9 ms·

Cyberespionage Using SS7 via Circles

218 points by sroussey 6y ago

__jf__ 6y ago
“Using Internet scanning, we found a unique signature associated with the hostnames of Check Point firewalls used in Circles deployments. This scanning enabled us to identify Circles deployments in at least 25 countries.” Nice OSINT find!
14 6y ago
We have seen this vulnerability for years and nothing has been done to change it. Is it safe to say that is intentional? Obviously a valuable too if you want to spy on your citizens.
- LinuxBender 6y ago
  Do you mean the weakness of SS7? If so, the answer is, it would be easier to entirely build a new telco network and new cities than to overhaul the SS7 signalling network. I would have to write a book to explain the complexities (technical, bureaucratic, legal challenges). To sum up, SS7 will probably be with us in its current state long after our great great grand-children. It is best to just avoid using it if you can. POTS lines, SMS Text messages currently depend on it, but SMS could be changed to use data only if all the wireless carriers could agree to block SS7 for SMS or tear down their SMS gateways. There would need to be an agreed upon standard to re-route all the SMS messages. Landline calls and mobile to landline and mobile carrier to mobile carrier will still use SS7 for the foreseeable future and will always be vulnerable to interception. Mobile devices would have to solve this with some type of device validation, at least for mobile to mobile calls and home/business systems would need to implement that validation.
  - helios_invictus 6y ago
    A great deal of technical patching could occur in the SS7 based on lesson's learned from the Internet. But the telco's are strapped for resources and interoperability concern that this won't occur with our a massive push by a third party to support it. The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling.
    - LinuxBender 6y ago
      That idea is great, but the SS7 network was never built to even understand those concepts. Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Getting telco companies to agree to things like that is not even conceivable. It would take some international political groups to push for it. Maybe I am just jaded from my telco background, but even when an entire telco company agrees to implement a change, it rarely gets completed.
      - at-fates-hands 6y ago
        >> Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Just curious, would this mean digging up cable and other stuff which would include parts of this system you're referring to?
        LinuxBender 6y ago
        Digging should not be required in most cases. It would require replacing gear in most of the telco central offices. That probably sounds simple, but it is not. Much of this gear is ancient, most of the people that intimately understand it are no longer with us and most of the companies that made it no longer exist. The new equipment would have to be backwards compatible and run side-by-side with the old equipment for a couple decades. Many of the CO's are at physical capacity. Even if the new gear is a fraction of the size of old gear, there will be logistical issues in many places. That alone is a significant undertaking. The coordination required between telcos within countries and between countries would be significant.
    - jlgaddis 6y ago
      > The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling. SHAKEN & STIR [0] should (hopefully!) eliminate most of the issues which result from "spoofing" caller ID. From "Combating Spoofed Robocalls with Caller ID Authentication" [1]: > "[The FCC] adopted new rules requiring all originating and terminating voice service providers to implement caller ID authentication using STIR/SHAKEN technological standards in the Internet Protocol (IP) portions of their networks by June 30, 2021." -- [0]: https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN [1]: https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication
  - toast0 6y ago
    SMPP sort of fills the need for a standard way to send SMS between carriers. Although you still need to know which carrier to send it to, and have a working connection to them. I think HD voice calls can't be made over SS7? So to the extent that carriers interconnect for those (which isn't a lot, but it's more than zero), that's a parallel system too.
- sneak 6y ago
  See also: * Wifi lack of forward secrecy * SNI unencrypted * OCSP unencrypted * DNS unencrypted CloudFlare is banging the drum on at least two of these, and Chrome on another, and I think FS is now optional in the latest Wifi spec.
  - spacemanmatt 6y ago
    The pushback on ESNI was...telling
  - pabs3 6y ago
    The DNS encryption efforts only protect part of the DNS query/response transit across the Internet, the packets from the recursive resolver to the root servers are still unencrypted. In addition, IP addresses are unencrypted and that can reveal a lot of information. Basically the planned SNI/DNS encryption is only going to be useful for websites hosted on global CDN providers and other centralised hosting. "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf Edit: then of course there is the whole BGP thing.
sroussey 6y ago
It would be great if Apple and Google had a setting to disable 2G and 3G at the very least.
- dragonwriter 6y ago
  > It would be great if Apple and Google had a setting to disable 2G and 3G at the very least. I don't know if its a Google, Samsung, or AT&T feature, but my Android has a default-off setting to enable 2G service. Nothing on 3G though.
  - mic_ozar 6y ago
    which android phone model?
    - dragonwriter 6y ago
      S10+
- baybal2 6y ago
  It will not make much if your phone company doesn't do the same, and stops accepting roaming requests from rogue countries. Somebody should also punch Google in the face for building in an "espionage API" into Android: reading sim card serial, imsi, and imei without even a notice. I doubt the thriving market of SS7 interceptions would be anywhere if not for Android creating a market for such data.
  - slim 6y ago
    maybe we could build android without it ?
- mandragon 6y ago
  go to the apple store and ask for a "cdma-less" iphone got this trick from a verizon engineer after complaining about such risks. carriers dont carry them but apple should be able to sell you one
noja 6y ago
Context: https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...
anon9001 6y ago
SS7 is challenging to find info about, so I'll ask here: How hard are these attacks to actually execute? * Can someone with an SDR and no credentials start an attack? * Do you need a femtocell registered with a carrier to attack SS7? * Do you need to be a registered carrier to have the access required to attack a user? The attacks described in the article assume the attacker is a nation-state, but is it possible for any random person with the right hardware to gain access to sensitive info via SS7?
- anonymousiam 6y ago
  The attacks are trivially easy. You need almost nothing. These are digital protocols on the wire so a SIP trunk would give you the same access as a cellular modem. An SDR would overly complicate things. It's almost as if the SS7 protocol was designed to support use by governments for collection and cyber-warfare.
  - Zenst 6y ago
    SS7 is an old legacy standard that can be viewed in the same vain as DNS and it's associated legacy and subsequent mitigations and improvements over the years. For more perspective, 2G came along decades later and that had more thought, why it used cutting edge 56bit encryption, which today is akin to plain text. A nice readup upon SS7 here: https://www.infopulse.com/blog/telecom-security-ss7-network-protocols/ https://www.infopulse.com/blog/telecom-security-ss7-network-... which also links to https://www.gsma.com/security/wp-content/uploads/2019/03/GSMA-Security-Threat-Landscape-31.1.19.pdf https://www.gsma.com/security/wp-content/uploads/2019/03/GSM... which fleshes out the picture even further. Remember that SS7 was invented in 1975, so if they designed cyber warfare into it, I'd be impressed with that level of planning.
    - anonymousiam 6y ago
      I did not mean to imply that there was a conscious effort to enable cyber-warfare when developing the SS7 protocols. What I meant was that it's so damn easy to do all of the mischievous things needed for cyber, that it sure seems like SS7 was made for that!
nbzso 6y ago
"Given that the company deals with wiretapping in the service of criminals and dictatorial regimes and is probably indirectly responsible for the deaths of many people, discriminatory treatment of employees and candidates is a petty crime. Don't bother if you're a normal person." This is google translated reaction in Bulgarian web-site for quality of workplaces. In other comments is obvious that paying 3500 eur salary is tied to working on undefined and risky situations. https://bgrabotodatel.com/company/10131?__cf_chl_jschl_tk__=d467cb4881d5d84fe0822c68040f045d7f1adc6e-1606935467-0-AXefFSN-JI5zFGsKASNF73qX3e6O06JHx3iXov6-XcHmSv2AeC_448KMl8gRpQ79t2tXbgBlhu_cr129gPAmYD0TQ-aEnOcl272z8p17NyJa7ki0pBjEXvNXhiAxwgH7dKEqROmjqSgWtpGyO1KAlNSZm5RIglTL_T-cw2a2NnEJxdnSv0gsdATV_UYE0KHxZKWYu03A2cFyeMziHECegejt-STYa7pZXVx251ckWWFJmMbuj5ErXgq_qUyqNlWHLbNcpfKEWKmUTl9-J98C5SlaxT8i-Haf18iv7-sRYDm7X2rp8i_bxu3J-AAlM16TxQ https://bgrabotodatel.com/company/10131?__cf_chl_jschl_tk__=...
