5 ms·

Sure it's technically completely unrelated. Just an analogy because I don't think that most of us can relate to a global title.

fmajid 3y ago
It's more complicated than that. Cellular calls are handled by the MAP (Mobile Application Part) protocol, which runs on top of ISUP (ISDN User Part), which runs on top of SS7. Those are exceedingly complex protocols and there are legitimate calls, even from Saudi, e.g. when a Saudi user is visiting America and his Saudi phone is roaming, it needs to send messages to the Saudi HLR (Home Location Register) that can route back calls made to him to the location he is in, and similarly there are management messages to interrogate the network for where the phone is. What the Saudis, and UAE, Russians, Israelis or Chinese have been doing is abusing those messages for US phone numbers of dissidents like Jamal Khashoggi. Thus a SS7 firewall would need to also support the higher-level MAP and ISUP protocols, and be sufficiently sophisticated to implement rules like "do not allow outside countries to interrogate the status of phones on country code +1 (apart from Canada, because they are also in the North American Number Plan). There aren't very many programmers with SS7 skills as no one really wants to invest their career in a poorly specified and dying legacy protocol. That's why implementing this would require a large amount of work, i.e. be very expensive, which is what US telcos are balking at, and the captured FCC not cracking the whip as it did with SHAKEN/STIR caller ID authentication.
- usr1106 3y ago
  > Thus a SS7 firewall would need to also support All 3 German mobile operators claim to run SS7 firewalls, so those exist. How effective those are I have no clue. Number portability to a competitor are a legal requirement in both Germany and Finland. But sending SMSes to a ported number number between those companies does not work between all operators, although calling works. Whether that is a firewall issue or yet something completely different I have no clue either. I would assume if the phone cannot receive an SMS it is also protected from a location lookup attack. But only from those networks where it doesn't work. Whether it would have worked or even still works using Fink's global titles I have no clue.

fmajid 3y ago

It's more complicated than that. Cellular calls are handled by the MAP (Mobile Application Part) protocol, which runs on top of ISUP (ISDN User Part), which runs on top of SS7. Those are exceedingly complex protocols and there are legitimate calls, even from Saudi, e.g. when a Saudi user is visiting America and his Saudi phone is roaming, it needs to send messages to the Saudi HLR (Home Location Register) that can route back calls made to him to the location he is in, and similarly there are management messages to interrogate the network for where the phone is. What the Saudis, and UAE, Russians, Israelis or Chinese have been doing is abusing those messages for US phone numbers of dissidents like Jamal Khashoggi. Thus a SS7 firewall would need to also support the higher-level MAP and ISUP protocols, and be sufficiently sophisticated to implement rules like "do not allow outside countries to interrogate the status of phones on country code +1 (apart from Canada, because they are also in the North American Number Plan). There aren't very many programmers with SS7 skills as no one really wants to invest their career in a poorly specified and dying legacy protocol. That's why implementing this would require a large amount of work, i.e. be very expensive, which is what US telcos are balking at, and the captured FCC not cracking the whip as it did with SHAKEN/STIR caller ID authentication.

usr1106 3y ago
> Thus a SS7 firewall would need to also support All 3 German mobile operators claim to run SS7 firewalls, so those exist. How effective those are I have no clue. Number portability to a competitor are a legal requirement in both Germany and Finland. But sending SMSes to a ported number number between those companies does not work between all operators, although calling works. Whether that is a firewall issue or yet something completely different I have no clue either. I would assume if the phone cannot receive an SMS it is also protected from a location lookup attack. But only from those networks where it doesn't work. Whether it would have worked or even still works using Fink's global titles I have no clue.