Since, it was revealed that it is possible to use the SS7 flaw to hack any phone number, the world of phone hacking took on a more sinister feel. Implying that there is an SS7 flaw that can be exploited to hack a phone number is simplistic though. Yes, hackers can tap your mobile number using the SS7 flaw, but the upside is, they have to be very tech-savvy in that particular area. And it is not easily achievable.
Signalling System No. 7, or SS7, acts like a broker between telecoms companies. All networks have it as part of their software and it is a very essential part of telecoms network. In simple terms, SS7 works like this: when you place a call, or send a text message to another number in a different network, it is the SS7 that routes the communications between the two networks. It is also in charge of organizing billing and other end user functions as connections are made between networks. Simply put, without SS7, calls cannot be made to other networks.
Therefore the SS7 flaw is so named after it was showed that it is possible for knowledgeable hackers to gain access to the system. So using the SS7 flaw, they can roughly guess the location of a person using phone tower triangulation, read the messages exchanged using the hacked number, see call logs, and more frightening of all listen and record calls of the hacked phone number.
How the SS7 flaw works was demonstrated by Karsten Nohl, a German security Expert, for the CBS show 60 minutes. The Guinea pig for the demonstration was US Congressman Ted Lieu. The Congressman was given a new iPhone, and from his base in Berlin, Germany, Nohl was able to hack the congressman’s iPhone all the way in California through the SS7 flaw. Nohl successfully located the location of the iPhone, read the text messages that passed through the iPhone and listened in and recorded conversations between the politician and his staff.
According to Nohl,
“The mobile network is independent from the little GPS chip in your phone, it knows where you are. So any choices that a congressman could’ve made, choosing a phone, choosing a pin number, installing or not installing certain apps, have no influence over what we are showing because this is targeting the mobile network. That, of course, is not controlled by any one customer.”
The SS7 flaw is not a new discovery. Actually, it was the same Karsten Nohl who first brought the world’s attention to this flaw that is present in all phone networks. So, it is rather disappointing that almost two years later, mobile networks are yet to address the issue. And telecoms know that end users of their services have no way of securing themselves against hackers with the know how to exploit the SS7 flaw.
On the other hand, it is certain that some groups, especially the security and intelligence services of most governments would not want SS7 flaw to be corrected. Fixing it means one way of secretly getting information about people has been blocked to them. However, this is an issue that needs to be addressed. It is scary just thinking about it. This is something I thought could happen only in movies. I understood that big government spy agencies could do it, but any random person able to exploit the SS7 flaw is something else.
photo credits: hackread.com; tweakimg.net