The FCC’s Public Safety and Homeland Security Bureau is seeking input on how communication service providers are securing SS7 and Diameter protocols to prevent location-tracking vulnerabilities.
The protocols are crucial for call routing, network interconnection, and data exchange in mobile and fixed-line networks, as recent security concerns about SS7 potentially enabling unauthorized location tracking of mobile devices prompt the FCC to investigate service providers’ security measures.
The Diameter protocol, used for authentication and mobility in mobile networks, has vulnerabilities similar to the older SS7 protocol, allowing attackers to spoof their network identity and potentially gain access to user location or other sensitive information.
To mitigate these risks, recommendations include using firewalls and filters to limit access to user data, collaborating with signaling aggregators for broader network visibility, and encouraging users to adopt encryption technologies.
Continuous security assessments and information sharing are crucial for detecting and preventing attacks, as well as securing next-generation protocols like Diameter, which is essential for future mobile network security.
CSRIC VI identified location tracking as a major attack method for SS7 and Diameter vulnerabilities, where attackers can exploit the vulnerabilities to track a target’s general location (city-level) by retrieving a cell ID or serving an MSC /MSS address.
While not as precise as GPS coordinates, the information can still be valuable for attackers targeting VIPs or government officials, and to mitigate the attacks, CSRIC VI recommends secure domains and security gateways at network boundaries to reduce unauthorized access.
The FCC has encouraged implementing these recommendations and continues to monitor the industry’s progress, while Senator Wyden recently expressed concerns about these vulnerabilities and urged the FCC to take further action.
Document
@import url('https://fonts.googleapis.com/css2?family=Poppins&display=swap');
@import url('https://fonts.googleapis.com/css2?family=Poppins&family=Roboto&display=swap');
*{
margin: 0; padding: 0;
text-decoration: none;
}
.container{
font-family: roboto, sans-serif;
width: 90%;
border: 1px solid lightgrey;
padding: 20px;
background: linear-gradient(2deg,#E0EAF1 100%,#BBD2E0 100%);
margin: 20px auto ;
border-radius: 40px 10px;
box-shadow: 5px 5px 5px #e2ebff;
}
.container:hover{
box-shadow: 10px 10px 5px #e2ebff;
}
.container .title{
color: #015689;
font-size: 22px;
font-weight: bolder;
}
.container .title{
text-shadow: 1px 1px 1px lightgrey;
}
.container .title:after {
width: 50px;
height: 2px;
content: ' ';
position: absolute;
background-color: #015689;
margin: 20px 8px;
}
.container h2{
line-height: 40px;
margin: 2px 0;
font-weight: bolder;
}
.container a{
color: #170d51;
}
.container p{
font-size: 18px;
line-height: 30px;
}
.container button{
padding: 15px;
background-color: #4469f5;
border-radius: 10px;
border: none;
background-color: #00456e ;
font-size: 16px;
font-weight: bold;
margin-top: 5px;
}
.container button:hover{
box-shadow: 1px 1px 15px #015689;
transition: all 0.2S linear;
}
.container button a{
color: white;
}
hr{
/ display: none; /
}
Run Free ThreatScan on Your Mailbox
AI-Powered Protection for Business Email Security
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .
Run Free Threat Scan
Request for Comment:
The Federal Communications Commission (FCC) is seeking comments on the effectiveness of security measures to prevent unauthorized location tracking using SS7 and Diameter protocols.
It includes information on incidents where attackers exploited these protocols to track users, the specific vulnerabilities used, and the response taken by communication service providers, as it is also interested in learning about any misuse of leased global titles for location tracking in the US.
Information on how cell phone providers are securing customer location data transmitted via SS7 and Diameter protocols, as they are interested in specific measures taken to address location tracking vulnerabilities, including adherence to CSRIC recommendations and GSMA best practices.
Top of a cellular radio tower
The FCC also wants to understand how providers are preventing location information exploitation during roaming and by companies with leased global titles, as they inquire about challenges faced by providers in implementing security measures and how to gain better visibility into these practices across all service providers.
It is inviting interested parties to submit comments electronically via ECFS or on paper, where paper filings must be addressed with specific instructions.
Is Your Network Under Attack? – Read CISO’s Guide to Avoiding the Next Breach – Download Free Guide
The post Feds Patching Years-Old SS7 Vulnerability in Phone Networks appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform .
