4 ms·
Big telcos need to do SS7 filtering and (based on the interface they receive the message from) limit what can be done. The trouble is that SS7 lacks proper auth
by g_p 6y ago
Big telcos need to do SS7 filtering and (based on the interface they receive the message from) limit what can be done. The trouble is that SS7 lacks proper authentication, so it's like setting Linux iptables rules only based on the interface name - eth0, eth1 etc.
There are product-based SS7 protocol firewalls available that try to detect the "patterns" of signalling used to do "bad things", and block and report them.
Part of the problem with SS7 is that it's complex, and you can't easily restrict who says what - if you port your number from Operator A to Operator B, your number prefix still sits in A's range, and calls are signalled to Operator A. They can then tell you to try Operator B. B may then need to tell you the user is roaming and how to reach them. But yes, current firewlls leave a lot to be desired!
There's a number of good talks from CCC about SS7 - one is https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271...
- ng55QPSK 6y agoas far as i understand, there are no operators in Europe (maybe UK) anymore that don't run filtering on SS7. btw: SS7 is the legacy system and not part of 4G/5G.
- g_p 6y agoThey should all be running filtering, although not all filtering is as effective as each other. As you say, this is the legacy system, but it's still a huge problem for them!
- ng55QPSK 6y agoMy colleagues who do intrusion testing (for operators e.g.) tell me: We have not seen SS7 attacks in Europe for long time. The remaining attack surfaces are in the middle-east and north america.
- deleted 6y ago[deleted]
- g_p 6y agoThat's promising! It's now 5 years ago, but Telenor had a fairly big outage caused by malformed SS7 inbound signalling. Not sure if there's been anything since, but it certainly was an issue relatively recently. Hopefully with the (slow) move to 4G and IMS calling, we can turn the page on SS7 attacks soon.
- amaccuish 6y ago> if you port your number from Operator A to Operator B, your number prefix still sits in A's range, and calls are signalled to Operator A. They can then tell you to try Operator B. B may then need to tell you the user is roaming and how to reach them. But yes, current firewlls leave a lot to be desired! Not in all networks as far as I'm aware. UK is an annoying example of not having a central database of ported numbers (with ACQ), where a redirect is setup in the old network. I once ported my number in the UK and had huge issues receiving international calls or 2FA codes, it took me ages to work out and only got it sorted by leaving the number entirely and getting a new one. Otherwise, like here in Germany, it's done with a proper database and the call never passes through the old network.