Slashdot Mirror
Telecom Lobbyists Downplayed 'Theoretical' Security Flaws in Mobile Data Backbone (vice.com)
An anonymous reader shares a report: According to a confidential document obtained by Motherboard, wireless communications lobby group CTIA took issue with an in-depth report by the Department of Homeland Security on mobile device security, including flaws with the SS7 network. In a white paper sent to members of Congress and the Department of Homeland Security, CTIA, a telecom lobbying group that represents Verizon, AT&T, and other wireless carriers, argued that "Congress and the Administration should reject the [DHS] Report's call for greater regulation" while downplaying "theoretical" security vulnerabilities in a mobile data network that hackers may be able to use to monitor phones across the globe, according to the confidential document obtained by Motherboard. However, experts strongly disagree about the threat these vulnerabilities pose, saying the flaws should be taken seriously before criminals exploit them. SS7, a network and protocol often used to route messages when a user is roaming outside their provider's coverage, is exploited by criminals and surveillance companies to track targets, intercept phone calls or sweep up text messages. In some cases, criminals have used SS7 attacks to obtain bank account two-factor authentication tokens, and last year, California Rep. Ted Lieu said that, for hackers, "the applications for this vulnerability are seemingly limitless."
So why spend a cent to fix the issue. The free market is the best! It fixes everything. I'll just go to the carrier who fixes it. Oh wait, this is collective bargaining. No one fixes it and there is no where to go.
... gonna be cheap.
Anons need not reply. Questions end with a question mark.
Cutting security with the added bonus of charging more for enough for even basic functionality is not only profitable but makes the more crooked subcontractor "hacking" them a minimal expense as well.
Doubt the authenticity of that document.
One man's security flaw is another man's way to implement Stingray?
Why the extreme secrecy about Stingray? A couple thoughts on that.
The digital cell phone system was designed when we were using Windows 3.1. The system cannot withstand 21st century attacks. There must be some fundamental weakness in the way the network operates. This cannot be corrected without significant changes throughout the network base stations and mobile equipment. Thus it is expensive and time consuming to fix over a generation or more of equipment. This vulnerability may be the very basis of how Stingray works. If the secret got out, chaos would ensue. Everyone would be building their own Stingray devices. Poor people would be spying on rich people. Therefore we see security through obscurity of the vulnerability. Thus secrecy is paramount above all else including prosecutions. How this works can never be disclosed in open court, not even under the belly of a court ordered seal. The stakes are just too high.
Another theory. Stingray involves the illegal use of stolen credentials, keys, code or other information, or violation of an NDA. Therefore Stingray itself is illegal. Use and possibly even possession of Stingray may itself may run afoul of the law. Possibly if the secret of Stingray's operation got out, it might reveal, down to a small group of individuals who stole what, or who colluded with who.
For the two foregoing reasons, don't expect Stingray to see the light of day. That is why police can't even disclose that they have, let along use Stingray. Stingray is so secret that they will let proven criminals go free rather than use Stingray evidence in court. Or they will engage in "parallel construction" to avoid disclosing Stingray. (eg, Parallel Construction: a conspiracy of the prosecution and law enforcement to commit perjury and lie to the court about what their evidence actually is and how the investigation was conducted. Withholding this vital information from the defense.)
I'll see your senator, and I'll raise you two judges.
of course they down play it and label them as theoretical.. that is the lobbyist's job!
I mean they would actually lose their jobs if they didn't try to spin anything that came out that remotely related to the telco's. Not a single one of those companies that are represented by the lobbyists want anyone looking into how they operate with any detail, that way they can try to get away with as much slight of hand as possible and then offer up an apology when they get caught.
Lobbyists are nothing more than a marketing department for corporations that are geared towards policy makers, they are specifically used to spin things so that the policy makers think a certain way. This makes sense as they arent trying to sell things to the policy makers but trying to legalize how the companies work or at the very least distract and confuse them.
In this case it wouldn't really make a difference as most policy makers are technologically illiterate and wouldn't understand the severity of the problem if it was actually explained to them.
TL, DR: lobbyists do what lobbyists are paid to do, news at 11
Then they won't mind accepting unlimited and uncapped liability?
SS7 networks are internal, you cannot get to them from the internet and you cannot insert transactions into them. They do not carry voice and they are not even used with LTE and VoIP. They only get used with CDMA and GSM.
This "vulnerability" has always been just advertisement and politics. It has never had any relation to the real world.
According to a confidential document obtained by Motherboard
Risk is a slippery customer.
Those highlighting the potential risks aren't financially motivated. Those required to spend money to resolve the issues have a vested interest in playing down the risks.
This nicely encapsulates one of the main issues facing corporations everywhere.
The real trick is avoiding all the obfuscation and misdirection.
'Theoretical' Security Flaws
I think the NSA has a whole department for these.
It must have been something you assimilated. . . .
If people who are paid to lie and spread misinformation for rich people say that it's nothing to worry about, then it must be true.
For the last fileSytemChecking time! SS7 IS NOT a "Mobile Data Backbone"
SS7 is a SIGNALING protocol. Think of ICMP+OSPF+BGP... this is used for the "Switches" in the telecom network to coordinate among themselves, and NOT to carry data (unless you consider SMSs data). Very important, yes. I'd dare say critical. But, Mobile Data Backbone... NO!
Call it something other than Mobile Data BackBone.
*** Suerte a todos y Feliz dia!