7 ms·

For background context around telecoms for anyone reading this, there is an underlying difference in how telecoms networks are designed and architected - in the

by g_p 6y ago

For background context around telecoms for anyone reading this, there is an underlying difference in how telecoms networks are designed and architected - in the Telco world, links between networks were predicated on trust. Originally, telecoms networks were run by national level quasi-government operators, one per country. You interconnected with other "known entities". Even now, you likely have 3, 4 or 5 national mobile operators in any one country. They negotiate their own roaming agreements in order for you to get roaming access. It's all driven by these kinds of relationships predicated on trusting other networks. In IT, we are rapidly moving towards zero trust (due to the internet), but circuit switched (legacy) voice is still all designed to be sent over private circuits between operators who trust each other. The legacy protocols (see SS7), used to route calls between operators are functional, but also lack access control and authentication, as it's assumed only trusted parties are on the network and able to use them. Those assumptions are no longer valid, and there's a huge challenge in dealing with this - hence SMS and call interception and rerouting attacks to steal 2FA tokens etc.

est31 6y ago
Isn't the internet in the same situation, with BGP being assumed to be done between trusted parties?
- darkr 6y ago
  Yes, but increasingly traffic is strongly encrypted, with users able to exert some level of control over that encryption
- pas 6y ago
  The first rule of BGP is to filter what you get. Don't just blindly accept whatever the peer advertises. The second rule is obvious, but for the third there's also a lot of knobs for traffic engineering with BGP. And on top of that there's RPKI [ https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ ] I guess all of the big telcos have some homegrown ossified hacky "solution" that also serve as a minimal kind of "firewall" for SS7. (Basically I imagine that there's a lot of hardcoded rules for phone numbers, country codes and operators. Sure, they probably are an opposite of a problem for national intelligence services, after all it's easier to go by unnoticed in the noise, but they at least help with a total BGP-like hijack of a whole country code by an operator.)
  - g_p 6y ago
    Big telcos need to do SS7 filtering and (based on the interface they receive the message from) limit what can be done. The trouble is that SS7 lacks proper authentication, so it's like setting Linux iptables rules only based on the interface name - eth0, eth1 etc. There are product-based SS7 protocol firewalls available that try to detect the "patterns" of signalling used to do "bad things", and block and report them. Part of the problem with SS7 is that it's complex, and you can't easily restrict who says what - if you port your number from Operator A to Operator B, your number prefix still sits in A's range, and calls are signalled to Operator A. They can then tell you to try Operator B. B may then need to tell you the user is roaming and how to reach them. But yes, current firewlls leave a lot to be desired! There's a number of good talks from CCC about SS7 - one is https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271...
    - ng55QPSK 6y ago
      as far as i understand, there are no operators in Europe (maybe UK) anymore that don't run filtering on SS7. btw: SS7 is the legacy system and not part of 4G/5G.
      - g_p 6y ago
        They should all be running filtering, although not all filtering is as effective as each other. As you say, this is the legacy system, but it's still a huge problem for them!
        ng55QPSK 6y ago
        My colleagues who do intrusion testing (for operators e.g.) tell me: We have not seen SS7 attacks in Europe for long time. The remaining attack surfaces are in the middle-east and north america.
        deleted 6y ago
        [deleted]
- g_p 6y ago
  At transit layer to an extent yes, but with every underlying user of the connectivity considering the connection compromised, and therefore using their own measures on the untrusted link. Hence IPsec and site to site/road warrior VPN - the underlying connectivity is regarded as untrusted by any sane user. In telecoms, anyone on the SS7 network can make a request to find a given number, or say the number is available and can be reached by routing via their network.
- walrus01 6y ago
  Any reputable and clueful transit provider these days is performing automated RPKI validation of the prefixes announced to them. In addition to whatever prefix lists might be manually set up on a bgp session. That's only a small piece of the puzzle in network security generally, but is sure better than how SS7 works right now.
- rcarmo 6y ago
  Most carriers already use PKI for their BGP traffic. It's not the Wild West anymore (although of course you'll always find some weak link if you backtrack AS announcements far enough)
tyingq 6y ago
The recently discussed[1][2] method of hijacking SMS with almost zero effort was an eye opener to me. I had thought it required social engineering my carrier. Nope, just a $15 service. [1] https://news.ycombinator.com/item?id=26469738 https://news.ycombinator.com/item?id=26469738 [2] https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a... [3] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s... Edit...added [3] above. Apparently, it's a $16 service, not $15: https://sakari.io/pricing/ https://sakari.io/pricing/