- nbzso 6y ago
  Interesting comment from Circles Bulgaria Ltd worker from 2019. "The last opinions are very old, so I decided to write how things really are in the company. For now, everything is pretty good, especially after the management has changed almost completely. They take very good care of their people, and the only downside is the lack of a home office, but this is not felt. I don't know another company, or at least I think there are very few that take care of their people like that. The atmosphere is very positive and relaxed, and the projects we are working on are unique, once in a lifetime. Don't pay any attention to the grumblers, there will always be some. The information about the projects on the Internet is very small, but believe me, there is no place to touch such work."
  - draw_down 6y ago
    Sure, I bet NSA employees are quite happy as well.
  - mobilio 6y ago
    Well - this is "reputation cleaning review" probably from their HR department. BGRabotodatel is something similar as GlassDoor where ex-employees or even customers rate some companies with insider information. But HR departments see this and make countermeasures because site is well indexed and occupy first results on Google. And new potential employees see that too.
kingnothing 6y ago
Australia is in Five Eyes, so it's reasonable to assume that Canada, US, UK, and NZ are also all involved.
- deleted 6y ago
  [deleted]
- rubatuga 6y ago
  Australia seems to be a testing ground for fucked up internet policies.
- ajcp 6y ago
  Given Australia is in the Five Eyes I doubt it needs to get this capability from a third-party provider. More reasonable to assume that there is a maligned private actor in AUS. I don't believe Circle's admission that they only do business with nation-states one bit.
  - rurban 6y ago
    Indeed. In this case it points to Malaysia
- chrysaor 6y ago
  western countries is buys cirkles to spies on drug dealer borders.eastern countries is buys cirkles to spies on all journalist and freedom.
sloshnmosh 6y ago
The good people at CitizenLab are absolute hero’s exposing the digital terrorists that sell their warez to despots.
thdespou 6y ago
Former Circles Employee here. It's important to know that Circles has a big development team in Cyprus and they are doing lots of stuff. Ask me anything.
- meowface 6y ago
  Do you consider the company on ethically stronger or weaker grounds than NSO Group? And how do you feel about NSO Group?
- mleonhard 6y ago
  Can Circles users spy on mobile users from any country, or only handsets from the same country/network? If I disable roaming on my mobile account, will my mobile service provider reject intercept requests? Why is authentication optional in 4G and 5G? Do SS7 network participants suffer fraud? For example, a small telco in a developing country could charge random foreign customers for international calls that never occurred.
- ohreally3 6y ago
  What products does Circles make, and what is each of their purposes?
  - thdespou 6y ago
    They pretty much provide the core espionage platform services. They operate in a typical spy in a van scenarios with all the tools and hardware needed to perform hacking and exploiting. See for example this article: https://www.theguardian.com/world/2019/dec/20/cyprus-police-arrest-three-in-israeli-owned-spy-van-investigation https://www.theguardian.com/world/2019/dec/20/cyprus-police-...
commentrix 6y ago
What, no mention of Hong Kong? This clearly must be Chinese propaganda, quick flag and remove it, oh ye noblest and most righteousest HNers, or have you forgotten about your "beloved" HKers and their "righteous" cause...? In other news Australia IC, seems to really be getting slammed and dragged through the mud lately... What. A. Shame. https://news.ycombinator.com/item?id=25212930 https://news.ycombinator.com/item?id=25212930 Not to mention walking into the trap set by Chinese FM to make the SO abuse story blow up for a bit longer. "The image is clearly doctored...", news cycle spins for a bit longer
FreshFries 6y ago
Interested in the topic? Search for Karsten Nohl. That man is a 'one man army' exposing weaknesses in telcos and their protocols and has been for years. So long that many of these "S7 (as called in Europe) or SS7 (USA) tricks" are not even abusable in many networks since he helped them mitigate the issues. https://en.wikipedia.org/wiki/Karsten_Nohl https://en.wikipedia.org/wiki/Karsten_Nohl https://srlabs.de https://srlabs.de They guy's one of my all time heroes.

