4 ms·

We have seen this vulnerability for years and nothing has been done to change it. Is it safe to say that is intentional? Obviously a valuable too if you want to

by 14 6y ago

We have seen this vulnerability for years and nothing has been done to change it. Is it safe to say that is intentional? Obviously a valuable too if you want to spy on your citizens.

LinuxBender 6y ago
Do you mean the weakness of SS7? If so, the answer is, it would be easier to entirely build a new telco network and new cities than to overhaul the SS7 signalling network. I would have to write a book to explain the complexities (technical, bureaucratic, legal challenges). To sum up, SS7 will probably be with us in its current state long after our great great grand-children. It is best to just avoid using it if you can. POTS lines, SMS Text messages currently depend on it, but SMS could be changed to use data only if all the wireless carriers could agree to block SS7 for SMS or tear down their SMS gateways. There would need to be an agreed upon standard to re-route all the SMS messages. Landline calls and mobile to landline and mobile carrier to mobile carrier will still use SS7 for the foreseeable future and will always be vulnerable to interception. Mobile devices would have to solve this with some type of device validation, at least for mobile to mobile calls and home/business systems would need to implement that validation.
- helios_invictus 6y ago
  A great deal of technical patching could occur in the SS7 based on lesson's learned from the Internet. But the telco's are strapped for resources and interoperability concern that this won't occur with our a massive push by a third party to support it. The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling.
  - LinuxBender 6y ago
    That idea is great, but the SS7 network was never built to even understand those concepts. Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Getting telco companies to agree to things like that is not even conceivable. It would take some international political groups to push for it. Maybe I am just jaded from my telco background, but even when an entire telco company agrees to implement a change, it rarely gets completed.
    - at-fates-hands 6y ago
      >> Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Just curious, would this mean digging up cable and other stuff which would include parts of this system you're referring to?
      - LinuxBender 6y ago
        Digging should not be required in most cases. It would require replacing gear in most of the telco central offices. That probably sounds simple, but it is not. Much of this gear is ancient, most of the people that intimately understand it are no longer with us and most of the companies that made it no longer exist. The new equipment would have to be backwards compatible and run side-by-side with the old equipment for a couple decades. Many of the CO's are at physical capacity. Even if the new gear is a fraction of the size of old gear, there will be logistical issues in many places. That alone is a significant undertaking. The coordination required between telcos within countries and between countries would be significant.
  - jlgaddis 6y ago
    > The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling. SHAKEN & STIR [0] should (hopefully!) eliminate most of the issues which result from "spoofing" caller ID. From "Combating Spoofed Robocalls with Caller ID Authentication" [1]: > "[The FCC] adopted new rules requiring all originating and terminating voice service providers to implement caller ID authentication using STIR/SHAKEN technological standards in the Internet Protocol (IP) portions of their networks by June 30, 2021." -- [0]: https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN [1]: https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication
- toast0 6y ago
  SMPP sort of fills the need for a standard way to send SMS between carriers. Although you still need to know which carrier to send it to, and have a working connection to them. I think HD voice calls can't be made over SS7? So to the extent that carriers interconnect for those (which isn't a lot, but it's more than zero), that's a parallel system too.
sneak 6y ago
See also: * Wifi lack of forward secrecy * SNI unencrypted * OCSP unencrypted * DNS unencrypted CloudFlare is banging the drum on at least two of these, and Chrome on another, and I think FS is now optional in the latest Wifi spec.
- spacemanmatt 6y ago
  The pushback on ESNI was...telling
- pabs3 6y ago
  The DNS encryption efforts only protect part of the DNS query/response transit across the Internet, the packets from the recursive resolver to the root servers are still unencrypted. In addition, IP addresses are unencrypted and that can reveal a lot of information. Basically the planned SNI/DNS encryption is only going to be useful for websites hosted on global CDN providers and other centralised hosting. "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf Edit: then of course there is the whole BGP thing.

by 14 6y ago

We have seen this vulnerability for years and nothing has been done to change it. Is it safe to say that is intentional? Obviously a valuable too if you want to spy on your citizens.