- g_p 6y ago
  Indeed! And if you have access to SS7, you can do it without the middle-man $15 service! These systems are really designed for use in a world where only trusted actors have any access to the system! That's clearly not true with all these third parties exposing functionality to the general public! [1] https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet...
  - thaumasiotes 6y ago
    > And if you have access to SS7, you can do it without the middle-man $15 service! This doesn't really seem to make things any worse. Surely it's easier to have $15 than it is to have access to SS7.
    - MayeulC 6y ago
      Right, but $15 a piece makes it only worth it for targeted attacks. Even if it's harder or more expensive to get access to SS7, it might become economical to attempt MITM on a larger target base once you do.
    - myself248 6y ago
      Yeah, but say you want to hijack a million accounts. It's easier to have access to SS7 than $15 million.
walrus01 6y ago
SS7 is not fixable in my opinion. It needs to undergo the metaphorical equivalent of being burnt to the ground and having its ashes stomped around on a bit. The further you go into the architecture of the "trust based" PSTN, SS7, traditional Telco stuff... The more you will see the total lack of modern cryptography, PKIs, zero trust network modeling, etc. I'll admit that my perspective is skewed by working in backbone IP network engineering for a mid sized ISP. We occasionally have reason to interact with some pstn related stuff. All of the real technical innovation, security advances and such have been taking place in the ISP world for the past 25 years, not the Telco world.
- g_p 6y ago
  Indeed, SS7 is based on a whole host of assumptions that just can't be relied upon. Since SS7 doesn't even bother to try to verify who anyone is (you'd only peer with trustworthy people, right?!), it's also very hard to hold anyone accountable too. And since the idea of SS7 signalling is that it can be forwarded and passed around, it simply needs to be replaced by authenticated, access-control validated signalling. Then you can at least have some confidence you're actually hearing from a network that has a reason to be communicating. Too much of SS7 comes from a world where anyone can do anything - there's no legitimate reason in 2021 for an arbitrary network to be able to request a user's network location and cell ID, but the protocols support it. SS7 firewalls try to plug the gaps, but ultimately you just innovate in how you try to get the network to hand over what you want, and eventually you'll find a way the firewall doesn't spot. Cat and mouse continues. Telco networks are "zero trust", just not in the right way(!)
- amaccuish 6y ago
  > The more you will see the total lack of modern cryptography, PKIs.. Funny you say that as x509 was an ITU standard. But yes, PSTN is terribly broken, with mobile bolted on.
bradleyjg 6y ago
> as it's assumed only trusted parties are on the network and able to use them. Those assumptions are no longer valid Why not refuse to peer with networks that peer/sell to bad actors? Before we had ML based email filters that kind of “hold upstreams responsible” strategy worked pretty well.
- g_p 6y ago
  That's one approach, but some operators have SS7 connections to unknown providers. And turning off connections is a great way to discover that a whole host of services (think Twilio etc) suddenly stop working, as they were using some sketchy forgotten-about route into the network. With third party access often "leased" via legitimate-ish providers though, it's hard to really do this without cutting countries or territories loose. Small countries often have operators that give SS7 access, to raise some extra revenue they can't get from their (small and population limited) subscriber-base.
  - bradleyjg 6y ago
    It may be callous to say but I think most customers would be okay with the trade-off of losing telephone access to some small country that decided to monetize access to global telephony by selling to spammers and scammers, in exchange for not getting those calls.
foobarian 6y ago
Reminds me of how NIS used to work on LANs. Oh what fun was had in college with NFS mounted home directories...
gumby 6y ago
This same approach (assume only trusted parties) is fundamental to SCADA systems (the industrial control protocols for power generation, wastewater systems, and other big industrial machinery). At best you get a firewall in front of it.
miohtama 6y ago
If the trust issues cannot be fixed on hardware level or on base layer, it needs to be fixed on higher levels with more prominent and audited protocols. “IP based calls and everyone gets a free VPN from their telco”
- happysadpanda2 6y ago
  This would solve eavesdropping, but not the problem of you friendly neighborhood stalker knowing the rough location of your cellphone at any given point in time.
rcarmo 6y ago
SS7 is dead except in legacy switches. IMS started rolling out in 2004(ish), and replaced most voice switching with SIP, which gradually flowed out towards customers. Most voice installed for the last 10 years is already over IP. If it doesn't start in the CPE, then it starts at the curbside or lot where a DSLAM or equivalent generate dial tones, pack it onto IP packets and send it over a fiber connection.

