Vulnerabilities in the SS7 signaling protocol, which serves as the backbone of our mobile communications networks, can be used to retrieve sensitive information without the user’s knowledge, which may even result to bank account hacking. For the unfamiliar, the SS7 signaling protocol allows mobile networks around the world to send text messages to subscribers of other carriers. Using just the person’s phone number, hackers can take advantage of the weaknesses of the SS7 signaling protocol to record phone calls, read text messages and identify the user’s location. These records, along with other sensitive information, can then be used for numerous purposes, from spying on high-profile targets to using the gathered information to try hacking bank accounts. While telecoms have known that the SS7 network has weak safeguards against spying, it was only this Wednesday that a German newspaper uncovered that the vulnerabilities of the SS7 signaling protocol were used to hack and drain bank accounts.
One of the major problems with the network running the SS7 protocol is its tendency to follow whatever instructions it was given. For example, if somebody who has an access to the network requests that the communications of certain phone numbers be routed through their devices, the routing will take place. In the case of hackers who bought access to SS7 network for 1000 Euros, they could route certain phone numbers and log their SMS messages. Once information about bank transactions are transferred via SMS, the hackers can then access the bank account of their target using the information they have gathered from the routed messages, assuming they already have the account password of their target.
Given the vulnerabilities of SS7 protocol, people are asked to not use SMS-based two-factor authentication and instead, use other forms of two-factor authentication. However, there is a possibility that other forms of authentication may be affected by the weaknesses in the SS7 protocol. An example of this is Twitter, which still sends 2-factor authentication logs through SMS code even if Google Authenticator was used. Meanwhile, US lawmakers Ted Lieu and Ron Wyden, along with experts like Karsten Nohl, have long pushed for improvements in the protocol and emphasized the need for action by the FCC and the carriers.