The Critical Hole At the Heart Of Our Cell Phone Networks (wired.com)

An anonymous reader writes: Kim Zetter from WIRED writes an intriguing report about a vulnerability at the heart of our cell phone networks. It centers around Signaling System No. 7 (SS7), which refers to a data network -- and the protocols or rules that govern how information gets exchanged over it. Zetter writes, "It was designed in the 1970s to track and connect landline calls across different carrier networks, but is now commonly used to calculate cellular billing and send text messages, in addition to routing mobile and landline calls between carriers and regional switching centers. SS7 is part of the telecommunications backbone but is not the network your voice calls go through; it's a separate administrative network with a different function." According to WIRED, the problem is that SS7 is based on trust -- any request a telecom receives is considered legitimate. In addition to telecoms, government agencies, commercial companies and criminal groups can gain access to the network. Most attacks can be defended with readily available technologies, but more involved attacks take longer to defend against. T-Mobile and ATT have vulnerabilities with fixes that have yet to be implemented for example.

Comments

This is not the Hole you are looking for

[TheRealHocusLocus]

Geez... IF ONLY the ability to hack into the signalling network and make some free calls was the worst of our problems. What a wonderful world that would be.

How about... the fact that you are probably within a thousand feet of a cell tower that is too bloody stupid to connect your cell phone with your neighbor's cell phone? How we made a transition over the last couple of decades from a Bell Standard Practice of completely autonomous wired phone systems in hardened buildings, each with the capability to provide complete functionality and call completion to its area served so long as you keep a single generator running... and if your neighboring cities or counties keep the generators their buildings running, you can call them too...

To a cell phone patchwork abortion of distributed virtual networks. Now, depending on the size of your state, instead of dozens there are hundreds, even thousands of emergency generators that must keep running if grid power fails, some on towers that are necessary to connect the edge networks with a fragile few, centralized CO/HLR platforms to handle roaming and billing, which may be hundreds of miles and several hops away. As one AC in the linked thread says, "A large wireless carrier for example has three switches for the entire state. What that means is if that central switch goes down, you cannot call people local to your area/CO."

So to describe it in layman's terms, if you wanted to complete a call on a Bell network the answer was FUCK YEAH, so long as it didn't have too many different digits. For cell phones the answer is FUCK NO BY DEFAULT unless a deliciously complicated procedure involving connectivity and negotiation to distant computers completes quickly and successfully. This system was built out by telecommunications engineers making a series of decisions. Each decision made the system more fragile, and they kept making them for years. It was always someone else's job to look at the whole and say, "Well sheeit. This is a whole lot stupider than the system it is replacing, if something bad happens." And that someone else never showed up for work. These engineers were all grown-ups, but their collective decision was infantile.

So enjoy your 2G and your 3G and your 4G while it lasts. Dance on Ma Bell's grave and laugh at those gutted terminal boxes in your neighborhood with their covers off, raindrops dripping off the rainbow of copper wires going nowhere. But unlike the 'dark ages' of the 1970s,should something should go wrong and the power goes out and it becomes critical for communities to communicate with one another, it's all the way back to Pony Express, baby. Better gas up yer horse.