Tobias Engel: SS7: Locate. Track. Manipulate.

Name: Tobias Engel: SS7: Locate. Track. Manipulate.
Uploaded: 2014-12-28T13:18:47Z
Duration: 3657 s
Description: Tobias Engel's 31C3 talk shows how weaknesses in the SS7 telephone signaling network let companies and attackers locate, track and manipulate phones from anywhere in the world, with precision down to about 50 meters.

Mmedia.ccc.de24 videos here

YouTube

84K views · Dec 28, 2014 · 1:00:57 · 1 HN recommender · 3 mentions · discussed 2017–2021

Tobias Engel's 31C3 talk shows how weaknesses in the SS7 telephone signaling network let companies and attackers locate, track and manipulate phones from anywhere in the world, with precision down to about 50 meters.

Why Hacker News points people here: HN cites it as the foundational demonstration that SS7 is insecure, relevant to arguments about SMS-based two-factor authentication.

“Tobias Engel demonstrates among other things tracking down a test subject over two continents for about a month”HN comment, 2017

Security & hacking Privacy, surveillance & cybercrime Networking & internet infrastructure Talk #ss7 #phone tracking #31c3 #mobile security #telecom

What Hacker News said 3

RecommendsHasknewbieJul 2017

“Tobias Engel demonstrates among other things tracking down a test subject over two continents for about a month”

Demonstrates tracking a test subject across continents via SS7.

Full comment

SS7 (the protocol whose security flaws are being downplayed here) was not designed with security in mind, and so has been the subject of infosec research for a few years now. This is a CCC talk from 2014 (there are older ones) where Tobias Engel demonstrates among other things tracking down a test subject over two continents for about a month, via his non-tempered mobile phone, using only SS7: this video In the same talk he mentions that he is working with a German telecom operator to resolve some of these issues. So as opposed to the US, it appears SS7 has been hardened in the EU since at least 2014 for the type of attacks mentioned in the Vice article... I really wonder why the US MNO are unwilling to act on this, since it's (1) a well known vulnerability and (2) fixes (or at least mitigations) have been implemented.

Cites itZekioMay 2017

“SS7 was proved ridiculously insecure ages ago by a guy who did a talk”

Newer version of the talk on SS7 insecurity.

Full comment

If I remember correctly SS7 was proved ridiculously insecure ages ago by a guy who did a talk at DefCon it was quite the interesting talk, will see if I can find it and add it to my comment EDIT: wasn't a defcon talk I remembered, but a 25c3 talk: link from 2010 :) EDIT2: this video newer version of the talk

Cites itmindcrimeJun 2021

Full comment

See also, /r/weirdnumbers and, if you're into that sort of thing (that is, exploring the phone network), /r/phreaking Old-skool phreaking[0] (eg, using blue boxes and red boxes) is mostly dead (at least in the US and most "first world" countries. Maybe there is some vestige of in-band signaling left somewhere else) but there is still some fun to be had exploring phones and phone networks. Modern day phreaking is more about GSM sniffing[1], messing with the SS7 network[2][3][4], using SCTP[5]/SIGTRAN stuff[6], etc. etc. But, at least for the land-line / PSTN network, even some of the old "colored boxes"[7] still do useful things. You can always beige-box a landline phone, violet-boxes should still work, I think a gold-box would still work, etc. If you want to dig deeper into how the PSTN works, a good, fun book is Understanding Telephone Electronics [8] by Carr, Winder, and Bigelow. Another interesting one is Digital Telephony [9] by Bellamy. Another "oldie but goodie" is Voice and Data Communications Handbook [10] by Bates and Gregory. Also, don't ask me how or why I know any of this stuff... :-) [0]: link [1]: link [2]: link [3]: this video [4]: link [5]: link [6]: link [7]: link [8]: link [9]: link [10]: link