Abstract
Today, more and more interactions rely on smart phones. Their security becomes a real concern to guarantee the protection of identity, life and property. Cybersecurity initiatives regularly emphasize the importance of good practices for passwords, updating patches, encryption or other appropriate defenses. They also announce vulnerabilities discovered in applications. But they rarely warn of the danger of SS7 (Signaling System No. 7), the stack of protocols used between 2G and 3G telecommunications network equipment, including cellular phones. This paper presents on-going research on the detection of SS7 attacks which target the SS7 Mobile Application Protocol (MAP). More specifically, we plan to detect attacks based on so-called Category 3 MAP messages which are difficult to manage with SS7 firewalls. The method verifies the consistency of the position/speed revealed by the telecommunications equipment involved in SS7 signaling when a subscriber is in outbound roaming situation. In particular, we plan to detect attacks spoofing a SS7 equipment (from anywhere in the world) and injecting Category 3 MAP messages in order to take control of voice or SMS delivery equipment, which would allow the attacker to intercept calls or SMSs or even to prevent communications.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Khandelwal, S.: Real-world SS7 attack – hackers are stealing money from bank accounts. In: The Hacker News, 4 May 2017. Accessed 25 Aug 2022
Dryburgh, L., Hewett, J.: Signaling System No. 7 (SS7/C7): Protocol, Architecture and Services. Cisco Press (2005)
Sauter, M.: From GSM to LTE: An Introduction to Mobile Networks and Mobile Broadband. Wiley, Hoboken (2011)
Ullah, K., Rashid, I., Afzal, H., Iqbal, W., Bangash, Y., Abbas, H.: SS7 vulnerabilities - a survey & implementation of machine learning vs rule based filtering for detection of SS7 network attacks. IEEE Commun. Surv. Tutor. 22, 1337–1371 (2020)
Mourad, H.: The fall of SS7 – How can the critical security controls help? https://www.sans.org/reading-room/whitepapers/critical/fall-ss7--critical-security-controls-help-36225. Accessed 25 Aug 2022
Jensen, K., Nguyen, H.T., Do, T.V., Årnes, A.: A big data analytics approach to combat telecommunication vulnerabilities. Clust. Comput. 20(3), 2363–2374 (2017). https://doi.org/10.1007/s10586-017-0811-x
Positive Technologies: SS7 Vulnerabilities and Attack Exposure Report 2018. https://www.gsma.com/membership/wp-content/uploads/2018/07/SS7_Vulnerability_2017_A4.ENG_.0003.03.pdf. Accessed 25 Aug 2022
Beumier, C.: SMS-based 2FA authentication is insecure. https://cylab.be/blog/171/sms-based-2-factor-authentication-is-insecure. Accessed 25 Aug 2022
Dabrowski, A., Pianta, N., Klepp, T., Mulazzani, M., Weippl, E.: IMSI-catch me if you can. In: ACSAC 2014 (2014)
GSMMap. https://gsmmap.org/
FS11: SS7 Interconnect Security Monitoring and Firewall Guidelines
Nikolov, G., Debatty, T., Mees, W.: Evaluation of a multi-agent anomaly-based advanced persistent threat detection framework. In: 12th International Conference on Evolving Internet (INTERNET 2020) (2020)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Beumier, C., Debatty, T. (2022). Attack Detection in SS7. In: Dziech, A., Mees, W., Niemiec, M. (eds) Multimedia Communications, Services and Security. MCSS 2022. Communications in Computer and Information Science, vol 1689. Springer, Cham. https://doi.org/10.1007/978-3-031-20215-5_2
Download citation
DOI: https://doi.org/10.1007/978-3-031-20215-5_2
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-20214-8
Online ISBN: 978-3-031-20215-5
eBook Packages: Computer ScienceComputer Science (R0)