Endpoint

1/3/2018
02:00 PM
Michael Downs
Michael Downs
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

In Mobile, It's Back to the Future

The mobile industry keeps pushing forward while overlooking some security concerns of the past.

The mobile revolution has advanced so fast that we might have missed some critical steps on the way. For example, ever notice how many key elements in this dynamic field seem highly contradictory?

First, of course, there's the work-play equation: every emerging mobile innovation is specifically designed to be consumer-friendly, yet many are undeniably fundamental to business productivity, which mandates different priorities. Next, most users know just enough about mobile technologies to embrace and depend on new tools as they arrive, but not nearly enough to keep those practices secure. And perhaps most importantly, the mobile industry is constantly pushing us forward — new form factors, new platforms, new channels, new apps — but the challenge to true progress might be some security concerns from the past.

All that helps explain why the near future is such a mix of potential and peril. Sure, the endless stream of new technologies will keep coming — think 5G, or the Internet of Things, and surely others we don't know about yet. Each innovation will bring with it greater access, lower costs, enhanced convenience, and a bunch of other benefits. But at the same time, without some remedial action, we'll leave ourselves increasingly vulnerable to hacks, attacks, and outright theft.

So, what can we see coming down the pike that might bring dangers later on? More to the point, what should users know that they don't?

Let's start with SS7. Officially, this is a telecom protocol defined by the International Telecommunication Union  as a way to offload public switched telephone network data traffic congestion onto a wireless or wireline digital broadband network. Because that likely doesn't mean much to folks not working in telecommunications, here's just a sampling of different areas in which it's used: basic call setup, management, and teardown; personal communications and other wireless services, wireless roaming, and mobile subscriber authentication; local number portability; toll-free services; and enhanced features such as call forwarding and three-way calling; and optimal security. In other words, even if we don't think about it, we all use it every day.

Now let's turn to 5G. Think your current download speed is pretty good? This pending standard will make it seem tortoise-like. It's the next big thing, succeeding the International Mobile Telecommunications-Advanced Standard, or 4G (and sometimes 4.5G). The benefits are undeniable: Data rates of 100 Mbps in metropolitan areas, 1 Gbps simultaneously to workers on the same office floor, hundreds of thousands of simultaneous connections for wireless sensors, and much more. It will alter our reception and appreciation of everything from cable TV to physical objects that get an IoT hookup.

Finally, consider Diameter. This is the upcoming authentication, authorization, and accounting protocol, and it's in a rush. By 2021, it's expected to generate 595 million messages per second.

And now for the bad news.

It was reported this summer that some cybercriminals were draining bank accounts around Germany. They didn't actually hack the banks — they got a customer's username, password, and telephone number, then used SS7 vulnerabilities to reroute the two-factor codes that serve as the ultimate defense.

Remember, the whole point of SS7 is carrier interoperability. Without it, we couldn't get a text or call from anyone outside the network (or the country). The basic belief is that this process can't happen — seamlessly, instantly, easily — without a certain level of trust. For example, carriers need to identify the location of a device specifically to route the call to the nearest cell tower. If scammers can spoof a carrier to ask the same question, they'll get the same answer — and enable all kinds of fraud.

But here's the worst part: this is not new. Security specialists and others have been saying for years that SS7 has fundamental security issues — and Diameter has them too. So, in the future we'll have not just mobile devices but every corner of IoT (cars, kitchens, utilities) running on 5G, SS7, and Diameter. It will be high speed and highly insecure.

There's some action on the legislative front: Arizona's HB 2365 law seeks to streamline the permitting process for faster networks (as does pending legislation in other states), while the US Senate is considering action to accelerate 5G implementation. But security is a more difficult issue.

When new mobile networks rely on network protocols littered with vulnerabilities, multiple filters can help secure SS7. But ultimately, every organization in the chain needs to ensure constant monitoring and assessments to not only identify vulnerabilities but also stay one step ahead of emerging zero-day exploits. That will require innovative technologies such as artificial intelligence and machine learning, to be sure, but also solid reverse engineering and network visibility coupled with human analysis. Some of this might sound old-fashioned — but in the future, that's just what we need.

Related Content:

Michael Downs has been assisting telecoms and mobile providers address the business impact from cybersecurity risks for nearly 20 years. At Positive Technologies, he works side by side with the penetration testing team and research specialists to help mobile network operators ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.