218 points by sroussey 6y ago

“Using Internet scanning, we found a unique signature associated with the hostnames of Check Point firewalls used in Circles deployments. This scanning enabled us to identify Circles deployments in at least 25 countries.” Nice OSINT find!

14 6y ago

We have seen this vulnerability for years and nothing has been done to change it. Is it safe to say that is intentional? Obviously a valuable too if you want to spy on your citizens.

LinuxBender 6y ago
Do you mean the weakness of SS7? If so, the answer is, it would be easier to entirely build a new telco network and new cities than to overhaul the SS7 signalling network. I would have to write a book to explain the complexities (technical, bureaucratic, legal challenges). To sum up, SS7 will probably be with us in its current state long after our great great grand-children. It is best to just avoid using it if you can. POTS lines, SMS Text messages currently depend on it, but SMS could be changed to use data only if all the wireless carriers could agree to block SS7 for SMS or tear down their SMS gateways. There would need to be an agreed upon standard to re-route all the SMS messages. Landline calls and mobile to landline and mobile carrier to mobile carrier will still use SS7 for the foreseeable future and will always be vulnerable to interception. Mobile devices would have to solve this with some type of device validation, at least for mobile to mobile calls and home/business systems would need to implement that validation.
- helios_invictus 6y ago
  A great deal of technical patching could occur in the SS7 based on lesson's learned from the Internet. But the telco's are strapped for resources and interoperability concern that this won't occur with our a massive push by a third party to support it. The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling.
  - LinuxBender 6y ago
    That idea is great, but the SS7 network was never built to even understand those concepts. Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Getting telco companies to agree to things like that is not even conceivable. It would take some international political groups to push for it. Maybe I am just jaded from my telco background, but even when an entire telco company agrees to implement a change, it rarely gets completed.
    - at-fates-hands 6y ago
      >> Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Just curious, would this mean digging up cable and other stuff which would include parts of this system you're referring to?
      - LinuxBender 6y ago
        Digging should not be required in most cases. It would require replacing gear in most of the telco central offices. That probably sounds simple, but it is not. Much of this gear is ancient, most of the people that intimately understand it are no longer with us and most of the companies that made it no longer exist. The new equipment would have to be backwards compatible and run side-by-side with the old equipment for a couple decades. Many of the CO's are at physical capacity. Even if the new gear is a fraction of the size of old gear, there will be logistical issues in many places. That alone is a significant undertaking. The coordination required between telcos within countries and between countries would be significant.
  - jlgaddis 6y ago
    > The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling. SHAKEN & STIR [0] should (hopefully!) eliminate most of the issues which result from "spoofing" caller ID. From "Combating Spoofed Robocalls with Caller ID Authentication" [1]: > "[The FCC] adopted new rules requiring all originating and terminating voice service providers to implement caller ID authentication using STIR/SHAKEN technological standards in the Internet Protocol (IP) portions of their networks by June 30, 2021." -- [0]: https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN [1]: https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication
- toast0 6y ago
  SMPP sort of fills the need for a standard way to send SMS between carriers. Although you still need to know which carrier to send it to, and have a working connection to them. I think HD voice calls can't be made over SS7? So to the extent that carriers interconnect for those (which isn't a lot, but it's more than zero), that's a parallel system too.
sneak 6y ago
See also: * Wifi lack of forward secrecy * SNI unencrypted * OCSP unencrypted * DNS unencrypted CloudFlare is banging the drum on at least two of these, and Chrome on another, and I think FS is now optional in the latest Wifi spec.
- spacemanmatt 6y ago
  The pushback on ESNI was...telling
- pabs3 6y ago
  The DNS encryption efforts only protect part of the DNS query/response transit across the Internet, the packets from the recursive resolver to the root servers are still unencrypted. In addition, IP addresses are unencrypted and that can reveal a lot of information. Basically the planned SNI/DNS encryption is only going to be useful for websites hosted on global CDN providers and other centralised hosting. "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf Edit: then of course there is the whole BGP thing.

sroussey 6y ago

It would be great if Apple and Google had a setting to disable 2G and 3G at the very least.

dragonwriter 6y ago
> It would be great if Apple and Google had a setting to disable 2G and 3G at the very least. I don't know if its a Google, Samsung, or AT&T feature, but my Android has a default-off setting to enable 2G service. Nothing on 3G though.
- mic_ozar 6y ago
  which android phone model?
  - dragonwriter 6y ago
    S10+
baybal2 6y ago
It will not make much if your phone company doesn't do the same, and stops accepting roaming requests from rogue countries. Somebody should also punch Google in the face for building in an "espionage API" into Android: reading sim card serial, imsi, and imei without even a notice. I doubt the thriving market of SS7 interceptions would be anywhere if not for Android creating a market for such data.
- slim 6y ago
  maybe we could build android without it ?
mandragon 6y ago
go to the apple store and ask for a "cdma-less" iphone got this trick from a verizon engineer after complaining about such risks. carriers dont carry them but apple should be able to sell you one

noja 6y ago

Context: https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...

anon9001 6y ago

SS7 is challenging to find info about, so I'll ask here: How hard are these attacks to actually execute? * Can someone with an SDR and no credentials start an attack? * Do you need a femtocell registered with a carrier to attack SS7? * Do you need to be a registered carrier to have the access required to attack a user? The attacks described in the article assume the attacker is a nation-state, but is it possible for any random person with the right hardware to gain access to sensitive info via SS7?

anonymousiam 6y ago
The attacks are trivially easy. You need almost nothing. These are digital protocols on the wire so a SIP trunk would give you the same access as a cellular modem. An SDR would overly complicate things. It's almost as if the SS7 protocol was designed to support use by governments for collection and cyber-warfare.
- Zenst 6y ago
  SS7 is an old legacy standard that can be viewed in the same vain as DNS and it's associated legacy and subsequent mitigations and improvements over the years. For more perspective, 2G came along decades later and that had more thought, why it used cutting edge 56bit encryption, which today is akin to plain text. A nice readup upon SS7 here: https://www.infopulse.com/blog/telecom-security-ss7-network-protocols/ https://www.infopulse.com/blog/telecom-security-ss7-network-... which also links to https://www.gsma.com/security/wp-content/uploads/2019/03/GSMA-Security-Threat-Landscape-31.1.19.pdf https://www.gsma.com/security/wp-content/uploads/2019/03/GSM... which fleshes out the picture even further. Remember that SS7 was invented in 1975, so if they designed cyber warfare into it, I'd be impressed with that level of planning.
  - anonymousiam 6y ago
    I did not mean to imply that there was a conscious effort to enable cyber-warfare when developing the SS7 protocols. What I meant was that it's so damn easy to do all of the mischievous things needed for cyber, that it sure seems like SS7 was made for that!

nbzso 6y ago

"Given that the company deals with wiretapping in the service of criminals and dictatorial regimes and is probably indirectly responsible for the deaths of many people, discriminatory treatment of employees and candidates is a petty crime. Don't bother if you're a normal person." This is google translated reaction in Bulgarian web-site for quality of workplaces. In other comments is obvious that paying 3500 eur salary is tied to working on undefined and risky situations. https://bgrabotodatel.com/company/10131?__cf_chl_jschl_tk__=d467cb4881d5d84fe0822c68040f045d7f1adc6e-1606935467-0-AXefFSN-JI5zFGsKASNF73qX3e6O06JHx3iXov6-XcHmSv2AeC_448KMl8gRpQ79t2tXbgBlhu_cr129gPAmYD0TQ-aEnOcl272z8p17NyJa7ki0pBjEXvNXhiAxwgH7dKEqROmjqSgWtpGyO1KAlNSZm5RIglTL_T-cw2a2NnEJxdnSv0gsdATV_UYE0KHxZKWYu03A2cFyeMziHECegejt-STYa7pZXVx251ckWWFJmMbuj5ErXgq_qUyqNlWHLbNcpfKEWKmUTl9-J98C5SlaxT8i-Haf18iv7-sRYDm7X2rp8i_bxu3J-AAlM16TxQ https://bgrabotodatel.com/company/10131?__cf_chl_jschl_tk__=...

