3

I am aware of the risks of SS7 for mobile users. Attackers can get location information, send spoofed texts, cause DoS and intercept phone calls/texts.

Do those risks still apply for landlines? There is no roaming support, so I would assume call interception would be harder as the attacker wouldn't be able to say "this SIM is roaming on my network, send me all the calls!" to the home network's HLR.

  • Although not directly related, remember that at least in the U.S. it's almost impossible to get an actual landline phone any more; what the companies give you instead is a VOIP phone. – Xiong Chiamiov Mar 23 '17 at 14:49
  • @XiongChiamiov actually I am indeed using VoIP, but for the SS7 side that shouldn't change anything, and I am aware of the attack surface of the VoIP side. – André Borie Mar 23 '17 at 16:59
  • @XiongChiamiov It is not almost impossible but it is somewhat difficult like you point out. If you are not careful you can certainly get duped by the phone company into getting fake landline service. On AT&T's website you have to dig real hard to find their traditional landline service page. Nevertheless, if you really want it, you can get it. – InterLinked Oct 27 '18 at 10:02
1

In search of an answer to this question, I decided to do some research and see if I could find out myself.

Your thinking seems to be on the right track:

60 Minutes showed Karsten Nohl, a German computer scientist, remotely attacking U.S. Congressman Ted Lieu’s cell phone and listening to his cell phone calls... The spying was allowed by security bugs in the global telecommunications network known as Signaling System No. 7 (a/k/a SS7), which allows carriers to connect so they can offer roaming and texting. According to Nohl, SS7 will be used for the next 10 to 15 years until its replacement (Diameter) is implemented, and Diameter is also vulnerable. — Landlines still a safe way to communicate but telephone companies want to drop them

Most of what I could find does not mention anything about landlines being affected. I can only find mentions of mobile phones being affected:

Who is affected by the vulnerability? Should a hacker gain entry to the SS7 system on any number of networks, or if they are used by a law enforcement agency as part of its surveillance, anyone with a mobile phone could be vulnerable. — SS7 hack explained: what can you do about it?

Another article detailing this issue mentions that SS7 is 43 years old but focuses exclusively on mobile technology that was hardly existent then.

President Trump recently made headlines as well because of the SS7 vulnerabilities.

Trump has been asked to give up his third iPhone but wants to keep it as “unlike his other two phones, he can store his contacts in it.” And while he’s encouraged to use the White House’s secure landline for conversations, he reportedly doesn’t want the calls going through the switchboard and logged for senior aides to see. US intelligence agencies believe spies from China and Russia are eavesdropping on Trump’s calls—even those using the secure iPhones—by intercepting them as they travel through national and international cellphone networks. — China and Russia are reportedly eavesdropping on Trump's phone calls: He's been advised to use the White House's secure landline

Note the mention of secure landline. The government uses encrypted landlines that ordinary consumers do not. It's possible ordinary landlines may also be somehow vulnerable. The article does not say whether an ordinary landline would be more vulnerable. Secure landlines have been mentioned in more than one article:

Mr. Trump’s aides have repeatedly warned him that his cellphone calls are not secure, and they have told him that Russian spies are routinely eavesdropping on the calls, as well. But aides say the voluble president, who has been pressured into using his secure White House landline more often these days, has still refused to give up his iPhones. — When Trump Phones Friends, the Chinese and the Russians Listen and Learn

The government currently uses Secure Terminal Equipment for its secure landline communications. This replaced STU-III, which was used from 1987 until 2008. To be clear, this is not technology that ordinary civilians would normally be using.

I do find this all a little ironic considering that Signaling System 7 was intended to replace in-band signaling, which allowed anyone with a tone generator to reroute calls on Ma Bell's analog long distance network. SS7 is still more phreak-proof in the sense that end-customers can no longer do that.

The SS7 system CCS-7, which dates to the 1970’s, is riddled with security vulnerabilities like the absence of encryption or service message validation. For a long time, it didn’t pose any risk to subscribers or operators, as the SS7 network was a closed system available only to landline operators — Primary Security Threats for SS7 Cellular Networks

Given that mobile phones were barely in use when Signaling System 7 replaced the multi-frequency based signaling system that had been in place since the 1940s, I don't think it's exactly fair either to say that SS7 was designed with vulnerabilities, because they weren't vulnerabilities at the time we transitioned to it.

To answer the question, the security risks seem to be mostly surrounding location and access to content on the device, and since none of that applies to landlines and I found references recommending using landlines to circumvent SS7 security issues (despite the fact they rely on SS7 for long-distance as well), I can say that landlines are certainly a much more secure choice and are likely not affected by it. If anyone else finds something, though, I'd like to hear it; there's very little circulating online about how landlines are affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.