{"id":49239,"date":"2016-04-26T10:31:05","date_gmt":"2016-04-26T17:31:05","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=49239"},"modified":"2025-08-31T22:30:26","modified_gmt":"2025-09-01T05:30:26","slug":"ss7-flaw-how-hackers-abuse-it","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/ss7-flaw-how-hackers-abuse-it\/","title":{"rendered":"The SS7 Flaw: What it is, and How Hackers Abuse It"},"content":{"rendered":"

Users don\u2019t always have it easy when it comes to online security. Beyond the plethora of passwords, usernames, security questions and websites to remember, you still have to be on guard for malicious application and programs. Now you can add the security of obscure, but critical, technologies<\/a> to that list.<\/p>\n

60 Minutes <\/em>recently published a segment on the security worries around an obscure, but important, backend technology for mobile networks. The technology in question is called Signaling System Seven<\/a>, or SS7. It\u2019s a critical part of the overall security posture for mobile phone. Let me put it this way: if mobile security were a Jenga tower, then SS7 would be the one peg the entire tower balances on.<\/p>\n

In this case, the peg is a global network connecting carriers with phone users. SS7 is a critical piece of the mobile puzzle, allowing phone networks to exchange data, phone calls, messages and more. It\u2019s also the technology that allows travelers to roam on other networks while traveling abroad, and helps banks to confirm mobile payments via geolocation. For today\u2019s mobile world, it\u2019s a critical, but quiet, part of our daily lives.<\/p>\n

The problem, however, is that anyone with their hands on someone\u2019s phone number (and a lot of know-how) can use SS7 to intercept calls and record messages with relatively little work. What\u2019s more, it\u2019s very difficult to stop an SS7 attack; it can happen even if you follow security best practices<\/strong>.<\/p>\n

It\u2019s unsettling, but it\u2019s not all bad news. For one, you likely don\u2019t have to worry about someone surveilling you with SS7. That\u2019s largely because SS7\u2019s potential security dangers have been known since 2014 and also because such a powerful technique would probably be utilized to spy on individuals in positions of power. For another, we\u2019re talking openly about SS7 vulnerabilities, which means industry associations, companies and networks want to see the vulnerabilities fixed.<\/p>\n

Over the coming years, SS7 will be patched, if not outright replaced (as Ars Technica reports<\/a>), for your protection. You can expect the same sort of treatment for many of the outdated, or insecure, industrial technologies we use day to day.<\/p>\n

Mobile Security Best Practices<\/h2>\n

So, what can you do in the meantime? Well, there\u2019s little you or I could do to defend against SS7 attacks at this time, but it still pays to stick to mobile security best practices. So keep these tips in mind as you use your mobile devices:<\/p>\n