Comment by walrus01 | Hacker News Reader

Comment by walrus01 | Hacker News Reader

SS7 is fundamentally broken and nobody is ever going to fix it. It's based on telcos all trusting each other in the year 1985. The sheer mass of installed equipment that nobody wants to spend hundreds of thousands of dollars to upgrade means that implementing authentication and security on top of SS7 is never going to happen. Any extensions on top of SS7 that implement something resembling proper security will thoroughly break backwards compatibility with all old PSTN equipment.

If you use SMS or anything phone network related for 2FA you're doing it wrong.

My job title has "network engineer" in it. It's time to simply disregard the existence of the PSTN and move on to modern communications methods. By modern, I mean things that are based on packet-switched IP networks, with software applications using battle tested public/private key crypto implemented at layers 4-7 in the OSI model.

Crypto attempts have been made, but now we're starting to see both industry associations (GSMA) and open source (P1 Security SigFW [1]) working on filtering and encrypting SS7.

If placed in front of the legacy equipment, that could enable operators to gradually move toward signed+encrypted signaling traffic.

Problem is that this industry can be slow to react and would probably need government/regulatory pressure to move faster.

[1] https://github.com/P1sec/SigFW/

GSMA standards have always included purposeful insecurity, e.g. look at the history of A5/1 & A5/2.

It's a group that buys into the idea of secure backdoors, I'm not sure it's possible for them to build a secure system.

I actually think the current Huawei mess is direct fallout from our history of creating purposefully insecure systems: if the overall system was designed to be secure, the network infrastructure potentially being compromised wouldn't be such a significant issue.

I work at a company whose customer is the Phone Company. As I complained to my manager, "We may have a two-week sprint, but the Phone Company has a two-year sprint."

:-)

Well back when I worked for BT they had quarterly sprints but this was for things like major changes to the entire system.

I like to view the problem of SS7 as similar to that of BGP. How to add security to a widely used protocol. I think there are ways of moving forward, albeit slowly, without having to mass replace everything.

Interesting you mean a hybrid TCP/IP and OSI model

Reply on news.ycombinator.com