Many news articles informed this week that hackers in Germany used malware attacks to identify bank accounts, login information, password and account balances. Subsequently, they were able to redirect the SMS messages which banks used to send one-time passwords for transaction confirmation. For this they used security vulnerabilities in the SS7 protocol. The result was that the hackers were able to transfer funds out of bank accounts.
Süddeutsche Zeitung:
Schwachstelle im Mobilfunknetz: Kriminelle Hacker räumen Konten leer
What is SS7 and how can be used by hackers?
SS7 is a telephony signalling protocol used since 1975, when it was designed. It’s widely used in fixed and mobile networks around the world. Every day billions of calls and SMS messages are handled by this system.
The Guardian:
SS7 hack explained: what can you do about it?
Approximately a year ago, many news articles were published about security holes in the SS7 protocol. The CBS News editor also decided to verify this vulnerability. For this purpose, she purchased a new mobile phone and provided it to US Congressman Ted Lieu (a member of the IT Control Committee). Lieu agreed to use the phone to communicate with his employees, and informed them about possible interceptions. The editor approached Security Research Labs, who could listen to Lieu's congressional phone calls via the SS7 protocol and track his location, even when the GPS was turned off.
Tom's Guide:
How Strangers Can, and Can't, Hack Your Cellphone
Who is affected by the SS7 vulnerability?
Most known attacks on mobile devices are based on weakness of operating systems such as Android, iOS, Windows Mobile or BlackBerry (we already wrote about it here). This raises questions of whether one operating system is safer than another one. However, SS7 is a part of communication protocol that must be included on each mobile device. Even on those that are not referred as “smart”.
What to do and how to protect your privacy?
To protect against SS7 vulnerabilities is quite easy. All you need to do is to use any VoIP (voice-over internet) application instead of standard voice and SMS services provided by a mobile operator. For this purpose, you can use applications like WhatsApp, Telegram, Signal and similar. However, these applications have other security vulnerabilities. To reliably protect your privacy against wiretapping and interception it is advised to use Silentel.
Read more:
