5

I am aware of the risks of SS7 for mobile users. Attackers can get location information, send spoofed texts, cause DoS and intercept phone calls/texts.

Do those risks still apply for landlines? There is no roaming support, so I would assume call interception would be harder as the attacker wouldn't be able to say "this SIM is roaming on my network, send me all the calls!" to the home network's HLR.

3
  • Although not directly related, remember that at least in the U.S. it's almost impossible to get an actual landline phone any more; what the companies give you instead is a VOIP phone. Commented Mar 23, 2017 at 14:49
  • @XiongChiamiov actually I am indeed using VoIP, but for the SS7 side that shouldn't change anything, and I am aware of the attack surface of the VoIP side. Commented Mar 23, 2017 at 16:59
  • @XiongChiamiov It is not almost impossible but it is somewhat difficult like you point out. If you are not careful you can certainly get duped by the phone company into getting fake landline service. On AT&T's website you have to dig real hard to find their traditional landline service page. Nevertheless, if you really want it, you can get it. Commented Oct 27, 2018 at 10:02

1 Answer 1

2

In search of an answer to this question, I decided to do some research and see if I could find out myself.

Your thinking seems to be on the right track:

60 Minutes showed Karsten Nohl, a German computer scientist, remotely attacking U.S. Congressman Ted Lieu’s cell phone and listening to his cell phone calls... The spying was allowed by security bugs in the global telecommunications network known as Signaling System No. 7 (a/k/a SS7), which allows carriers to connect so they can offer roaming and texting. According to Nohl, SS7 will be used for the next 10 to 15 years until its replacement (Diameter) is implemented, and Diameter is also vulnerable. — Landlines still a safe way to communicate but telephone companies want to drop them

Most of what I could find does not mention anything about landlines being affected. I can only find mentions of mobile phones being affected:

Who is affected by the vulnerability? Should a hacker gain entry to the SS7 system on any number of networks, or if they are used by a law enforcement agency as part of its surveillance, anyone with a mobile phone could be vulnerable. — SS7 hack explained: what can you do about it?

Another article detailing this issue mentions that SS7 is 43 years old but focuses exclusively on mobile technology that was hardly existent then.

President Trump recently made headlines as well because of the SS7 vulnerabilities.

Trump has been asked to give up his third iPhone but wants to keep it as “unlike his other two phones, he can store his contacts in it.” And while he’s encouraged to use the White House’s secure landline for conversations, he reportedly doesn’t want the calls going through the switchboard and logged for senior aides to see. US intelligence agencies believe spies from China and Russia are eavesdropping on Trump’s calls—even those using the secure iPhones—by intercepting them as they travel through national and international cellphone networks. — China and Russia are reportedly eavesdropping on Trump's phone calls: He's been advised to use the White House's secure landline

Note the mention of secure landline. The government uses encrypted landlines that ordinary consumers do not. It's possible ordinary landlines may also be somehow vulnerable. The article does not say whether an ordinary landline would be more vulnerable. Secure landlines have been mentioned in more than one article:

Mr. Trump’s aides have repeatedly warned him that his cellphone calls are not secure, and they have told him that Russian spies are routinely eavesdropping on the calls, as well. But aides say the voluble president, who has been pressured into using his secure White House landline more often these days, has still refused to give up his iPhones. — When Trump Phones Friends, the Chinese and the Russians Listen and Learn

The government currently uses Secure Terminal Equipment for its secure landline communications. This replaced STU-III, which was used from 1987 until 2008. To be clear, this is not technology that ordinary civilians would normally be using.

I do find this all a little ironic considering that Signaling System 7 was intended to replace in-band signaling, which allowed anyone with a tone generator to reroute calls on Ma Bell's analog long distance network. SS7 is still more phreak-proof in the sense that end-customers can no longer do that.

The SS7 system CCS-7, which dates to the 1970’s, is riddled with security vulnerabilities like the absence of encryption or service message validation. For a long time, it didn’t pose any risk to subscribers or operators, as the SS7 network was a closed system available only to landline operators — Primary Security Threats for SS7 Cellular Networks

Given that mobile phones were barely in use when Signaling System 7 replaced the multi-frequency based signaling system that had been in place since the 1940s, I don't think it's exactly fair either to say that SS7 was designed with vulnerabilities, because they weren't vulnerabilities at the time we transitioned to it.

To answer the question, the security risks seem to be mostly surrounding location and access to content on the device, and since none of that applies to landlines and I found references recommending using landlines to circumvent SS7 security issues (despite the fact they rely on SS7 for long-distance as well), I can say that landlines are certainly a much more secure choice and are likely not affected by it. If anyone else finds something, though, I'd like to hear it; there's very little circulating online about how landlines are affected.

Recent update:

According to NIST, landlines may not be immune after all:

The U.S. National Institute of Standards and Technology (NIST) announced in July 2016 that organizations should no longer send one time passwords to mobile phones. The reasoning? This approach is simply not secure. NIST���which both corporations and U.S. regulatory agencies look to for cybersecurity compliance—determined that thieves can too easily steal one time passwords sent to phones via SMS text message. (The same applies to voice codes sent over landlines, according to the agency.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .