SS7 protocol concerns intensifying: security expert

Despite recent calls to limit encryption by some government officials and intelligence heads worldwide, the use of end-to-end encryption may help alleviate security concerns related to a decades-old mobile network infrastructure known as Signalling System 7 (SS7), which in recent months has been the subject of security vulnerabilities exploited by hackers. “The vulnerability has not changed; it is the same as it has been for years,” Carlisle Adams, a cryptography and network security professor at the University of Ottawa, said in an email. “But now that it has been more widely publicized, and especially now that it has been exploited for real, the urgency has increased.” In May, telecom O2 of Telefonica UK Ltd. in Germany reported that people exploiting the SS7 protocol intercepted customers’ two-factor authentication codes sent by their banks, effectively allowing the attackers to drain their accounts, according to a report by technology publication The Register, which called it the “first publicly confirmed attack.” Adams said that more hackers are now aware of these vulnerabilities and may seek to get in on the exploit. A recent report by the Verge noted that a website was offering access to the telecoms’ SS7 networks for $500 a month. Initially designed for roaming, the SS7, which pre-dates mobile phones, is a global backend protocol that connects operator networks with each other within a country and between countries, Siddharth Prakash Rao, a PhD candidate at Aalto University in Finland, who has worked with security research groups, said in an email. It has since stood the test of time and adapted to the introduction of mobile phones and short message services (SMS), Rao added. Now hackers, sometimes with inside access to the telecom’s networks, can use it to locate users and read, listen and intercept communications. “Canadians should be concerned about the vulnerability reported in the SS7 protocol,” Benjamin Fung, Canada research chair in data mining for cybersecurity at McGill University, said in an email. “The same security holes may be found in Canada’s mobile network.” But Fung noted that the vulnerability is not a flaw, but a feature that allows for roaming and therefore it can’t be easily patched. The way it works is the SS7 identifies, authenticates and registers the user when a phone is turned on. Before a call is made, a further check is made to ensure the phone is not stolen and gets permission to place the call. The network must track the user to deliver the call and maintain the connection, according to a Cisco Systems Inc. book called System No. 7: Protocol, Architecture, and Services. Access to the SS7 can be obtained through methods including attacking “network operator equipment left unsecured on the Internet, gaining access through femtocells, or simply purchasing access from a phone operator,” noted an April report on mobile device security prepared by the U.S. Department of Homeland Security for the U.S. Congress. The report also noted that the SS7 vulnerabilities “can be exploited by criminals, terrorists, and nation-state actors/foreign intelligence organizations.” The publicity surrounding the vulnerability — which includes calls in March by a U.S. senator and congressman asking Homeland Security and the Federal Communications Commission (FCC) to address the issue — and the May attack come amid calls by other government officials to limit encryption because it has frustrated investigations, notably in terror-related cases. Late last month, United Kingdom home secretary Amber Rudd suggested "real people" who use messaging apps like Facebook Inc.’s WhatsApp are not that interested in end-to-end encryption. She suggested a way for the government to read specific messages, something that kind of encryption doesn't allow. In March, she called for cooperation from communications companies in the wake of terror attacks outside the British houses of parliament and said such messaging services shouldn't be a place for terrorists to hide. In June, tech giants including Facebook, Microsoft Corp., Twitter Inc. and Alphabet Inc.’s YouTube established a coalition to combat terrorism. In the same month, a group of intelligence agencies known as the Five Eyes, which includes Canada, the U.S. and the U.K., suggested in a meeting that encryption “can severely undermine public safety efforts by impeding lawful access” to communications content needed for investigations. Civil society groups came out and reinforced their support for the privacy measure in response. But end-to-end encryption has been identified as a saving grace to help insulate users from the SS7’s vulnerabilities, at least in the short term. “Perhaps the best short-term solution is simply for users to choose end-to-end encryption services,” Adams said. Though while Fung agreed that end-to-end encryption “will help protect the message contents,” it won’t help with metadata, which discloses who is talking to whom and at what time. Moreover, over-the-top (OTT) messaging services still require SMS to verify the user initially. “If a hacker can intercept or redirect the messages, then they may be able to impersonate