Fixing the Cell Network Flaw That Lets Hackers Drain Bank Accounts: Study Notes

Posted on by

Is 2FA really as secure as everyone would suppose? This article talks about how hackers used it to rob banks exploiting the SS7 protocol.

Everyone’s accounts protected by text-based two-factor authentication, such as bank accounts, are potentially at risk until the FCC and telecom industry fix the devastating SS7 security flaw.

T. Lieu (2017, May 3).Rep. Lieu Statement on Hackers Draining Bank Accounts via SS7 Flaw. Ted Lieu [Online], Available: https://lieu.house.gov/media-center/press-releases/rep-lieu-statement-hackers-draining-bank-accounts-ss7-flaw [Accessed: 10 September 2024].
SS7 Attack – What is SS7, Why Care, SS7 Threat, How to Secure yourself

SS7 is at the core of telephony. It stands for Signaling System 7. It is a protocol that controls telephone calls, how they are routed and charged to a user’s account, and SMS messages. It was built before encryption and authentication became common-place, so does not have its own security.

It is however a closed system, meaning that only telephony operators have access to it: this includes threat agents acting as telephony services, and governments. These organisations can then use SS7 to obtain your location using your mobile phone. SMS messages are sent unencrypted and thus can be read by people with access to SS7: snooping on SS7 to listen in to calls and read messages is called an SS7 probe or international mobile subscriber identity catcher. SS7 has long been known as an easy target for spies and data interceptors.

https://www.techtarget.com/searchnetworking/definition/Signaling-System-7

Experts have warned about SS7 being a vulnerability open to exploit for years, and the hackers were able to reroute 2FA codes from mobile phones to authenticate themselves as the bank account user, after obtaining their credentials.

The vulnerability is SS7’s naivety: a mobile phone carrier will request the location of a phone so it can route the phone number, and SS7 will simply tell the carrier that location. A hacker can do this as well because SS7 does not require authentication on behalf of the carrier.

Because of this, NIST has recommended not to use SMS for 2FA. Until a full solution is found, which takes time and money, there can be no improvements to SS7 or even added encryption.

The full story of how the hackers achieved their objective is here: https://www.sueddeutsche.de/wirtschaft/it-sicherheit-schwachstelle-im-mobilfunknetz-kriminelle-hacker-raeumen-konten-leer-1.3486504

Thoughts

It would seem that trying to log in to your bank account on your laptop, and then getting a 2FA message via your email or phone would seem sensible: they are two separate devices, and how would a hacker on the other side of the world have access to your credentials, your email, and/or your phone? It is unlikely.

However – all of this information is going through channels which can be compromised. Your devices may be on the same IP. Your email may be accessed on the same computer on which you are logging into your bank account. You probably use only one email address to authenticate many different accounts, and if a hacker had access to your emails, they would be able to access those accounts.

SS7 and similar older architecture, built a long time ago before security concerns, can be used for mass surveillance and data interception. Like banks that still rely on legacy code, they have many vulnerabilities that can easily be exploited by those who know how. As mentioned in the article, many organisations responsible for SS7 or depend on it to deliver their services, do not care if people are passively observing information: it is only when data breaches result in huge financial loss that it becomes a problem.