by g_p 6y ago

est31 6y ago

Isn't the internet in the same situation, with BGP being assumed to be done between trusted parties?

darkr 6y ago
Yes, but increasingly traffic is strongly encrypted, with users able to exert some level of control over that encryption
pas 6y ago
The first rule of BGP is to filter what you get. Don't just blindly accept whatever the peer advertises. The second rule is obvious, but for the third there's also a lot of knobs for traffic engineering with BGP. And on top of that there's RPKI [ https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ ] I guess all of the big telcos have some homegrown ossified hacky "solution" that also serve as a minimal kind of "firewall" for SS7. (Basically I imagine that there's a lot of hardcoded rules for phone numbers, country codes and operators. Sure, they probably are an opposite of a problem for national intelligence services, after all it's easier to go by unnoticed in the noise, but they at least help with a total BGP-like hijack of a whole country code by an operator.)
- g_p 6y ago
  Big telcos need to do SS7 filtering and (based on the interface they receive the message from) limit what can be done. The trouble is that SS7 lacks proper authentication, so it's like setting Linux iptables rules only based on the interface name - eth0, eth1 etc. There are product-based SS7 protocol firewalls available that try to detect the "patterns" of signalling used to do "bad things", and block and report them. Part of the problem with SS7 is that it's complex, and you can't easily restrict who says what - if you port your number from Operator A to Operator B, your number prefix still sits in A's range, and calls are signalled to Operator A. They can then tell you to try Operator B. B may then need to tell you the user is roaming and how to reach them. But yes, current firewlls leave a lot to be desired! There's a number of good talks from CCC about SS7 - one is https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271...
  - ng55QPSK 6y ago
    as far as i understand, there are no operators in Europe (maybe UK) anymore that don't run filtering on SS7. btw: SS7 is the legacy system and not part of 4G/5G.
    - g_p 6y ago
      They should all be running filtering, although not all filtering is as effective as each other. As you say, this is the legacy system, but it's still a huge problem for them!
      - ng55QPSK 6y ago
        My colleagues who do intrusion testing (for operators e.g.) tell me: We have not seen SS7 attacks in Europe for long time. The remaining attack surfaces are in the middle-east and north america.
        deleted 6y ago
        [deleted]
g_p 6y ago
At transit layer to an extent yes, but with every underlying user of the connectivity considering the connection compromised, and therefore using their own measures on the untrusted link. Hence IPsec and site to site/road warrior VPN - the underlying connectivity is regarded as untrusted by any sane user. In telecoms, anyone on the SS7 network can make a request to find a given number, or say the number is available and can be reached by routing via their network.
walrus01 6y ago
Any reputable and clueful transit provider these days is performing automated RPKI validation of the prefixes announced to them. In addition to whatever prefix lists might be manually set up on a bgp session. That's only a small piece of the puzzle in network security generally, but is sure better than how SS7 works right now.
rcarmo 6y ago
Most carriers already use PKI for their BGP traffic. It's not the Wild West anymore (although of course you'll always find some weak link if you backtrack AS announcements far enough)

tyingq 6y ago

The recently discussed[1][2] method of hijacking SMS with almost zero effort was an eye opener to me. I had thought it required social engineering my carrier. Nope, just a $15 service. [1] https://news.ycombinator.com/item?id=26469738 https://news.ycombinator.com/item?id=26469738 [2] https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a... [3] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s... Edit...added [3] above. Apparently, it's a $16 service, not $15: https://sakari.io/pricing/ https://sakari.io/pricing/

g_p 6y ago
Indeed! And if you have access to SS7, you can do it without the middle-man $15 service! These systems are really designed for use in a world where only trusted actors have any access to the system! That's clearly not true with all these third parties exposing functionality to the general public! [1] https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet...
- thaumasiotes 6y ago
  > And if you have access to SS7, you can do it without the middle-man $15 service! This doesn't really seem to make things any worse. Surely it's easier to have $15 than it is to have access to SS7.
  - MayeulC 6y ago
    Right, but $15 a piece makes it only worth it for targeted attacks. Even if it's harder or more expensive to get access to SS7, it might become economical to attempt MITM on a larger target base once you do.
  - myself248 6y ago
    Yeah, but say you want to hijack a million accounts. It's easier to have access to SS7 than $15 million.

