locations, calls and texts.

On May 29, 2018, Sen. Ron Wyden wrote in a letter to the Federal Communications Commission (FCC) that SS7 is “riddled with long-standing cybersecurity vulnerabilities that pose a major national security threat.” Criminals and foreign governments can use SS7 vulnerabilities to “prey on unsuspecting consumers,” Wyden wrote.

Wyden had previously raised his concerns with Christopher Krebs, the president’s nominee for Undersecretary of the National Protection and Programs Directorate (NPPD) within the Department of Homeland Security (DHS). In a May 22, 2018 letter to Wyden, Krebs acknowledged that threat actors might have exploited SS7 to target U.S. residents’ communications.

Government and Industry Players Address the SS7 Flaw

According to Ian Eyberg, CEO of virtual machine vendor NanoVMs, cybercriminals have been targeting SS7 for 25 years.

“There are companies that sell cell tracking packages based on SS7 flaws — that’s how bad it has gotten,” Eyberg said. “What’s disturbing is that year after year, security researchers find more and more things wrong with the protocol.”

While Wyden is pushing the FCC and DHS to address SS7 flaws, some influential players in the mobile industry have already moved to protect against smartphone attacks. CTIA, a U.S. trade group representing carriers, worked with the FCC on SS7 vulnerabilities following a 2016 “60 Minutes” special that detailed how cybercriminals can track phone owners and intercept calls and text messages.

U.S. mobile operators have endorsed several FCC recommendations, including monitoring and filtering signaling interconnections.

“The wireless industry is committed to safeguarding consumer security and privacy and collaborates closely with the DHS, FCC and other stakeholders to combat evolving threats that could impact communications networks,” a CTIA spokesman said.

Attacks Persist Despite Better Mobile Security Tools

Many mobile security experts still see avenues of attack, however. Positive Technologies, a security monitoring firm, found that a whopping 100 percent of SS7-based SMS interception attacks that took place on European and Middle Eastern mobile phone networks during 2016 and 2017 were successful.

“Virtually every network allowed eavesdropping on conversations and reading incoming text messages,” the company asserted in a March 2018 press release accompanying the report. “Use of SMS for two-factor authentication means that if a hacker is able to access a subscriber’s text messages, they can go on to compromise accounts for online banks, stores, government services and much more.”

The researchers noted a decrease in successful SS7-based attacks between an earlier study in 2015 and 2017. This drop could be due to the proliferation of ready-made mobile security solutions in the market, they suggested. Still, all of the mobile networks studied in 2017 were susceptible to SS7-based attacks looking for subscriber information, subscriber traffic interception and subscriber denial-of-service (DoS) attacks.

How Can Consumers Protect Themselves?

According to Dan Tara, executive vice president of Positive Technologies, there are no significant actions mobile customers can take.

“Attacks on the SS7 network are conducted from the outside and are aimed at extracting or modifying data in the network devices of the operator infrastructure,” Tara said. “Subscribers cannot resist these attacks in any way because they’re outside of the SS7 network perimeter.” Instead, carriers must embrace comprehensive security protections, including SS7 firewalls, he said.

Eyberg agreed that the problem is largely within the purview of mobile carriers, but customers can also help by embracing encryption, he said.

“Short of [carriers] adopting new protocols, consumers can use encrypted chat and encrypted voice applications,” Eyberg added. “However, that is not always an option for things like one-time passwords from your bank.”

Eyberg also noted that customers should pay attention when their carriers are compromised.

“I think the best individuals can do is map out the irresponsible carriers and vote with their pockets,” he said.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today