Hacker News Reader

Comment by Animats | Hacker News Reader

Is there a translation of how they got into SS7? Google rejects the PDF as too large to translate.[1]

[1] http://www.ptsecurity.ru/download/PT_SS7_security_2014_rus.p...

Thanks. From that article: "To access an SS7 network, attackers can acquire an existing provider’s connection on the black (underground) market and obtain authorization to operate as a mobile carrier in countries with lax communications laws. In addition, any hacker who happens to work as a technical specialist at a telecommunications operator, would be able to connect their hacking equipment to the company’s SS7 network. In order to perform certain attacks, legitimate functions of the existing communication network equipment must be used. There is also an opportunity to penetrate a provider’s network through a cracked edge device (GGSN or a femtocell)."

So they don't have a way to break into WhatsApp without breaking into SS7 first. SS7 isn't publicly accessible, and it doesn't extend out to the air link for mobiles. The attacker has to find a backdoor into SS7. The problem is that, once on the SS7 network, you can send lots of messages which are believed by telco networks. You can divert phone calls and set up MITM attacks easily.

If this works against WhatsApp, their app lacks adequate MITM protection.

You can get the SS7 link for a few hundred bucks a month:

https://www.youtube.com/watch?v=lQ0I5tl0YLY

Its an hour, but I highly suggest the talk.

But you can just connect to a carrier SS7 network because you bought an SS7 gateway appliance or because bought a SIP trunk to some third party. It doesn't work like this. You need to have an agreement with a carrier to even talk to their gateway. These are usually well vetted as well because you are entering into a financial agreement with a carrier when you connect to them this way.

But we can easily assume that every major intelligence community has access to SS7.

You might find this angle interesting to. It's why Clive and I have pushed for not trusting the carriers, basebands, or cellphones themselves for years now.

https://www.schneier.com/blog/archives/2015/08/ss7_phone-swi...

This appears to be it:

https://www.ptsecurity.ru/upload/ptcom/SS7_WP_A4.ENG.0036.01...

Reply on news.ycombinator.com