Attack Detection in SS7

Today, more and more interactions rely on smart phones. Their security becomes a real concern to guarantee the protection of identity, life and property. Cybersecurity initiatives regularly emphasize the importance of good practices for passwords, updating patches, encryption or other appropriate defenses. They also announce vulnerabilities discovered in applications. But they rarely warn of the danger of SS7 (Signaling System No. 7), the stack of protocols used between 2G and 3G telecommunications network equipment, including cellular phones. This paper presents on-going research on the detection of SS7 attacks which target the SS7 Mobile Application Protocol (MAP). More specifically, we plan to detect attacks based on so-called Category 3 MAP messages which are difficult to manage with SS7 firewalls. The method verifies the consistency of the position/speed revealed by the telecommunications equipment involved in SS7 signaling when a subscriber is in outbound roaming situation. In particular, we plan to detect attacks spoofing a SS7 equipment (from anywhere in the world) and injecting Category 3 MAP messages in order to take control of voice or SMS delivery equipment, which would allow the attacker to intercept calls or SMSs or even to prevent communications.