Attacks on SS7
Master Thesis
Author
Magklaris, Eustratios
Μάγκλαρης, Ευστράτιος
Date
2019-06Advisor
Xenakis, ChristosΞενάκης, Χρήστος
View/ Open
Keywords
3G ; 4G ; GSM ; GPRS ; UMTS ; SS7 ; Telcom ; Security ; Telephone ; Call ; SMS ; GeolocationAbstract
Signalling System No 7 is the global network that interconnects all telecom operators around the world.
Even though it is still used to control 3G traffic, it was design many years ago, when most operators
were state controlled companies. Back then, modern threats could not have been foreseen and thus SS7
was adopted without any measures of security, such as authentication, integrity or confidentiality. The
whole structure of trust was based on international trade agreements between the operators.
With the emerging market liberalization and the increased switch to All-IP technology, access to SS7
has become easier than ever. Access to such an insecure network could mean the compromise of the
global telephone network, landline and mobile.
In this thesis, we analyse the structure of the SS7 protocol stack, we outline its known attacks, we
show some ways to emulate an operators network and finally we present an automated tool as a proof of
concept, along with some defence solutions.