LinuxBender 6y ago

Do you mean the weakness of SS7? If so, the answer is, it would be easier to entirely build a new telco network and new cities than to overhaul the SS7 signalling network. I would have to write a book to explain the complexities (technical, bureaucratic, legal challenges). To sum up, SS7 will probably be with us in its current state long after our great great grand-children. It is best to just avoid using it if you can. POTS lines, SMS Text messages currently depend on it, but SMS could be changed to use data only if all the wireless carriers could agree to block SS7 for SMS or tear down their SMS gateways. There would need to be an agreed upon standard to re-route all the SMS messages. Landline calls and mobile to landline and mobile carrier to mobile carrier will still use SS7 for the foreseeable future and will always be vulnerable to interception. Mobile devices would have to solve this with some type of device validation, at least for mobile to mobile calls and home/business systems would need to implement that validation.

helios_invictus 6y ago
A great deal of technical patching could occur in the SS7 based on lesson's learned from the Internet. But the telco's are strapped for resources and interoperability concern that this won't occur with our a massive push by a third party to support it. The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling.
- LinuxBender 6y ago
  That idea is great, but the SS7 network was never built to even understand those concepts. Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Getting telco companies to agree to things like that is not even conceivable. It would take some international political groups to push for it. Maybe I am just jaded from my telco background, but even when an entire telco company agrees to implement a change, it rarely gets completed.
  - at-fates-hands 6y ago
    >> Some of the equipment could be updated, but a vast majority of systems would have to be replaced. Just curious, would this mean digging up cable and other stuff which would include parts of this system you're referring to?
    - LinuxBender 6y ago
      Digging should not be required in most cases. It would require replacing gear in most of the telco central offices. That probably sounds simple, but it is not. Much of this gear is ancient, most of the people that intimately understand it are no longer with us and most of the companies that made it no longer exist. The new equipment would have to be backwards compatible and run side-by-side with the old equipment for a couple decades. Many of the CO's are at physical capacity. Even if the new gear is a fraction of the size of old gear, there will be logistical issues in many places. That alone is a significant undertaking. The coordination required between telcos within countries and between countries would be significant.
- jlgaddis 6y ago
  > The idea of implement something like reverse-path forwarding on SS7 switches would for example greatly cut down on robo-calling. SHAKEN & STIR [0] should (hopefully!) eliminate most of the issues which result from "spoofing" caller ID. From "Combating Spoofed Robocalls with Caller ID Authentication" [1]: > "[The FCC] adopted new rules requiring all originating and terminating voice service providers to implement caller ID authentication using STIR/SHAKEN technological standards in the Internet Protocol (IP) portions of their networks by June 30, 2021." -- [0]: https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN [1]: https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication
toast0 6y ago
SMPP sort of fills the need for a standard way to send SMS between carriers. Although you still need to know which carrier to send it to, and have a working connection to them. I think HD voice calls can't be made over SS7? So to the extent that carriers interconnect for those (which isn't a lot, but it's more than zero), that's a parallel system too.

sneak 6y ago

See also: * Wifi lack of forward secrecy * SNI unencrypted * OCSP unencrypted * DNS unencrypted CloudFlare is banging the drum on at least two of these, and Chrome on another, and I think FS is now optional in the latest Wifi spec.

spacemanmatt 6y ago
The pushback on ESNI was...telling
pabs3 6y ago
The DNS encryption efforts only protect part of the DNS query/response transit across the Internet, the packets from the recursive resolver to the root servers are still unencrypted. In addition, IP addresses are unencrypted and that can reveal a lot of information. Basically the planned SNI/DNS encryption is only going to be useful for websites hosted on global CDN providers and other centralised hosting. "What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf https://irtf.org/anrw/2019/slides-anrw19-final44.pdf Edit: then of course there is the whole BGP thing.