SS7: The Backdoor That Nobody Closed
SS7 is a 50-year-old protocol that routes every mobile on the planet.
After decades of mobile phone development and plenty of money spent on the tech, you’d think that if we didn’t have this whole security thing sorted out yet, we must be getting pretty close. So when most people find out that the global backbone of the mobile network is run by a fifty-year-old protocol that is inherently insecure, it typically comes as quite a surprise.
Today, we’ll be checking out the history and story of SS7. We’ll be covering a display at the Chaos Computer Congress, and look at a US politician whose communications were intercepted with no warrant and no awareness of what was happening.
The juiciest part is when we cover WHY a fifty-year protocol with known weaknesses is still an essential part of the landscape today.
Background
It would be 2014 when a German security researcher would take to the stage in Hamburg for the Chaos Computer Congress convention. The display offered to intercept any communications from a nominated device. Naturally, a mobile telephone number for a sitting politician would be provided.
A call would be placed from California. It would be intercepted in Berlin, with the politician unaware that the capture had even occurred until he was later shown the recording.
This was not malware. It was not an exotic zero-day that had been saved for a purpose. It was a 1975-era telecommunications protocol whose problems had been known since at least 2008.
Rather than fixing it, it would be exploited for intelligence and surveillance purposes. And to understand why, we have to go back decades, to a different time, with a different attitude towards security.
We all carry smartphones. But in-depth knowledge of how switching, routing and management protocols work is limited knowledge. Source: Wikipedia
A Different Age
Living in an information age means that the concept of “Security By Obscurity” can seem a little foreign. But when Signalling System no 7 (SS7) was introduced, security by obscurity would be a key concept that would help underpin critical infrastructure both on the ground and in orbit.
While this approach seems positively archaic today, in the past, when information wasn’t as freely available, this would often be a valid choice. It was a different time, both in the threat models we would face and, more importantly, the technology that would be used to underpin our communications networks.
In 1975, the global telephone network was operated by a small number of large, state-backed telecommunications monopolies. AT&T in the United States. British Telecom in the UK. Deutsche Telekom in Germany.
These organisations were heavily regulated, nationally accountable, and operated within a framework of mutual trust that had developed over decades. When they needed to connect their networks to route calls across borders, they did so as trusted partners.
Protocols like SS7 would be the mechanism that enabled these cross-border calls to work seamlessly. And, it’s worth highlighting that this protocol would work at nearly every layer of a mobile device.
When you make a call, SS7 is what tells the network where the destination phone is, how to route the call to reach it, and how to set up the connection. When you send an SMS, SS7 is what delivers it. When you travel abroad and your phone registers on a foreign network, SS7 is what handles the roaming authentication that tells your home network you’re reachable.
The whole concept would work on trust over verification. Only trusted users would have access to a node, and once you had a node that was accessible, everything would fall into place.
There was no authentication between nodes. No verification of message origin. No mechanism to confirm that an instruction was legitimate before acting on it.
For more than thirty years, the trust assumption would hold. The idea of a criminal gang, hacker or private individual accessing a node would be deemed of “little operational concern”.
Then, the smartphone would hit the global market. Mobile phone usage would rapidly expand and evolve.
As the market would change in response to circumstances, so would the threat model.
How It Works
While the attacks have complicated consequences, the actual attack vectors remain pretty trivial considering the scope. To understand it, we’ll look at how the protocol works and then look to identify options for exploitation.
The protocol uses a messaging system called MAP (Mobile Application Part), to exchange information between network nodes. MAP messages handle everything from call routing to location updates to subscriber data queries. The problem is that any node on the network can send any MAP message to any other node, and the receiving node will act on it without verifying whether the sender is authorised to make that request. You don’t have to be a tech nerd or a cybersecurity specialist to understand the consequences of this.
This essentially gives us three potential attack vectors, and with it, huge insight into what a device is doing and how it is being used.
Location tracking: The easiest place to start. A MAP message designed to help the network deliver SMS messages can also return the current location of a target handset expressed as a cell tower identifier.
With a network of cell tower coordinates, that identifier can be resolved to a physical location. The request takes milliseconds. The target has no indication that it has occurred. There is no log visible to the subscriber.
Call and SMS interception: A more complex, but still achievable, attack vector. By sending MAP messages that redirect the target’s traffic through an attacker-controlled node before forwarding it to the legitimate destination, calls can be recorded, and SMS messages read without the conversation being disrupted in any way that the participants would notice.
3. Two-factor authentication bypass: In 2016, attackers used SS7 access to intercept SMS authentication codes sent by German banks, bypassing 2FA to drain customer accounts. The same year, the same technique was used as part of the attack on Bangladesh Bank’s SWIFT system, contributing to the theft of $81 million.
It’s worth mentioning that, from the security side of things, 2FA bypass is where the rubber meets the road, so to speak. While surveillance and location tracking can be damaging enough, 2FA bypass, thanks to SS7, has already caused significant financial consequences.
Zero-days can be expensive, and once used, are typically patched quite quickly. On the other hand, SS7 vulnerabilities remain reasonably cost-effective. Wholesale SS7 access has been available through grey market telecom resellers for a price point within the reach of organised criminal groups and well-resourced private investigators.
Like most things that can be commoditised, at some point, the global telecommunications infrastructure shifted from being more about communications to more about intelligence and data collection.
A very familiar problem we’ve encountered on more than one occasion.
The Demo That Changed The Dynamic
While the 2014 demonstration would establish capability, for the most part, the world wasn’t paying a huge amount of attention to this problem. For this to change, it would require a second demonstration in Australia.
If you’re interested in taking a look at the original interview, you can do so via this link. Essentially, though, journalists and politicians from Australia would join forces with global security researchers to highlight the issue by conducting real-world intercepts on targets who had given consent to being part of the experiment.
Over the course of the interview, the exploit would be explained in layman’s terms and then followed up with a real-world demonstration that would act as a proof of concept. Location hunting, SMS snooping, and call interception would all be performed as part of the interview, and it was this real-world demonstration that was helping to connect with the audience.
Interestingly enough, when questioned on the vulnerability, former Australian politician Nick Xenophon would struggle to believe it. The proof of the exploit of each of the three attack vectors from his own conversation with journalists would soon change his perspective.
Unfortunately, like we’ve seen before on other issues, the response was half-hearted and lacked coordination. Inquiries were promised in various countries, patches and solutions were proposed, but the actual delivery was void of any real substance.
It’s almost like the vulnerabilities would be a feature, not a bug.
A New Threat Model
When a threat model becomes public and attack vectors become known, usually patches are issued, and the response achieves a decline in a particular threat vector, not an increase.
However, with SS7 in the modern age, this isn’t really a solution, as there are a few nuances that help ensure that the protocol remains vulnerable.
Given that SS7 lacks strong native authentication and encryption, some methods will remain vulnerable by default, meaning that often detection is the focus rather than prevention.
It’s natural to expect that, as the mobile world has evolved to move beyond legacy systems like 2G and 3G and into a world of high-speed data, new routing protocols would not contain vulnerabilities like what we see with SS7, and sadly, in this instance, you’d be mistaken.
Diameter, the more modern protocol that was designed to perform some of the original SS7 duties, has also been found to have vulnerabilities and security researchers would also document these shortly after the protocol was introduced. While 5G has helped the situation somewhat, some legacy methods are involved in modern routing, meaning that the same exploitation pathways often exist.
It’s worth pointing out that SS7 isn’t a hack in the traditional sense. Rather, it’s that it belongs in a different age. Trust everybody and verify nothing simply does not scale in a world with bad actors that are looking to find pathways to exploitation.
Here’s an interesting point to close out on, and one you might want to ponder yourself.
Why do so many people have the keys to the back door?
Investigator515 explores the RF spectrum, cybersecurity, and the hidden tech behind modern espionage.
Follow for new content weekly
Bluesky • X • Substack
You might also like,
- OSINT Investigators Guide to Self Care & Resilience
