Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/3/2018
02:00 PM
Michael Downs
Michael Downs
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

In Mobile, It's Back to the Future

The mobile industry keeps pushing forward while overlooking some security concerns of the past.

The mobile revolution has advanced so fast that we might have missed some critical steps on the way. For example, ever notice how many key elements in this dynamic field seem highly contradictory?

First, of course, there's the work-play equation: every emerging mobile innovation is specifically designed to be consumer-friendly, yet many are undeniably fundamental to business productivity, which mandates different priorities. Next, most users know just enough about mobile technologies to embrace and depend on new tools as they arrive, but not nearly enough to keep those practices secure. And perhaps most importantly, the mobile industry is constantly pushing us forward — new form factors, new platforms, new channels, new apps — but the challenge to true progress might be some security concerns from the past.

All that helps explain why the near future is such a mix of potential and peril. Sure, the endless stream of new technologies will keep coming — think 5G, or the Internet of Things, and surely others we don't know about yet. Each innovation will bring with it greater access, lower costs, enhanced convenience, and a bunch of other benefits. But at the same time, without some remedial action, we'll leave ourselves increasingly vulnerable to hacks, attacks, and outright theft.

So, what can we see coming down the pike that might bring dangers later on? More to the point, what should users know that they don't?

Let's start with SS7. Officially, this is a telecom protocol defined by the International Telecommunication Union  as a way to offload public switched telephone network data traffic congestion onto a wireless or wireline digital broadband network. Because that likely doesn't mean much to folks not working in telecommunications, here's just a sampling of different areas in which it's used: basic call setup, management, and teardown; personal communications and other wireless services, wireless roaming, and mobile subscriber authentication; local number portability; toll-free services; and enhanced features such as call forwarding and three-way calling; and optimal security. In other words, even if we don't think about it, we all use it every day.

Now let's turn to 5G. Think your current download speed is pretty good? This pending standard will make it seem tortoise-like. It's the next big thing, succeeding the International Mobile Telecommunications-Advanced Standard, or 4G (and sometimes 4.5G). The benefits are undeniable: Data rates of 100 Mbps in metropolitan areas, 1 Gbps simultaneously to workers on the same office floor, hundreds of thousands of simultaneous connections for wireless sensors, and much more. It will alter our reception and appreciation of everything from cable TV to physical objects that get an IoT hookup.

Finally, consider Diameter. This is the upcoming authentication, authorization, and accounting protocol, and it's in a rush. By 2021, it's expected to generate 595 million messages per second.

And now for the bad news.

It was reported this summer that some cybercriminals were draining bank accounts around Germany. They didn't actually hack the banks — they got a customer's username, password, and telephone number, then used SS7 vulnerabilities to reroute the two-factor codes that serve as the ultimate defense.

Remember, the whole point of SS7 is carrier interoperability. Without it, we couldn't get a text or call from anyone outside the network (or the country). The basic belief is that this process can't happen — seamlessly, instantly, easily — without a certain level of trust. For example, carriers need to identify the location of a device specifically to route the call to the nearest cell tower. If scammers can spoof a carrier to ask the same question, they'll get the same answer — and enable all kinds of fraud.

But here's the worst part: this is not new. Security specialists and others have been saying for years that SS7 has fundamental security issues — and Diameter has them too. So, in the future we'll have not just mobile devices but every corner of IoT (cars, kitchens, utilities) running on 5G, SS7, and Diameter. It will be high speed and highly insecure.

There's some action on the legislative front: Arizona's HB 2365 law seeks to streamline the permitting process for faster networks (as does pending legislation in other states), while the US Senate is considering action to accelerate 5G implementation. But security is a more difficult issue.

When new mobile networks rely on network protocols littered with vulnerabilities, multiple filters can help secure SS7. But ultimately, every organization in the chain needs to ensure constant monitoring and assessments to not only identify vulnerabilities but also stay one step ahead of emerging zero-day exploits. That will require innovative technologies such as artificial intelligence and machine learning, to be sure, but also solid reverse engineering and network visibility coupled with human analysis. Some of this might sound old-fashioned — but in the future, that's just what we need.

Related Content:

Michael Downs has been assisting telecoms and mobile providers address the business impact from cybersecurity risks for nearly 20 years. At Positive Technologies, he works side by side with the penetration testing team and research specialists to help mobile network operators ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JainishP529
50%
50%
JainishP529,
User Rank: Apprentice
8/25/2019 | 12:15:14 PM
Network
The network has connected the whole internet between us. that's useful to connect internet. because of the internet is growing more popular. 
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13157
PUBLISHED: 2019-11-22
nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...