Hidden Agendas: Bypassing GSMA Recommendations On SS7 Networks
summary
Demonstrates that SS7 TCAP’s ability to carry multiple MAP components lets an attacker hide malicious MAP operations behind benign ones to bypass SS7 firewalls and SMS Home Routing, extract IMSI/MSISDN routing info via an IPSec-connected VM and open-source tools, and perform profile changes that reroute calls or intercept SMS. Tests hit thousands of attacks/day statistics, show infinite loop transactions that ran six hours, and worked against four vendor stacks; detection requires updated IDS signatures and protocol checks for global opcodes.
AI-written summary · about
chapters (13)
- 0:00Introduction to SS7 vulnerabilities
- 3:17SS7 protocol history and risks
- 8:25Real-world SS7 attack cases
- 12:01Discovering the MAP component flaw
- 20:00SMS delivery process and abuse
- 23:50Bypassing SMS home routing
- 28:42Call routing manipulation attack
- 31:59Profile manipulation via SS7
- 39:59Premium rate call redirection
- 42:07Infinite loop attack on SS7
- 44:17Global opcode abuse technique
- 46:48Operator security recommendations
- 49:22Q&A session
related talks
26mBack to the Future. Cross-Protocol Attacks in the Era of 5G
40mWeaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?
39mSecure Your Data
26mMobile Interconnect Threats: How Next-Gen Products May be Already Outdated
25mAttacking Mobile Broadband Modems Like a Criminal Would
08mHacking 4G and how to get arrested in 10 minutes
30mAttacks Against GSMA's M2M Remote Provisioning
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol