Signalling System No. 7, or simply SS7, is a worldwide telecommunications protocol for managing the routing of phone calls, SMS messages, and other services between a network of interconnected signalling points. SS7 facilitates quick communication between various network elements to implement efficient call setup and routing and call termination.

Although it was standardised as early as 1993, SS7 still remains a crucial back bone for telecommunication services around the globe in 2024, even in the presence of modern networks.

In simple terms, SS7 is a network of signalling points that functions like the internet for telecommunications. It enables seamless connection and communication of voice calls and text messages across different telecom systems, similar to how the internet connects various devices and services for data exchange.

BUT!

Telecoms are simply magicians who invisibly orchestrate call routing, SMS deliveries, and worldwide roaming behind the curtain with the magic of SS7. It's interesting that this industry fails to mention how fragile SS7 can be, basically leaving our calls, messages, and even locations unsecured. Let me explain.

Imagine a small circle of trusted friends who never lock up their places. Anyone can walk in and out as they please, and everything would be fine-since it worked for generations- until an outsider, assuming the role of one of their close friends, slips through one of those open doors.

In telecommunications, SS7 works in a similar manner. It enables service providers to exchange information with minimal security barriers for ensuring communication across different networks, hence effective, but due to its open nature, it also has vulnerabilities through which potential attackers can take advantage.

Vulnerabilities of SS7

It might astonish you that anyone with a high school knowledge in signalling can exploit SS7-and he can do it without the consumer's knowledge.

1. Intercept Calls: Like some unwanted guest who would also listen to what is going on, the attacker might intercept already ongoing calls. They can even pass it to their device so they may overhear private conversations.

2. Location Information Access: The hacker hears not only a conversation; he can also know where everybody is. Similarly, an attacker can track where someone is by querying the SS7 network so that he could know where somebody is at all times.

3. Account Hijacking: If the hacker has gathered enough information, then it can steal one of your friend's identities. Technically, an attacker might hijack a phone number to intercept SMS-based two-factor authentication codes and gain access to online accounts, personal data, etc.

The vulnerability found exposes the critical weaknesses in the SS7 protocol but originates from earlier network infrastructures. This means that the safety of the communication depends on the transformation of the telecommunication technology. Now, which brings us back to the evolution of networks : from 2G to 5G, smarter and safer, at least more interconnected and greater than just the fast downloads or the live videos being streamed.

2G to 5G — It’s Not Just About Faster Cat Videos

You might be wondering why we’re still talking about 2G or 3G in the age of 5G. The reason is simple: not every country or network has the advanced infrastructure needed to support the latest technology.

• 2G: The granddaddy of mobile networks. This was to simply make calls and nothing more-just basic calls.

• 3G: The Age of Buffering and Dropped Connections and repeatedly asking "Can you hear me now?"

• 4G: Fast Internet, streaming video without interruptions, just like YouTube on the go.

• 5G: Unlimited possibilities, the future. Smart cities, drive-less cars, robots performing surgeries-the lot. Upgrade from narrow road to a 16-lane superhighway.

Why can we just abandon 2G/3G?

The problem is 2G and 3G networks aren’t going away anytime soon. Many regions still depend on them for basic connectivity. They’re like those old, reliable cars people drive in rural areas—outdated, but they get the job done.

Why internet-Based calling is better (WhatsApp)?

SS7 is vulnerable because it was designed in a time when global networks didn’t exist. No one anticipated communication becoming this... global. Then came the internet, which completely redefined global connectivity.

Internet-based calling is much more secure. Apps like WhatsApp are built with encryption at their core. Instead of being like houses with open doors, they function more like private, soundproof booths. Calls and messages stay strictly between you and the person on the other end.

Difference between Traditional calling and Internet-based calling

How attackers make a SS7 attack?

To attack someone, an attacker typically needs their phone number, which is not hard to find anyways. After that they need to get the access of SS7 network which is not legal and not every telecom provider sell it but there are few who does and that is enough.

