3 ms·

> All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.

by betaby 2y ago

amiga386 2y ago
You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.
- betaby 2y ago
  Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.
  - amiga386 2y ago
    You just sound like an unreliable witness. If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them). If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there? Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/security/gsma_resources/ir-82-ss7-security-network-implementation-guidelines-v5-0/ https://www.gsma.com/solutions-and-impact/technologies/secur... Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/security/gtleasing/ https://www.gsma.com/solutions-and-impact/technologies/secur...
    - betaby 2y ago
      That attack demonstrated on Linus channel, while it IS about SS7 I doubt it had SS7 interfaced in USA/Canada. Important details were left in that demo, while some hints were given. SS7 is definitely a thing in some countries though. Linus channel demonstrated attack is not a direct one, but rather trickery, in way similar to domains 'apple.com' and 'аррle.com'.
      - amiga386 2y ago
        I directly ask you: do you think there is at least one SS7 network in the USA or Canada, yes or no? If you claim there are no SS7 networks in the USA or Canada, please explain: 1) why the FCC believes they exist and need to be secured, as per their March 2024 note 2) what the UMTS networks, still operational in Canada, are using for messaging (note the 2025 dates in https://en.wikipedia.org/wiki/3G#Phase-out https://en.wikipedia.org/wiki/3G#Phase-out for Canada; 2G/3G is still alive and well there. And I note that most of the 3G phase out in the USA was in 2022, not in 2014 which is what they'd have to be for you to not have seen SS7 for a decade) 3) what the POTS networks, still operational in the USA and Canada, are using for messaging (noting that FCC 19-72 only removes the requirement on ILECs to provide UME Analog Loops to CLECs, and does not require them to shut down POTS networks entirely by August 2022. For example, AT&T only plans to have transitioned 50% of its POTS network by 2025)

> All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.

by betaby 2y ago

> All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.

You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.

betaby 2y ago
Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.
- amiga386 2y ago
  You just sound like an unreliable witness. If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them). If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there? Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/security/gsma_resources/ir-82-ss7-security-network-implementation-guidelines-v5-0/ https://www.gsma.com/solutions-and-impact/technologies/secur... Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/security/gtleasing/ https://www.gsma.com/solutions-and-impact/technologies/secur...
  - betaby 2y ago
    That attack demonstrated on Linus channel, while it IS about SS7 I doubt it had SS7 interfaced in USA/Canada. Important details were left in that demo, while some hints were given. SS7 is definitely a thing in some countries though. Linus channel demonstrated attack is not a direct one, but rather trickery, in way similar to domains 'apple.com' and 'аррle.com'.
    - amiga386 2y ago
      I directly ask you: do you think there is at least one SS7 network in the USA or Canada, yes or no? If you claim there are no SS7 networks in the USA or Canada, please explain: 1) why the FCC believes they exist and need to be secured, as per their March 2024 note 2) what the UMTS networks, still operational in Canada, are using for messaging (note the 2025 dates in https://en.wikipedia.org/wiki/3G#Phase-out https://en.wikipedia.org/wiki/3G#Phase-out for Canada; 2G/3G is still alive and well there. And I note that most of the 3G phase out in the USA was in 2022, not in 2014 which is what they'd have to be for you to not have seen SS7 for a decade) 3) what the POTS networks, still operational in the USA and Canada, are using for messaging (noting that FCC 19-72 only removes the requirement on ILECs to provide UME Analog Loops to CLECs, and does not require them to shut down POTS networks entirely by August 2022. For example, AT&T only plans to have transitioned 50% of its POTS network by 2025)