In Mobile, It's Back to the Future

The mobile revolution has advanced so fast that we might have missed some critical steps on the way. For example, ever notice how many key elements in this dynamic field seem highly contradictory?

First, of course, there's the work-play equation: every emerging mobile innovation is specifically designed to be consumer-friendly, yet many are undeniably fundamental to business productivity, which mandates different priorities. Next, most users know just enough about mobile technologies to embrace and depend on new tools as they arrive, but not nearly enough to keep those practices secure. And perhaps most importantly, the mobile industry is constantly pushing us forward — new form factors, new platforms, new channels, new apps — but the challenge to true progress might be some security concerns from the past.

All that helps explain why the near future is such a mix of potential and peril. Sure, the endless stream of new technologies will keep coming — think 5G, or the Internet of Things, and surely others we don't know about yet. Each innovation will bring with it greater access, lower costs, enhanced convenience, and a bunch of other benefits. But at the same time, without some remedial action, we'll leave ourselves increasingly vulnerable to hacks, attacks, and outright theft.

So, what can we see coming down the pike that might bring dangers later on? More to the point, what should users know that they don't?

Let's start with SS7. Officially, this is a telecom protocol defined by the International Telecommunication Union  as a way to offload public switched telephone network data traffic congestion onto a wireless or wireline digital broadband network. Because that likely doesn't mean much to folks not working in telecommunications, here's just a sampling of different areas in which it's used: basic call setup, management, and teardown; personal communications and other wireless services, wireless roaming, and mobile subscriber authentication; local number portability; toll-free services; and enhanced features such as call forwarding and three-way calling; and optimal security. In other words, even if we don't think about it, we all use it every day.

Now let's turn to 5G. Think your current download speed is pretty good? This pending standard will make it seem tortoise-like. It's the next big thing, succeeding the International Mobile Telecommunications-Advanced Standard, or 4G (and sometimes 4.5G). The benefits are undeniable: Data rates of 100 Mbps in metropolitan areas, 1 Gbps simultaneously to workers on the same office floor, hundreds of thousands of simultaneous connections for wireless sensors, and much more. It will alter our reception and appreciation of everything from cable TV to physical objects that get an IoT hookup.

Finally, consider Diameter. This is the upcoming authentication, authorization, and accounting protocol, and it's in a rush. By 2021, it's expected to generate 595 million messages per second.

And now for the bad news.

It was reported this summer that some cybercriminals were draining bank accounts around Germany. They didn't actually hack the banks — they got a customer's username, password, and telephone number, then used SS7 vulnerabilities to reroute the two-factor codes that serve as the ultimate defense.

Remember, the whole point of SS7 is carrier interoperability. Without it, we couldn't get a text or call from anyone outside the network (or the country). The basic belief is that this process can't happen — seamlessly, instantly, easily — without a certain level of trust. For example, carriers need to identify the location of a device specifically to route the call to the nearest cell tower. If scammers can spoof a carrier to ask the same question, they'll get the same answer — and enable all kinds of fraud.

But here's the worst part: this is not new. Security specialists and others have been saying for years that SS7 has fundamental security issues — and Diameter has them too. So, in the future we'll have not just mobile devices but every corner of IoT (cars, kitchens, utilities) running on 5G, SS7, and Diameter. It will be high speed and highly insecure.

There's some action on the legislative front: Arizona's HB 2365 law seeks to streamline the permitting process for faster networks (as does pending legislation in other states), while the US Senate is considering action to accelerate 5G implementation. But security is a more difficult issue.

When new mobile networks rely on network protocols littered with vulnerabilities, multiple filters can help secure SS7. But ultimately, every organization in the chain needs to ensure constant monitoring and assessments to not only identify vulnerabilities but also stay one step ahead of emerging zero-day exploits. That will require innovative technologies such as artificial intelligence and machine learning, to be sure, but also solid reverse engineering and network visibility coupled with human analysis. Some of this might sound old-fashioned — but in the future, that's just what we need.

Related Content: