4 ms·

> This is actually apples and oranges. You are making a distinction without a difference here. The ss7 network has been known to be broken forever, and all th

by woodman 11y ago

> This is actually apples and oranges. You are making a distinction without a difference here. The ss7 network has been known to be broken forever, and all the carriers sell their customer's historical data - so the Italians could have applied the same technique anywhere in the world. > ...automated co-traveler inference... That is exactly what they did, only instead of protecting in real time they ran models after the fact. Real time would actual be easier, because instead of dealing with the carrier - you just poll the ss7 network. There is nothing novel about the tracking methods, the inference, or the combination of the two.

rl3 11y ago
NSA's setup isn't simply SS7 though, and it's probably entirely passive at that.[0] They operate on an industrial scale and have every facet down to a science. Granted, field operatives who carry active cellphones with them while conducting a tail are probably bad at their job to begin with, so you're probably right in that the damage isn't much. [0] https://www.washingtonpost.com/news/the-switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships-based-on-mobile-location-data/ https://www.washingtonpost.com/news/the-switch/wp/2013/12/10...
- woodman 11y ago
  Well it can't be entirely passive for time-sensitive/comprehensive monitoring, because telemetric data won't cross one of their numerous tap points unless the target is roaming or the target's carrier is being queried by a roaming partner (or partner of a partner of a...). I'm sure they've got taps inside of major carriers, but I doubt they're inside every network. Considering how regularly ss7 is abused for criminal/commercial activity, they may not have to do much active probing for intra-network monitoring - but the barrier to entry is so low that it would be silly for them not to front a carrier with direct access. I can accept the excuse that ss7 was designed for a world with a few trusted carriers, but the latest stuff (that isn't even backwards compatible) has the exact same class of security flaws. The only rational explanation for the obviously insecure standard defining LTE RRC connection setup (base station control, no mutual auth, no crypto, identifying info in the clear - often with lat/lon) is intentional design. So the argument that the leak had any operational impact sounds pretty silly to me, but I won't deny that it caused serious embarrassment to people who really don't take criticism well.

by woodman 11y ago

rl3 11y ago

NSA's setup isn't simply SS7 though, and it's probably entirely passive at that.[0] They operate on an industrial scale and have every facet down to a science. Granted, field operatives who carry active cellphones with them while conducting a tail are probably bad at their job to begin with, so you're probably right in that the damage isn't much. [0] https://www.washingtonpost.com/news/the-switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships-based-on-mobile-location-data/ https://www.washingtonpost.com/news/the-switch/wp/2013/12/10...

woodman 11y ago
Well it can't be entirely passive for time-sensitive/comprehensive monitoring, because telemetric data won't cross one of their numerous tap points unless the target is roaming or the target's carrier is being queried by a roaming partner (or partner of a partner of a...). I'm sure they've got taps inside of major carriers, but I doubt they're inside every network. Considering how regularly ss7 is abused for criminal/commercial activity, they may not have to do much active probing for intra-network monitoring - but the barrier to entry is so low that it would be silly for them not to front a carrier with direct access. I can accept the excuse that ss7 was designed for a world with a few trusted carriers, but the latest stuff (that isn't even backwards compatible) has the exact same class of security flaws. The only rational explanation for the obviously insecure standard defining LTE RRC connection setup (base station control, no mutual auth, no crypto, identifying info in the clear - often with lat/lon) is intentional design. So the argument that the leak had any operational impact sounds pretty silly to me, but I won't deny that it caused serious embarrassment to people who really don't take criticism well.