It’s the mobile vulnerability that won’t go away: Security concerns about Signaling System 7 (SS7), a set of four-decade-old telephony signaling protocols, have flared up in recent weeks after a U.S. senator reported that an unnamed mobile carrier had been breached.

Mobile security experts have long recognized vulnerabilities in the SS7 protocol, which can enable cybercriminals to gain access to smartphones’ data, locations, calls and texts.

On May 29, 2018, Sen. Ron Wyden wrote in a letter to the Federal Communications Commission (FCC) that SS7 is “riddled with long-standing cybersecurity vulnerabilities that pose a major national security threat.” Criminals and foreign governments can use SS7 vulnerabilities to “prey on unsuspecting consumers,” Wyden wrote.

Wyden had previously raised his concerns with Christopher Krebs, the president’s nominee for Undersecretary of the National Protection and Programs Directorate (NPPD) within the Department of Homeland Security (DHS). In a May 22, 2018 letter to Wyden, Krebs acknowledged that threat actors might have exploited SS7 to target U.S. residents’ communications.

Government and Industry Players Address the SS7 Flaw

According to Ian Eyberg, CEO of virtual machine vendor NanoVMs, cybercriminals have been targeting SS7 for 25 years.

“There are companies that sell cell tracking packages based on SS7 flaws — that’s how bad it has gotten,” Eyberg said. “What’s disturbing is that year after year, security researchers find more and more things wrong with the protocol.”

While Wyden is pushing the FCC and DHS to address SS7 flaws, some influential players in the mobile industry have already moved to protect against smartphone attacks. CTIA, a U.S. trade group representing carriers, worked with the FCC on SS7 vulnerabilities following a 2016 “60 Minutes” special that detailed how cybercriminals can track phone owners and intercept calls and text messages.

U.S. mobile operators have endorsed several FCC recommendations, including monitoring and filtering signaling interconnections.

“The wireless industry is committed to safeguarding consumer security and privacy and collaborates closely with the DHS, FCC and other stakeholders to combat evolving threats that could impact communications networks,” a CTIA spokesman said.

Attacks Persist Despite Better Mobile Security Tools

Many mobile security experts still see avenues of attack, however. Positive Technologies, a security monitoring firm, found that a whopping 100 percent of SS7-based SMS interception attacks that took place on European and Middle Eastern mobile phone networks during 2016 and 2017 were successful.

“Virtually every network allowed eavesdropping on conversations and reading incoming text messages,” the company asserted in a March 2018 press release accompanying the report. “Use of SMS for two-factor authentication means that if a hacker is able to access a subscriber’s text messages, they can go on to compromise accounts for online banks, stores, government services and much more.”

The researchers noted a decrease in successful SS7-based attacks between an earlier study in 2015 and 2017. This drop could be due to the proliferation of ready-made mobile security solutions in the market, they suggested. Still, all of the mobile networks studied in 2017 were susceptible to SS7-based attacks looking for subscriber information, subscriber traffic interception and subscriber denial-of-service (DoS) attacks.

How Can Consumers Protect Themselves?

According to Dan Tara, executive vice president of Positive Technologies, there are no significant actions mobile customers can take.

“Attacks on the SS7 network are conducted from the outside and are aimed at extracting or modifying data in the network devices of the operator infrastructure,” Tara said. “Subscribers cannot resist these attacks in any way because they’re outside of the SS7 network perimeter.” Instead, carriers must embrace comprehensive security protections, including SS7 firewalls, he said.

Eyberg agreed that the problem is largely within the purview of mobile carriers, but customers can also help by embracing encryption, he said.

“Short of [carriers] adopting new protocols, consumers can use encrypted chat and encrypted voice applications,” Eyberg added. “However, that is not always an option for things like one-time passwords from your bank.”

Eyberg also noted that customers should pay attention when their carriers are compromised.

“I think the best individuals can do is map out the irresponsible carriers and vote with their pockets,” he said.