6 ms·

SS7: Locate. Track. Manipulate [video]

125 points by moe 12y ago

Tobias Engel demonstrates (amongst other things): * How to find out the phone numbers of nearby cellphones * How to track the location of a cellphone that you only know the phone number of * How intercept outgoing calls of nearby cellphones

moe 12y ago
Actual talk starts at 00:16:00 into the video. Tobias Engel demonstrates (amongst other things): * How to find out the phone numbers of nearby cellphones * How to track the location of any cellphone worldwide that you only know the phone number of * How intercept outgoing calls of nearby cellphones (to record and/or re-route to a different number)
dsl 12y ago
I've learned more about how to efficiently seat people in an auditorium than I ever needed to know. But on a serious note, conference organizers should play close attention to how CCC does stuff and replicate it. The pre-talk on screen information is amazing and useful.
- voltagex_ 12y ago
  The streaming set up is world class, they have a freaking DECT setup for live translation inside the hall and the NOC is second to none. I'm very jealous of those attending.
  - lgeek 12y ago
    They have a GSM network too: http://events.ccc.de/congress/2014/wiki/Static:GSM http://events.ccc.de/congress/2014/wiki/Static:GSM
- s3nnyy 12y ago
  I've only attended two talks today - could you explain what you mean?
sounds 12y ago
Should be easy to transcode using VLC and post on YouTube, anyone not on Comcast able to do that for the rest of us?
- voltagex_ 12y ago
  This will happen after the conference
- ingomaro 12y ago
  What's the issue with comcast (with respect to these videos?)
  - wirefloss 12y ago
    On Comcast. Can't see anything either.
  - s3nnyy 12y ago
    On Youtube you can watch the videos in HTML5 and 1.25/1.5/2.0x speed.
  - rsync 12y ago
    Yes - please elaborate as to how access is different coming from comcast ?
- walrus 12y ago
  This appears to be the same video: https://www.youtube.com/watch?v=lQ0I5tl0YLY https://www.youtube.com/watch?v=lQ0I5tl0YLY
- ehPReth 12y ago
  It's now available to download: http://media.ccc.de/browse/congress/2014/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel.html#download http://media.ccc.de/browse/congress/2014/31c3_-_6249_-_en_-_...
Timmmmmm 12y ago
This is pretty shocking. Shame it is technical enough that it will probably not become mainstream news.
- dmix 12y ago
  It has already been getting news coverage for the last week or two, including Washington Post: http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18/german-researchers-discover-a-flaw-that-could-let-anyone-listen-to-your-cell-calls-and-read-your-texts/ http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18...
- spacefight 12y ago
  It has. 4 out of 4 network operators in Germany closed (some of) the gapping holes already. One brave network engineer even came forward to complete that list (2/4 -> 4/4) after the talk of Karsten Nohl.
wirefloss 12y ago
All TDM and Sigtran signaling links of world-wide SS7 network are configured manually peer-to-peer. The signaling traffic including SMS texts travels mostly unencrypted. Hence it's next to impossible to get a real SS7 Pcap log (requires an NDA), let alone access to the SS7 network, unless you work with a network operator.
- moe 12y ago
  it's next to impossible to get access to the SS7 network Tobias claims the opposite in the video. He says you can easily rent access from a Carrier (e.g. Verizon) or buy a Femtocell[1][2]. Both approaches seem rather affordable ("hundreds of dollars"). [1] http://en.wikipedia.org/wiki/Femtocell http://en.wikipedia.org/wiki/Femtocell [2] http://www.thinksmallcell.com/Examples/where-can-i-buy-a-femtocell.html http://www.thinksmallcell.com/Examples/where-can-i-buy-a-fem...
  - deleted 12y ago
    [deleted]
  - at-fates-hands 12y ago
    Apparently the attack vector is pretty small considering: http://www.digitaltrends.com/mobile/femtocell-verizon-hack/ http://www.digitaltrends.com/mobile/femtocell-verizon-hack/ Fortunately for Verizon customers, the company has since issued a patch to all affected femtocells. Sprint currently offers a femtocell that is similar to the vulnerable models from Verizon, but the company has said it plans to discontinue the device. And while AT&T also offers femtocells, it requires an extra level of authentication that makes much of the iSEC Partner’s findings irrelevant. Still, says Ritter, the femtocell vulnerability is a major problem. And Ritter suggests that all carriers that offer femtocells require owners to provide a list of approved devices that are allowed to connect to their femtocell. And also prevent customers’ cell phones from connecting to any unauthorized femtocell.
    - moe 12y ago
      Pretty small? Verizon was just used as an example here, the same attack vector applies to every mobile carrier in the world.

125 points by moe 12y ago

moe 12y ago

Actual talk starts at 00:16:00 into the video. Tobias Engel demonstrates (amongst other things): * How to find out the phone numbers of nearby cellphones * How to track the location of any cellphone worldwide that you only know the phone number of * How intercept outgoing calls of nearby cellphones (to record and/or re-route to a different number)

dsl 12y ago

I've learned more about how to efficiently seat people in an auditorium than I ever needed to know. But on a serious note, conference organizers should play close attention to how CCC does stuff and replicate it. The pre-talk on screen information is amazing and useful.

voltagex_ 12y ago
The streaming set up is world class, they have a freaking DECT setup for live translation inside the hall and the NOC is second to none. I'm very jealous of those attending.
- lgeek 12y ago
  They have a GSM network too: http://events.ccc.de/congress/2014/wiki/Static:GSM http://events.ccc.de/congress/2014/wiki/Static:GSM
s3nnyy 12y ago
I've only attended two talks today - could you explain what you mean?

sounds 12y ago

Should be easy to transcode using VLC and post on YouTube, anyone not on Comcast able to do that for the rest of us?

voltagex_ 12y ago
This will happen after the conference
ingomaro 12y ago
What's the issue with comcast (with respect to these videos?)
- wirefloss 12y ago
  On Comcast. Can't see anything either.
- s3nnyy 12y ago
  On Youtube you can watch the videos in HTML5 and 1.25/1.5/2.0x speed.
- rsync 12y ago
  Yes - please elaborate as to how access is different coming from comcast ?
walrus 12y ago
This appears to be the same video: https://www.youtube.com/watch?v=lQ0I5tl0YLY https://www.youtube.com/watch?v=lQ0I5tl0YLY
ehPReth 12y ago
It's now available to download: http://media.ccc.de/browse/congress/2014/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel.html#download http://media.ccc.de/browse/congress/2014/31c3_-_6249_-_en_-_...

Timmmmmm 12y ago

This is pretty shocking. Shame it is technical enough that it will probably not become mainstream news.

dmix 12y ago
It has already been getting news coverage for the last week or two, including Washington Post: http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18/german-researchers-discover-a-flaw-that-could-let-anyone-listen-to-your-cell-calls-and-read-your-texts/ http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18...
spacefight 12y ago
It has. 4 out of 4 network operators in Germany closed (some of) the gapping holes already. One brave network engineer even came forward to complete that list (2/4 -> 4/4) after the talk of Karsten Nohl.

wirefloss 12y ago

All TDM and Sigtran signaling links of world-wide SS7 network are configured manually peer-to-peer. The signaling traffic including SMS texts travels mostly unencrypted. Hence it's next to impossible to get a real SS7 Pcap log (requires an NDA), let alone access to the SS7 network, unless you work with a network operator.

moe 12y ago
it's next to impossible to get access to the SS7 network Tobias claims the opposite in the video. He says you can easily rent access from a Carrier (e.g. Verizon) or buy a Femtocell[1][2]. Both approaches seem rather affordable ("hundreds of dollars"). [1] http://en.wikipedia.org/wiki/Femtocell http://en.wikipedia.org/wiki/Femtocell [2] http://www.thinksmallcell.com/Examples/where-can-i-buy-a-femtocell.html http://www.thinksmallcell.com/Examples/where-can-i-buy-a-fem...
- deleted 12y ago
  [deleted]
- at-fates-hands 12y ago
  Apparently the attack vector is pretty small considering: http://www.digitaltrends.com/mobile/femtocell-verizon-hack/ http://www.digitaltrends.com/mobile/femtocell-verizon-hack/ Fortunately for Verizon customers, the company has since issued a patch to all affected femtocells. Sprint currently offers a femtocell that is similar to the vulnerable models from Verizon, but the company has said it plans to discontinue the device. And while AT&T also offers femtocells, it requires an extra level of authentication that makes much of the iSEC Partner’s findings irrelevant. Still, says Ritter, the femtocell vulnerability is a major problem. And Ritter suggests that all carriers that offer femtocells require owners to provide a list of approved devices that are allowed to connect to their femtocell. And also prevent customers’ cell phones from connecting to any unauthorized femtocell.
  - moe 12y ago
    Pretty small? Verizon was just used as an example here, the same attack vector applies to every mobile carrier in the world.