Hacker News new | past | comments | ask | show | jobs | submit login

All? But it's something internal to networks and between networks, not between a network and a user device, so I don't see the relevance to IMEI catchers which intercept the radio link.

Answer delayed by hours due to HN rate limiting.




> All?

None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.


You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone?

https://www.youtube.com/watch?v=wVyu7NB7W6Y

Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there?

And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7:

https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable...

Are you saying they're just wrong, those SS7 networks don't exist in the USA?

I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf

    The Signaling System 7 (SS7) and Diameter protocols play a critical role in
    U.S. telecommunications infrastructure supporting fixed and mobile service
    providers in processing and routing calls and text messages between networks,
    enabling interconnection between fixed and mobile networks, and providing call
    session information such as Caller ID and billing data for circuit switched
    infrastructure. Over the last several years, numerous reports have called
    attention to security vulnerabilities present within SS7 networks and suggest
    that attackers target SS7 to obtain subscribers’ location information.
This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing.

It sounds like you're talking mince.


Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.


You just sound like an unreliable witness.

If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them).

If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there?

Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/secur...

Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/secur...


That attack demonstrated on Linus channel, while it IS about SS7 I doubt it had SS7 interfaced in USA/Canada. Important details were left in that demo, while some hints were given. SS7 is definitely a thing in some countries though. Linus channel demonstrated attack is not a direct one, but rather trickery, in way similar to domains 'apple.com' and 'аррle.com'.


I directly ask you: do you think there is at least one SS7 network in the USA or Canada, yes or no?

If you claim there are no SS7 networks in the USA or Canada, please explain:

1) why the FCC believes they exist and need to be secured, as per their March 2024 note

2) what the UMTS networks, still operational in Canada, are using for messaging (note the 2025 dates in https://en.wikipedia.org/wiki/3G#Phase-out for Canada; 2G/3G is still alive and well there. And I note that most of the 3G phase out in the USA was in 2022, not in 2014 which is what they'd have to be for you to not have seen SS7 for a decade)

3) what the POTS networks, still operational in the USA and Canada, are using for messaging (noting that FCC 19-72 only removes the requirement on ILECs to provide UME Analog Loops to CLECs, and does not require them to shut down POTS networks entirely by August 2022. For example, AT&T only plans to have transitioned 50% of its POTS network by 2025)




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: