4 ms·

SS7 is broken beyond repair, infact it being a walled garden is the only security it ever had. This ccc talk is a good intro - https://media.ccc.de/v/31c3_-_61

by dbalan 10y ago

SS7 is broken beyond repair, infact it being a walled garden is the only security it ever had. This ccc talk is a good intro - https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271830_-_mobile_self-defense_-_karsten_nohl https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271...

bogomipz 10y ago
SS7 is not broken at all. It's an extremely robust protocol thats been around forever. It was designed to work in the closed Bell system not designed for an idea 40 years in the future. Its not uncommon for an SS7 gateways to have 6 9's of uptime. Yes 6. There is nothing broken about it.
- nickpsecurity 10y ago
  Oh I disagree. High-security engineer Clive Robinson has been writing online about SS7 and similar protocols risks for years. In posts like this... https://www.schneier.com/blog/archives/2015/08/ss7_phone-switc.html#c6703762 https://www.schneier.com/blog/archives/2015/08/ss7_phone-swi... ...he points out that telecom and spy agencies were very tight in U.K. (and often U.S.). Many features that benefit spying are there on purpose. As he predicted, they continued to be a problem in upgrades due to the compatibility argument and downgrade attacks following. Worst, certification or connection to a major wireless standard might force you to include weak crypto or security in your product. It's all crap in terms of security. Sure they're reliable... amazingly so in some cases... but they're not secure and that's on purpose.
  - tptacek 10y ago
    The parent commenter isn't claiming that SS7 is secure. Nobody thinks it is.
    - nickpsecurity 10y ago
      I may have misread it. The subject is SS7 security and here's the parent comment: "broken beyond repair... infact it being a walled garden is the only security it ever had." bogomipz countered with how robust the protocol is. Your critique is true if bogomipz was only countering the words "broken beyond repair" with no context. In context, though, the counter would imply disagreement with the security claim. "isn't claiming that SS7 is secure. Nobody thinks it is." Hopefully true. :)
- lorenzhs 10y ago
  dbalan was referring to its security, while you appear to be arguing for its robustness, which is beside dbalan's point.

by dbalan 10y ago

bogomipz 10y ago

SS7 is not broken at all. It's an extremely robust protocol thats been around forever. It was designed to work in the closed Bell system not designed for an idea 40 years in the future. Its not uncommon for an SS7 gateways to have 6 9's of uptime. Yes 6. There is nothing broken about it.

nickpsecurity 10y ago
Oh I disagree. High-security engineer Clive Robinson has been writing online about SS7 and similar protocols risks for years. In posts like this... https://www.schneier.com/blog/archives/2015/08/ss7_phone-switc.html#c6703762 https://www.schneier.com/blog/archives/2015/08/ss7_phone-swi... ...he points out that telecom and spy agencies were very tight in U.K. (and often U.S.). Many features that benefit spying are there on purpose. As he predicted, they continued to be a problem in upgrades due to the compatibility argument and downgrade attacks following. Worst, certification or connection to a major wireless standard might force you to include weak crypto or security in your product. It's all crap in terms of security. Sure they're reliable... amazingly so in some cases... but they're not secure and that's on purpose.
- tptacek 10y ago
  The parent commenter isn't claiming that SS7 is secure. Nobody thinks it is.
  - nickpsecurity 10y ago
    I may have misread it. The subject is SS7 security and here's the parent comment: "broken beyond repair... infact it being a walled garden is the only security it ever had." bogomipz countered with how robust the protocol is. Your critique is true if bogomipz was only countering the words "broken beyond repair" with no context. In context, though, the counter would imply disagreement with the security claim. "isn't claiming that SS7 is secure. Nobody thinks it is." Hopefully true. :)
lorenzhs 10y ago
dbalan was referring to its security, while you appear to be arguing for its robustness, which is beside dbalan's point.