a user for fraudulent purposes,” Fung said. However, Fung added that because SMS and emails are not secure channels for communications, users should still consider using encrypted email tools and end-to-end encryption to protect their messages. In fact, a recent report by tech publication Wired, citing researchers, said adding encryption to SS7 would address long-term SS7 issues by protecting network traffic and strengthening authentication. Adding to the calls for more encryption, a March report by the U.S.’s Communications Security, Reliability and Interoperability Council (CSRIC) “urges the FCC to take action against network operators that refuse to tackle the issue. It warns the American public that they may be at risk, and says the FCC should set up programs to encourage people to use end-to-end encryption — which is one of the CSRIC’s key recommendations.” The result of that increased use could also further hurt the telecoms in another way. A January Juniper Research study found that the growth of, and migration to, OTT messaging services will cost global mobile network operators over a hundred billion dollars this year. The CSRIC report also wades into the debate around possible fixes, including the switch to another protocol. “Some have said that shifting to 5G networks will fix the problem by replacing SS7 with the Diameter protocol,” used in the long-term evolution (LTE) networks. “But the CSRIC report concludes that there are also serious security issues with Diameter and researchers have shown it's similarly vulnerable to attack as SS7,” the report added. Adams agreed that the Diameter protocol has “similar vulnerabilities and so is not necessarily a solution.” Rao doesn’t believe advancements in LTE will help Canada or other countries move past the SS7 vulnerabilities. Because the SS7 is an interconnection protocol, and so long as just one network is vulnerable, the rest of them would be vulnerable, too, he said. But this is not the first time interception and surveillance technology has been used before. A report in June of last year found that the RCMP has been using ‘stingray’ technology, or IMSI catchers, for the past decade. But whereas with stingrays, the users have to be in the vicinity for them to be effective, an SS7 exploit can be done remotely, Rao said, calling it a “military of the stingrays on steroids.” When reached over email for comment, the department of Innovation, Science and Economic Development (ISED) said it works with telecoms through the Canadian Security Telecommunications Advisory Committee (CSTAC) on risk management of telecom infrastructure in Canada. “A variety of evolving threats and vulnerabilities, including those from SS7 protocol, are discussed in the course of information exchange with a view to inform industry best practices in Canada and the cyber resilience of Canada’s critical telecom infrastructure,” Sabrina Foran, media relations and parliamentary affairs officer, said in the email. She added while ISED can’t comment on the specifics of SS7 vulnerabilities, the approach taken by CSTAC is a “continuous process” that is viewed on an “ongoing basis.” Meanwhile Tobi Cohen, spokeswoman for the office of the privacy commissioner, said in an email that they are aware of the issue through media reports “but we have not examined this vulnerability.” A separate July Wired article noted that a potential cure for the issue is the implementation of firewalls and filters “that scrutinize SS7 requests more closely instead of blindly fulfilling any query from anywhere,” but those efforts haven’t been deployed widely. For Adams, more pressure may need to be thrust on the telcos to fix the vulnerability, “or at least to do more extensive network monitoring so that such exploits can be found and stopped in real time.” BCE Inc. spokeswoman Jacqueline Michelis said in an email that the company is an active participant on CSTAC and regularly reviews the security controls it uses and monitors emerging threats to identify new controls, including developing plans related to SS7 vulnerabilities. For its part, Telus Corp. is also aware of the issue and does “periodic validations of the risk and potential use of SS7 features,” company spokesman Richard Gilhooley said in an email, adding the company is partnering with industry peers and the government to “evaluate any avenues for exploration.” Rogers Communications Inc. did not respond to a request for comment. Fung, for his part, said that perhaps governments and telecoms should “look into developing a new standard protocol to replace SS7.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

SS7 protocol concerns intensifying: security expert

News | August 8, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

SS7 protocol concerns intensifying: security expert

News | August 8, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Privacy commissioner seeks court order against Pornhub parent company

Privacy Commissioner investigating Elon Musk’s X platform

Meta’s content moderation changes highlight challenges for Canadian digital regulation

Four cyber bills dead on the order paper as Parliament prorogued

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us