21–24 of 24 posts
At some point you have to wonder how privacy and security wasnt a factor at all in the minds of engineers designing these systems- it has to be intentional, right? Did no one stop to consider how the system theyre building could be abused against the general public? Did they just not care?
They were and still are dumb and naive. This comment is going to be downvoted.
At some point you have to wonder how privacy and security wasnt a factor at all in the minds of engineers designing these systems- it has to be intentional, right? Did no one stop to consider how the system theyre building could be abused against the general public? Did they just not care?
Almost as crazy as email and HTTP being designed without encryption, amirite? SS7 dates from the early 1980s, as do SMTP (1981) and HTTP (1989). In all three cases people build the simplest thing that works and then hacked on it as new requirements arose. The main problem is that the telco world is very conservative and closed-source, so while we've had HTTPS and encrypted IMAP etc for a while now, SS7 hasn't gotten…
It's not the same protocol of course and doesn't do the same thing, but it's used in the same scenarios and has a similar level of security and importance.
And both are peer to peer - you can agree with one of your peers to secure your BGP session, but it won't have much impact on the global network, of which your BGP sessions are only a small part. There was a talk recently released from DEFCON33 about the phone system, where it was mentioned that to bypass authentication, spammers seek out carriers with old TDM systems which can't support authentication, and might even be their main customers. This is like that. All of your peerings may be secure, but if you start blocking calls you got relayed from 4 networks away with incorrect metadata, you can't tell if it's fake data or if one of those intermediary networks messed up the metadata on a legitimate call, and you will block legitimate calls and lose customers. Networks are weird systems where politics, not specifications, dominate.
Is there anything a common person can do to help reduce the likelihood of their phone being tracked via SS7? (other than not carrying a phone or disabling the mobile network)
Put #1 and #2 SIM cards in two WWAN modems in a device (laptop?) you always keep at home, or at work if you don't want your home location known. Cross-connect the two modems by software (Asterisk?) such that if a call comes in from #1, it's forwarded through #2 modem to #3 (your mobile phone) and if you dial #2 from your mobile phone, you get a dial tone on #1 modem.
Disadvantages:
- No call ID. You'll never know who calls you and can't immediately save their number without looking at the call logs at home.
- You must store all phone numbers with #2 as prefix, a pause, then the actual phone number as extension.
At some point you have to wonder how privacy and security wasnt a factor at all in the minds of engineers designing these systems- it has to be intentional, right? Did no one stop to consider how the system theyre building could be abused against the general public? Did they just not care?