phone - Do SS7-based attacks affect landlines? - Information ...

I am aware of the risks of SS7 for mobile users. Attackers can get location information, send spoofed texts, cause DoS and intercept phone calls/texts.
Do those risks still apply for landlines? There is no roaming support, so I would assume call interception would be harder as the attacker wouldn't be able to say "this SIM is roaming on my network, send me all the calls!" to the home network's HLR.
@XiongChiamiov It is not almost impossible but it is somewhat difficult like you point out. If you are not careful you can certainly get duped by the phone company into getting fake landline service. On AT&T's website you have to dig real hard to find their traditional landline service page. Nevertheless, if you really want it, you can get it.
1 Answer
1
In search of an answer to this question, I decided to do some research and see if I could find out myself.
Your thinking seems to be on the right track:
60 Minutes showed Karsten Nohl, a German computer scientist, remotely
attacking U.S. Congressman Ted Lieu’s cell phone and listening to his
cell phone calls... The spying was allowed by security bugs in the
global telecommunications network known as Signaling System No. 7
(a/k/a SS7), which allows carriers to connect so they can offer
roaming and texting. According to Nohl, SS7 will be used for the next
10 to 15 years until its replacement (Diameter) is implemented, and
Diameter is also vulnerable. — Landlines still a safe way to communicate but telephone companies want to drop them
Most of what I could find does not mention anything about landlines being affected. I can only find mentions of mobile phones being affected:
Who is affected by the vulnerability? Should a hacker gain entry to the SS7 system on any number of networks, or if they are used by a law enforcement agency as part of its surveillance, anyone with a mobile phone could be vulnerable. — SS7 hack explained: what can you do about it?
President Trump recently made headlines as well because of the SS7 vulnerabilities.
Trump has been asked to give up his third iPhone but wants to keep it as “unlike his other two phones, he can store his contacts in it.” And while he’s encouraged to use the White House’s secure landline for conversations, he reportedly doesn’t want the calls going through the switchboard and logged for senior aides to see. US intelligence agencies believe spies from China and Russia are eavesdropping on Trump’s calls—even those using the secure iPhones—by intercepting them as they travel through national and international cellphone networks. — China and Russia are reportedly eavesdropping on Trump's phone calls: He's been advised to use the White House's secure landline
Note the mention of secure landline. The government uses encrypted landlines that ordinary consumers do not. It's possible ordinary landlines may also be somehow vulnerable. The article does not say whether an ordinary landline would be more vulnerable. Secure landlines have been mentioned in more than one article:
Mr. Trump’s aides have repeatedly warned him that his cellphone calls are not secure, and they have told him that Russian spies are routinely eavesdropping on the calls, as well. But aides say the voluble president, who has been pressured into using his secure White House landline more often these days, has still refused to give up his iPhones. — When Trump Phones Friends, the Chinese and the Russians Listen and Learn
The government currently uses Secure Terminal Equipment for its secure landline communications. This replaced STU-III, which was used from 1987 until 2008. To be clear, this is not technology that ordinary civilians would normally be using.
I do find this all a little ironic considering that Signaling System 7 was intended to replace in-band signaling, which allowed anyone with a tone generator to reroute calls on Ma Bell's analog long distance network. SS7 is still more phreak-proof in the sense that end-customers can no longer do that.
The SS7 system CCS-7, which dates to the 1970’s, is riddled with security vulnerabilities like the absence of encryption or service message validation. For a long time, it didn’t pose any risk to subscribers or operators, as the SS7 network was a closed system available only to landline operators — Primary Security Threats for SS7 Cellular Networks
Given that mobile phones were barely in use when Signaling System 7 replaced the multi-frequency based signaling system that had been in place since the 1940s, I don't think it's exactly fair either to say that SS7 was designed with vulnerabilities, because they weren't vulnerabilities at the time we transitioned to it.
To answer the question, the security risks seem to be mostly surrounding location and access to content on the device, and since none of that applies to landlines and I found references recommending using landlines to circumvent SS7 security issues (despite the fact they rely on SS7 for long-distance as well), I can say that landlines are certainly a much more secure choice and are likely not affected by it. If anyone else finds something, though, I'd like to hear it; there's very little circulating online about how landlines are affected.
The U.S. National Institute of Standards and Technology (NIST)
announced in July 2016 that organizations should no longer send one
time passwords to mobile phones. The reasoning? This approach is
simply not secure. NIST—which both corporations and U.S. regulatory
agencies look to for cybersecurity compliance—determined that thieves
can too easily steal one time passwords sent to phones via SMS text
message. (The same applies to voice codes sent over landlines,
according to the agency.)