3 ms·

SS7 is an old legacy standard that can be viewed in the same vain as DNS and it's associated legacy and subsequent mitigations and improvements over the years.

by Zenst 6y ago

SS7 is an old legacy standard that can be viewed in the same vain as DNS and it's associated legacy and subsequent mitigations and improvements over the years. For more perspective, 2G came along decades later and that had more thought, why it used cutting edge 56bit encryption, which today is akin to plain text. A nice readup upon SS7 here: https://www.infopulse.com/blog/telecom-security-ss7-network-protocols/ https://www.infopulse.com/blog/telecom-security-ss7-network-... which also links to https://www.gsma.com/security/wp-content/uploads/2019/03/GSMA-Security-Threat-Landscape-31.1.19.pdf https://www.gsma.com/security/wp-content/uploads/2019/03/GSM... which fleshes out the picture even further. Remember that SS7 was invented in 1975, so if they designed cyber warfare into it, I'd be impressed with that level of planning.

anonymousiam 6y ago
I did not mean to imply that there was a conscious effort to enable cyber-warfare when developing the SS7 protocols. What I meant was that it's so damn easy to do all of the mischievous things needed for cyber, that it sure seems like SS7 was made for that!
- deleted 6y ago
  [deleted]
- Zenst 6y ago
  If you look at anything from the 70's, very very few stand the test of time security wise and the ethos of security has become more mainstream at a technology level which see's today's technology that surpassed the wildest dreams of technology back then. Making many attack vectors non-viable to even state players back then, consumer accessible today. Might be why I've grown to love and appreciate analogue systems that just work.
segfaultbuserr 6y ago
> For more perspective, 2G came along decades later and that had more thought, why it used cutting edge 56bit encryption, which today is akin to plain text. It was not 56-bit, but 54-bit, not cutting edge even in the 80s. Remember that GSM's encryption was designed under the restriction of crypto regulations, weak security was deliberately used, just like how SSL had weak export ciphers thanks to the NSA. A few cryptographers behind GSM [0] have accused the GCHQ and the NSA for sabotaging GSM's security, or at least acknowledged the security was weakened due to political pressure. > Jan Arild Audestad has been an employee of Telenor in many years and has also been a professor at Gjøvik Universty College and the Norwegian University of Science and Technology. > — Originally we proposed that the encryption key length should be 128 bit, because we knew little about cryptographic systems, and how secure they were. The request was that the keys and algorithms should be secure at least for 15 years after the installation, Audestad tells. > Audestad says that the British were not very interested in having a strong encryption. And after a few years, they protested against the high security level that was proposed.— They wanted a key length of 48 bit. We were very surprised. The West Germans protested because they wanted a stronger encryption to prevent spying from East Germany. The compromise was a key length of 64 bit – where the ten last bits were set to zero. The result was an effective key length of 54 bit. > Aftenposten has spoken to several people who together with Audestad co-operated on building the GSM network. > One of them is Peter van der Arend from Netherlands. He tells Aftenposten how he «fought» with the British about this case – especially in a meeting in Portugal. > - The British argued that the key length had to be reduced. Among other things they wanted to make sure that a specified Asian country should not have the opportunity to escape surveillance. > Van der Arend was very opposed to the British proposal. > — The length was increased by the British – two bits at the time. They did not want to go further than 54 bits. And even though I argued against it, I eventually lost support from the others. And from that moment we had weaker security, and I am still angry about this. > Thomas Haug, who was one of the most central persons in the making of GSM, also says that he was put pressure on by the British. > — I was told by a British delegate that the British secret services wanted to weaken the security so they could eavesdrop more easily. > Michel Mouly from France was one of the other central people in the making of GSM. He cannot confirm that the British were pushing for weaker encryption. But he confirms that the encryption was not as strong as planned, due to political pressure. Mouly also confirms that it would have been technological possible to have a much stronger encryption than what the result became. [0] https://www.aftenposten.no/verden/i/Olkl/sources-we-were-pressured-to-weaken-the-mobile-security-in-the-80s https://www.aftenposten.no/verden/i/Olkl/sources-we-were-pre...

by Zenst 6y ago

anonymousiam 6y ago

I did not mean to imply that there was a conscious effort to enable cyber-warfare when developing the SS7 protocols. What I meant was that it's so damn easy to do all of the mischievous things needed for cyber, that it sure seems like SS7 was made for that!

deleted 6y ago
[deleted]
Zenst 6y ago
If you look at anything from the 70's, very very few stand the test of time security wise and the ethos of security has become more mainstream at a technology level which see's today's technology that surpassed the wildest dreams of technology back then. Making many attack vectors non-viable to even state players back then, consumer accessible today. Might be why I've grown to love and appreciate analogue systems that just work.

segfaultbuserr 6y ago

> For more perspective, 2G came along decades later and that had more thought, why it used cutting edge 56bit encryption, which today is akin to plain text. It was not 56-bit, but 54-bit, not cutting edge even in the 80s. Remember that GSM's encryption was designed under the restriction of crypto regulations, weak security was deliberately used, just like how SSL had weak export ciphers thanks to the NSA. A few cryptographers behind GSM [0] have accused the GCHQ and the NSA for sabotaging GSM's security, or at least acknowledged the security was weakened due to political pressure. > Jan Arild Audestad has been an employee of Telenor in many years and has also been a professor at Gjøvik Universty College and the Norwegian University of Science and Technology. > — Originally we proposed that the encryption key length should be 128 bit, because we knew little about cryptographic systems, and how secure they were. The request was that the keys and algorithms should be secure at least for 15 years after the installation, Audestad tells. > Audestad says that the British were not very interested in having a strong encryption. And after a few years, they protested against the high security level that was proposed.— They wanted a key length of 48 bit. We were very surprised. The West Germans protested because they wanted a stronger encryption to prevent spying from East Germany. The compromise was a key length of 64 bit – where the ten last bits were set to zero. The result was an effective key length of 54 bit. > Aftenposten has spoken to several people who together with Audestad co-operated on building the GSM network. > One of them is Peter van der Arend from Netherlands. He tells Aftenposten how he «fought» with the British about this case – especially in a meeting in Portugal. > - The British argued that the key length had to be reduced. Among other things they wanted to make sure that a specified Asian country should not have the opportunity to escape surveillance. > Van der Arend was very opposed to the British proposal. > — The length was increased by the British – two bits at the time. They did not want to go further than 54 bits. And even though I argued against it, I eventually lost support from the others. And from that moment we had weaker security, and I am still angry about this. > Thomas Haug, who was one of the most central persons in the making of GSM, also says that he was put pressure on by the British. > — I was told by a British delegate that the British secret services wanted to weaken the security so they could eavesdrop more easily. > Michel Mouly from France was one of the other central people in the making of GSM. He cannot confirm that the British were pushing for weaker encryption. But he confirms that the encryption was not as strong as planned, due to political pressure. Mouly also confirms that it would have been technological possible to have a much stronger encryption than what the result became. [0] https://www.aftenposten.no/verden/i/Olkl/sources-we-were-pressured-to-weaken-the-mobile-security-in-the-80s https://www.aftenposten.no/verden/i/Olkl/sources-we-were-pre...