4 ms·

even with SS7 ?

by yapyap 2y ago

even with SS7 ?

betaby 2y ago
Last time I saw SS7 in production about a decade ago. Which operator uses SS7 today?
- immibis 2y ago
  All? But it's something internal to networks and between networks, not between a network and a user device, so I don't see the relevance to IMEI catchers which intercept the radio link. Answer delayed by hours due to HN rate limiting.
  - betaby 2y ago
    > All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.
    - amiga386 2y ago
      You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.
      - betaby 2y ago
        Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.
        amiga386 2y ago
        You just sound like an unreliable witness. If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them). If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there? Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/security/gsma_resources/ir-82-ss7-security-network-implementation-guidelines-v5-0/ https://www.gsma.com/solutions-and-impact/technologies/secur... Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/security/gtleasing/ https://www.gsma.com/solutions-and-impact/technologies/secur...
        betaby 2y ago
        That attack demonstrated on Linus channel, while it IS about SS7 I doubt it had SS7 interfaced in USA/Canada. Important details were left in that demo, while some hints were given. SS7 is definitely a thing in some countries though. Linus channel demonstrated attack is not a direct one, but rather trickery, in way similar to domains 'apple.com' and 'аррle.com'.
        amiga386 2y ago
mike_hearn 2y ago
Happy new year! SS7 only gets into the picture after the handset has connected to the home network, from what I understand (n.b. not a telco engineer). The IMEI is exposed to the network, but only to your network and only after the handset sets up an encrypted and authenticated connection with it. 5G uses a thing called a GUTI to identify handsets, not an IMEI. Think of it like a GUTI being a temporary IPv6 address allocated for a few hours by DHCP, and the IMEI being like a browser cookie. IMEI is exposed to your home network and networks you roam onto, but merely being in range of a tower doesn't expose it, and it's never transmitted in the clear over the air. Also, within a network most of the components don't get access to the IMEI either.

even with SS7 ?

by yapyap 2y ago

even with SS7 ?

betaby 2y ago

Last time I saw SS7 in production about a decade ago. Which operator uses SS7 today?

immibis 2y ago
All? But it's something internal to networks and between networks, not between a network and a user device, so I don't see the relevance to IMEI catchers which intercept the radio link. Answer delayed by hours due to HN rate limiting.
- betaby 2y ago
  > All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.
  - amiga386 2y ago
    You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.
    - betaby 2y ago
      Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.
      - amiga386 2y ago
        You just sound like an unreliable witness. If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them). If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there? Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/security/gsma_resources/ir-82-ss7-security-network-implementation-guidelines-v5-0/ https://www.gsma.com/solutions-and-impact/technologies/secur... Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/security/gtleasing/ https://www.gsma.com/solutions-and-impact/technologies/secur...
        betaby 2y ago
        That attack demonstrated on Linus channel, while it IS about SS7 I doubt it had SS7 interfaced in USA/Canada. Important details were left in that demo, while some hints were given. SS7 is definitely a thing in some countries though. Linus channel demonstrated attack is not a direct one, but rather trickery, in way similar to domains 'apple.com' and 'аррle.com'.
        amiga386 2y ago

mike_hearn 2y ago

Happy new year! SS7 only gets into the picture after the handset has connected to the home network, from what I understand (n.b. not a telco engineer). The IMEI is exposed to the network, but only to your network and only after the handset sets up an encrypted and authenticated connection with it. 5G uses a thing called a GUTI to identify handsets, not an IMEI. Think of it like a GUTI being a temporary IPv6 address allocated for a few hours by DHCP, and the IMEI being like a browser cookie. IMEI is exposed to your home network and networks you roam onto, but merely being in range of a tower doesn't expose it, and it's never transmitted in the clear over the air. Also, within a network most of the components don't get access to the IMEI either.