The critical flaw lies in the global telecom network known as Signal System 7 that powers multiple phone carriers across the world, including AT&T and Verizon,
to route calls, texts and other services to each other. The
vulnerability has been discovered by the German researchers who will
present their findings at a hacker conference in Hamburg later this month.
"Experts say it's increasingly clear that SS7, first designed in the 1980s, is riddled with serious vulnerabilities that undermine the privacy of the world's billions of cellular customers," said The Washington Post, which first uncovered flaws in the system earlier this year.
NUMBER OF SECURITY FLAWS IN SS7
SS7 or Signaling System Number 7 is a
protocol suite used by most telecommunications operators throughout the
world to communicate with one another when directing calls, texts and
Internet data. It allows cell phone carriers to collect location
information from cell phone towers and share it with each other. A
United States carrier will find its customer, no matter if he or she
travels to any other country.
+
According to the security researchers, the outdated infrastructure of the SS7 makes it very easy for hackers to hack,
as it is loaded with some serious security vulnerabilities which can
lead to huge invasions of privacy of the billions of cellular customers
worldwide.
"The flaws discovered by the German researchers are actually functions built into SS7 for other purposes – such as keeping calls connected as users speed down highways, switching from cell tower to cell tower – that hackers can repurpose for surveillance because of the lax security on the network," the report reads.
BACKDOOR OPEN FOR HACKERS
So far, the extent of flaws exploited by hackers have not been revealed,
but it is believed that using the flaws hackers can locate or redirect
users' calls to themselves or anywhere in the world before forwarding to
the intended recipient, listen to calls as they happen, and record
hundreds of encrypted calls and texts at a time for later decryption.
No matter how much strong or advanced encryption the carriers are using,
for example AT&T and Verizon use 3G and 4G networks for calls,
messages, and texts sent from people within the same network, but the
use of that old and insecure SS7 for sending data across networks the
backdoor open for hackers.
Not just this, use of SS7 protocol also makes the potential to defraud
users and cellular carriers, according to the researchers.
ACLU – STOP USING TELEPHONE SERVICE, BUT WAIT!! IS THAT POSSIBLE?
The American Civil Liberties Union (ACLU) has also warned people against using their handset in light of the breaches.
"Don't use the telephone service provided by the phone company for voice. The voice channel they offer is not secure," principle technologist Christopher Soghoian told Gizmodo. "If you want to make phone calls to loved ones or colleagues and you want them to be secure, use third-party tools. You can use FaceTime, which is built into any iPhone, or Signal, which you can download from the app store. These allow you to have secure communication on an insecure channel."
Soghoian also believes that security agencies – like the United states'
NSA and British security agency GCHQ – could be using these flaws. "Many
of the big intelligence agencies probably have teams that do nothing
but SS7 research and exploitation. They've likely sat on these things
and quietly exploited them," he said.
However, the poor security capabilities of SS7 protocol is not hidden
from the people and its not at all a new, just three months ago we
reported How a Cell Phone User Can be Secretly Tracked Across the Globe.
But the era where each and every person care about privacy and security
of their data, things like this really publicize exactly how big this
threat really is and make many worried of its consequences.
No comments:
Post a Comment