DHS Says China, Russia, Iran, and Israel Are Spying on People in US with SS7
www.404media.co
The Department of Homeland Security knows which countries SS7 attacks are primarily originating from. Others include countries in Europe, Africa, and the Middle East.

Summary

The Department of Homeland Security (DHS) has identified China, Russia, Iran, and Israel as the primary countries exploiting vulnerabilities in SS7, a telecom protocol, to spy on individuals in the U.S.

This includes tracking locations and intercepting calls and messages.

Newly released information, revealed by Senator Ron Wyden, links these attacks to foreign nations and builds on prior reports of SS7 exploitation.

A 2017 DHS presentation highlighted these risks, showing persistent concerns over SS7’s security flaws.

The disclosure underscores ongoing surveillance threats targeting U.S. telecommunications networks.

  • @Rapidcreek@lemmy.world
    19•5 days ago

    SS7 is a signaling protocol. It does specific things between exchanges. For example, you make a long distance call…before you input the last four numbers, SS7 has signaled the end office that a call is to be setup. As the last four numbers are dialed, the connection is interrogated and if free completes the connection, hello. But if it’s busy, SS7 signals back to your office to activate its tone generator to produce a busy signal. Magic. Very little resources are used. Knew a guy who was very good in SS7 and he claimed he could do some shit.

    • @Brkdncr@lemmy.world
      13•5 days ago

      I took a networking course and the teacher did 2 weeks in telephone protocols all the way from Morse code. Ss7 is magic.

    • @SanctimoniousApe
      9•5 days ago

      That’s all well and good, but doesn’t address the point of the post in that it’s apparently insecure AF.

      • @Rapidcreek@lemmy.world
        4•4 days ago

        Hmmmmm. The first thing to remember is the only thing SS7 does is signal. No call processing. Also, the network control of SS7 is isolated, with only links to the processor (STP) being the exchanges themselves. You can simulate SS7 to the exchange which will cause a call setup to the exchange. But, that is a hack into the local exchange and not really SS7. Anyway, it would seem to me to be more work than worth.

  • Flying Squid
    10•4 days ago

    Surely nowhere near just those four.

    Swaziland’s probably doing it. Why not? It’s obviously not a challenge.

  • @hnh@lemmy.world
    3•5 days ago

    It’s not that difficult to secure SS7, there are lots of good firewalls out there. But it takes effort and costs money…