An attacker can use a Linux system with an SS7 SDK, which is free to download. Once connected to SS7 protocol to attackers can manipulate the network into believing their device is a legitimate MSC/VLR node.

The Mobile Switching Center (MSC) is a critical switching station that manages and directs your phone calls. The Visitor Location Register (VLR), on the other hand, is a temporary database that keeps track of your location while you are connected to the network. Together, these components help facilitate seamless communication and ensure that calls reach the right destination.

By pretending to be an MSC/VLR, attackers can find out victim’s location and access their International Mobile Subscriber Identity (IMSI), which is like an ID number for the SIM card (You can compare it with your IMEI). With the IMSI, they can redirect calls and messages to their own devices, putting the victim at risk.

Story Time

What Happened:

In 2017 Attackers used the SS7 vulnerability to intercept SMS messages that banks send to their customers as part of two-factor authentication (2FA). Specifically, they targeted customers of several banks in Germany.

1. Phase 1: Phishing for Bank Credentials

   The attackers initially obtained victims' online banking credentials through phishing attacks. This is a common tactic where users are tricked into giving away their bank login details via fake emails or websites.

2. Phase 2: Exploiting SS7 to Hijack SMS

   The banks required a second layer of authentication through one-time passcodes (OTPs) sent via SMS. To intercept these OTPs, the attackers used SS7 vulnerabilities.

   • Using SS7, they tracked the location of victims' phones and rerouted the OTPs to their own devices without the victims knowing.

   • This rerouting happens at the core of the mobile network, so it doesn't involve hacking the actual user's phone or SIM card. The attackers simply made the network forward SMS messages to their own devices.

3. Phase 3: Draining Bank Accounts

   With both the victims' online banking credentials and OTP codes, the attackers were able to log into the victims' bank accounts and initiate money transfers. They then moved the stolen funds into accounts they controlled.

Impact:

The attack allowed attackers to drain money from several customers' bank accounts in Germany. Since SS7 vulnerabilities affected the entire mobile communication infrastructure, there wasn't much the banks could do at the time to prevent the SMS rerouting from happening.

How It Was Discovered:

The incident came to light when customers noticed suspicious transactions in their accounts and reported them to their banks. An investigation revealed that the attackers had exploited the SS7 network to intercept the 2FA SMS codes.

What can we do?

Just to make it clear, we cannot avoid 100% of SS7 vulnerabilities until we stop using mobile network all together but we can obviously take some precautions.

• Always enable multi-layered authentication for critical accounts.

• For your two-factor authentication (2FA), instead of SMS-based 2FA use authenticator apps like Google Authenticator or Microsoft Authenticator.

• Try to use only end-to-end encrypted apps for communication.

• Use VPNs whenever possible for added privacy.

• Switch to 4G or 5G networks when available for improved security features.

• Regularly monitor your bank accounts and don’t neglect any unusual activity.

“Nothing to Hide, Nothing to Fear”? Think Again!

The classic argument — "If I’m not doing anything wrong, why should I care?".

Well privacy is not just about hiding, It’s about protection.

Here is an analogy — Would you be okay with leaving your front door unlocked just because you have nothing valuable inside? Probably not. It’s the same with privacy. You might not be hiding anything, but that doesn’t mean someone won’t try to exploit your personal information.

• In 2019, over 4 billion records were compromised due to data breaches. That’s more than half the global population!.

• Hackers have used SS7 to intercept 2FA codes and empty bank accounts in a matter of minutes.

One thing is certain: accidents and incidents don’t happen regularly, but it’s always better to be prepared than to regret it later.

Conclusion

Signalling System No. 7 (SS7) has built the foundation of global networking but it’s era has to end at some time. The future is in encrypted communication which lies in the 5G network but it’s gonna take some time, we are not there yet. Till then we can just be cautious and be aware of such vulnerabilities.

So, the next time someone says, “Nothing to hide, nothing to fear,” just remind them: it’s not about secrecy, it’s about security.