nbzso 6y ago
Interesting comment from Circles Bulgaria Ltd worker from 2019. "The last opinions are very old, so I decided to write how things really are in the company. For now, everything is pretty good, especially after the management has changed almost completely. They take very good care of their people, and the only downside is the lack of a home office, but this is not felt. I don't know another company, or at least I think there are very few that take care of their people like that. The atmosphere is very positive and relaxed, and the projects we are working on are unique, once in a lifetime. Don't pay any attention to the grumblers, there will always be some. The information about the projects on the Internet is very small, but believe me, there is no place to touch such work."
- draw_down 6y ago
  Sure, I bet NSA employees are quite happy as well.
- mobilio 6y ago
  Well - this is "reputation cleaning review" probably from their HR department. BGRabotodatel is something similar as GlassDoor where ex-employees or even customers rate some companies with insider information. But HR departments see this and make countermeasures because site is well indexed and occupy first results on Google. And new potential employees see that too.

kingnothing 6y ago

Australia is in Five Eyes, so it's reasonable to assume that Canada, US, UK, and NZ are also all involved.

deleted 6y ago
[deleted]
rubatuga 6y ago
Australia seems to be a testing ground for fucked up internet policies.
ajcp 6y ago
Given Australia is in the Five Eyes I doubt it needs to get this capability from a third-party provider. More reasonable to assume that there is a maligned private actor in AUS. I don't believe Circle's admission that they only do business with nation-states one bit.
- rurban 6y ago
  Indeed. In this case it points to Malaysia
chrysaor 6y ago
western countries is buys cirkles to spies on drug dealer borders.eastern countries is buys cirkles to spies on all journalist and freedom.

sloshnmosh 6y ago

The good people at CitizenLab are absolute hero’s exposing the digital terrorists that sell their warez to despots.

thdespou 6y ago

Former Circles Employee here. It's important to know that Circles has a big development team in Cyprus and they are doing lots of stuff. Ask me anything.

meowface 6y ago
Do you consider the company on ethically stronger or weaker grounds than NSO Group? And how do you feel about NSO Group?
mleonhard 6y ago
Can Circles users spy on mobile users from any country, or only handsets from the same country/network? If I disable roaming on my mobile account, will my mobile service provider reject intercept requests? Why is authentication optional in 4G and 5G? Do SS7 network participants suffer fraud? For example, a small telco in a developing country could charge random foreign customers for international calls that never occurred.
ohreally3 6y ago
What products does Circles make, and what is each of their purposes?
- thdespou 6y ago
  They pretty much provide the core espionage platform services. They operate in a typical spy in a van scenarios with all the tools and hardware needed to perform hacking and exploiting. See for example this article: https://www.theguardian.com/world/2019/dec/20/cyprus-police-arrest-three-in-israeli-owned-spy-van-investigation https://www.theguardian.com/world/2019/dec/20/cyprus-police-...

commentrix 6y ago

What, no mention of Hong Kong? This clearly must be Chinese propaganda, quick flag and remove it, oh ye noblest and most righteousest HNers, or have you forgotten about your "beloved" HKers and their "righteous" cause...? In other news Australia IC, seems to really be getting slammed and dragged through the mud lately... What. A. Shame. https://news.ycombinator.com/item?id=25212930 https://news.ycombinator.com/item?id=25212930 Not to mention walking into the trap set by Chinese FM to make the SO abuse story blow up for a bit longer. "The image is clearly doctored...", news cycle spins for a bit longer

FreshFries 6y ago

Interested in the topic? Search for Karsten Nohl. That man is a 'one man army' exposing weaknesses in telcos and their protocols and has been for years. So long that many of these "S7 (as called in Europe) or SS7 (USA) tricks" are not even abusable in many networks since he helped them mitigate the issues. https://en.wikipedia.org/wiki/Karsten_Nohl https://en.wikipedia.org/wiki/Karsten_Nohl https://srlabs.de https://srlabs.de They guy's one of my all time heroes.