The IT Nerd

A CBC news report is making the rounds today, and it should give you a reason to think twice about how secure your cell phone is. In short, the report demonstrates how easy it is for hackers to track and monitor someone via their cell phone. And they only need their cell phone number to do it:

This is all possible because of vulnerability in the international telecommunication network. It involves what’s known as Signalling System No. 7— or SS7.

SS7 is the way cellphone networks around the world communicate with one another. It’s a hidden layer of messages about setting up and tearing down connections for a phone call, exchanging billing information or allowing a phone to roam. But hackers can gain access to SS7, too.

And:

That can go beyond spying on phone conversations or geolocating a phone. SS7 attacks can also be used to alter, add or delete content.

For example, Nohl said he could set up a person’s cellphone voicemail so all messages went directly to him. The user might never know the messages were missing.

“The technology is built with good intentions to make a very useful phone network and good user experience but it lacks any kind of security and it’s open to abuse.”.

The report then illustrates how easy it is to leverage this flaw to track someone. I would suggest reading the report as it is quite frightening. But what’s more frightening is how Canadian telcos responded to this report:

Bell, Rogers and the Canadian Wireless Telecommunications Association declined to sit down with CBC/Radio-Canada and speak about the test results.

Via email, CBC/Radio-Canada sent a series of questions about what the networks were doing to prevent SS7 attacks and why customers weren’t being told conversations could be compromised. Both networks responded with general statements about their security efforts.

Rogers Communications said security is a top priority and that it has a cybersecurity team monitoring threats and is introducing new measure to protect customers.

“On SS7, we have already introduced and continue to implement the most advanced technologies but we are unable to share specific details for security reasons.”

Bell sent a two-line response.

“Bell works with international industry groups such as the GSMA [an international mobile phone operators association] to identify and address emerging security risks, including those relating to SS7.”

A spokesperson added that Bell is “an active participant” in the Canadian Security Telecommunications Advisory Committee.

The group that represents Canadian telecoms was also fairly tight-lipped. The Canadian Wireless Telecommunications Association said it works with domestic and international bodies on security standards. It also said it works with law enforcement to “actively monitor and address risks.”

I’m sorry, but they need to do way better than that. While the threat is a problem for any telco almost anywhere on Earth, you have to know and see that the telco that you use has your back when it comes to security. What I am hearing from these companies doesn’t meet that bar. It’s actually not even close to that bar. That’s a problem. So is the fact that “Big three” member Telus is missing from this conversation. So are second tier companies like Public Mobile, Freedom Mobile, and the like. All of these companies need to step up and tell Canadians how they are going to ensure that their customers are protected.

Speaking of protection, here’s how you can protect yourself:

“If you’re using Signal, WhatsApp, Skype, you’re certainly protected from SS7 attacks…. But there’s other types of attacks that could happen against you, your computer, your phone. So you’re never fully safe.”

When it comes to having your movements tracked, Nohl said the only protection is to turn your phone off — something that’s not always practical.

That’s another reason why Canadian telcos need to step up and tell Canadians how they are going to be protected from this. And they need to do it now.

This entry was posted on November 22, 2017 at 9:33 pm and is filed under Commentary with tags Canada, wireless. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.