Feds Patching Years-Old SS7 Vulnerability in Phone Networks

The FCC’s Public Safety and Homeland Security Bureau is seeking input on how communication service providers are securing SS7 and Diameter protocols to prevent location-tracking vulnerabilities. 

The protocols are crucial for call routing, network interconnection, and data exchange in mobile and fixed-line networks, as recent security concerns about SS7 potentially enabling unauthorized location tracking of mobile devices prompt the FCC to investigate service providers’ security measures. 

The Diameter protocol, used for authentication and mobility in mobile networks, has vulnerabilities similar to the older SS7 protocol, allowing attackers to spoof their network identity and potentially gain access to user location or other sensitive information. 

To mitigate these risks, recommendations include using firewalls and filters to limit access to user data, collaborating with signaling aggregators for broader network visibility, and encouraging users to adopt encryption technologies. 

Continuous security assessments and information sharing are crucial for detecting and preventing attacks, as well as securing next-generation protocols like Diameter, which is essential for future mobile network security. 

CSRIC VI identified location tracking as a major attack method for SS7 and Diameter vulnerabilities, where attackers can exploit the vulnerabilities to track a target’s general location (city-level) by retrieving a cell ID or serving an MSC /MSS address. 

While not as precise as GPS coordinates, the information can still be valuable for attackers targeting VIPs or government officials, and to mitigate the attacks, CSRIC VI recommends secure domains and security gateways at network boundaries to reduce unauthorized access. 

The FCC has encouraged implementing these recommendations and continues to monitor the industry’s progress, while Senator Wyden recently expressed concerns about these vulnerabilities and urged the FCC to take further action. 

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Run Free Threat Scan

Request for Comment:

The Federal Communications Commission (FCC) is seeking comments on the effectiveness of security measures to prevent unauthorized location tracking using SS7 and Diameter protocols. 

It includes information on incidents where attackers exploited these protocols to track users, the specific vulnerabilities used, and the response taken by communication service providers, as it is also interested in learning about any misuse of leased global titles for location tracking in the US. 

Information on how cell phone providers are securing customer location data transmitted via SS7 and Diameter protocols, as they are interested in specific measures taken to address location tracking vulnerabilities, including adherence to CSRIC recommendations and GSMA best practices. 

The FCC also wants to understand how providers are preventing location information exploitation during roaming and by companies with leased global titles, as they inquire about challenges faced by providers in implementing security measures and how to gain better visibility into these practices across all service providers.  

It is inviting interested parties to submit comments electronically via ECFS or on paper, where paper filings must be addressed with specific instructions.

Is Your Network Under Attack? – Read CISO’s Guide to Avoiding the Next Breach – Download Free Guide