SS7 Security Vulnerabilities - The Australian Government to Require SMS/MMS Sender ID Registraion

The broader security problem of legacy SS7 signaling protocols lacking authentication, enabling state actors like Russia or Saudi Arabia to track dissidents by querying cell location data from foreign telcos.

Legacy SS7 signaling protocols suffer from a critical lack of authentication, allowing foreign state actors like Russia or Saudi Arabia to exploit the network for global surveillance. By sending simple queries to domestic carriers, these regimes can track the precise cell locations of dissidents even when they are located within the United States. Although the FCC has attempted to address related vulnerabilities through the SHAKEN/STIR mandate for Caller ID, the rollout remains incomplete and notably fails to protect SMS or MMS communications. This leaves a dangerous gap where outdated telecommunications infrastructure continues to prioritize seamless connectivity over the fundamental security of its users.

View on HN · Topics

That's why in 2020 the FCC belatedly mandated SHAKEN/STIR to authenticate Caller ID in the US using public-key cryptography. Deployment is still work in progress, and it does not cover SMS/MMS, however.

A bigger problem is Russia or Saudi Arabia using the SS7 signalling network to track their dissidents in the US because those legacy telco protocols have basically no authentication whatsoever, and won't blink if a Saudi Telco sends Verizon a MAP message saying "what is the cell location of Jamal Khashoggi's phone?"