walrus01 6y ago

SS7 is not fixable in my opinion. It needs to undergo the metaphorical equivalent of being burnt to the ground and having its ashes stomped around on a bit. The further you go into the architecture of the "trust based" PSTN, SS7, traditional Telco stuff... The more you will see the total lack of modern cryptography, PKIs, zero trust network modeling, etc. I'll admit that my perspective is skewed by working in backbone IP network engineering for a mid sized ISP. We occasionally have reason to interact with some pstn related stuff. All of the real technical innovation, security advances and such have been taking place in the ISP world for the past 25 years, not the Telco world.

g_p 6y ago
Indeed, SS7 is based on a whole host of assumptions that just can't be relied upon. Since SS7 doesn't even bother to try to verify who anyone is (you'd only peer with trustworthy people, right?!), it's also very hard to hold anyone accountable too. And since the idea of SS7 signalling is that it can be forwarded and passed around, it simply needs to be replaced by authenticated, access-control validated signalling. Then you can at least have some confidence you're actually hearing from a network that has a reason to be communicating. Too much of SS7 comes from a world where anyone can do anything - there's no legitimate reason in 2021 for an arbitrary network to be able to request a user's network location and cell ID, but the protocols support it. SS7 firewalls try to plug the gaps, but ultimately you just innovate in how you try to get the network to hand over what you want, and eventually you'll find a way the firewall doesn't spot. Cat and mouse continues. Telco networks are "zero trust", just not in the right way(!)
amaccuish 6y ago
> The more you will see the total lack of modern cryptography, PKIs.. Funny you say that as x509 was an ITU standard. But yes, PSTN is terribly broken, with mobile bolted on.

bradleyjg 6y ago

> as it's assumed only trusted parties are on the network and able to use them. Those assumptions are no longer valid Why not refuse to peer with networks that peer/sell to bad actors? Before we had ML based email filters that kind of “hold upstreams responsible” strategy worked pretty well.

g_p 6y ago
That's one approach, but some operators have SS7 connections to unknown providers. And turning off connections is a great way to discover that a whole host of services (think Twilio etc) suddenly stop working, as they were using some sketchy forgotten-about route into the network. With third party access often "leased" via legitimate-ish providers though, it's hard to really do this without cutting countries or territories loose. Small countries often have operators that give SS7 access, to raise some extra revenue they can't get from their (small and population limited) subscriber-base.
- bradleyjg 6y ago
  It may be callous to say but I think most customers would be okay with the trade-off of losing telephone access to some small country that decided to monetize access to global telephony by selling to spammers and scammers, in exchange for not getting those calls.

foobarian 6y ago

Reminds me of how NIS used to work on LANs. Oh what fun was had in college with NFS mounted home directories...

gumby 6y ago

This same approach (assume only trusted parties) is fundamental to SCADA systems (the industrial control protocols for power generation, wastewater systems, and other big industrial machinery). At best you get a firewall in front of it.

miohtama 6y ago

If the trust issues cannot be fixed on hardware level or on base layer, it needs to be fixed on higher levels with more prominent and audited protocols. “IP based calls and everyone gets a free VPN from their telco”

happysadpanda2 6y ago
This would solve eavesdropping, but not the problem of you friendly neighborhood stalker knowing the rough location of your cellphone at any given point in time.

rcarmo 6y ago

SS7 is dead except in legacy switches. IMS started rolling out in 2004(ish), and replaced most voice switching with SIP, which gradually flowed out towards customers. Most voice installed for the last 10 years is already over IP. If it doesn't start in the CPE, then it starts at the curbside or lot where a DSLAM or equivalent generate dial tones, pack it onto IP packets and send it over a fiber connection.