While running some SS7 pentests last year, I developed a small tool automating some of the well-known SS7 attack cases. Today I’m releasing the first version of ss7MAPer, a SS7MAP (pen-)testing toolkit.

SS7 SMS Center platform – SMSC. The SMSC Service Provider uses the SMS Center platform and its features for managing connections to mobile operators including commercial conditions, and secure high performance on SMS messages like bulk campaign advertisements send by telemarketing customers. Download the latest Snort open source network intrusion prevention software. Review the list of free and paid Snort rules to properly manage the software. The Signaling System 7 Download Samsung USB Drivers for Windows 10 (32 / 64-bit) 2019. Ss7 hack download app apk posts updated on May,12 2020, see also posts related to ss7 hack download app apk, and android app news from showboxfreeapp. Phone companies use SS7 to exchange billing information.

The toolkit is build upon the Osmocom SS7 stack and implements some basic MAP messages. At its current state tests against the HLR are ready for use, in future versions tests against VLR, MSC and SMSC will follow.

The source code of the tool is published on github, feel free to use and extend.

Ss7 Download For Windows 10 Windows 10

The tool is written in Erlang; to get it running you will need the Erlang runtime environment. It is developed for version 17.5.

As example, the screen shot below shows the output of the tool against a HLR, testing which MAP messages are accepted and the results given back.

As you can see in the picture, the demonstrated test cases for the HLR respond to most of the MAP messages regardless the fact that we are not registered as valid provider. The tool is not configured as a serving MSC nor a roaming contractor. Some of the information gathered can be seen as critical, as the MSISD -> IMSI resolution, the over-the-air crypto keys or the ability to create supplementary services e.g. call forwarding.

The code (and its dependencies) are not that easy to compile but I tried to give a complete step by step instructions in the README file.

The messages and test cases are gathered from public SS7 research of the last years (see 1, 2) and check for known weaknesses in the SS7 domain.
The tool itself was developed under a cooperation with the Belgium provider Proximus and aims to test the secure configuration of the internal and external SS7 network access. Thanks a lot for giving us the opportunity here, we are convinced that the tool gives the research community but also telecommunication providers a new, important and (especially) open-source-based possibility for SS7 testing.

More about the tool and SS7 testing on Troopers TelcoSecDay, Telco Network Security & Network Protocol Fuzzing Workshop.

That’s it, get the code, try the tool.
Best wishes from Heidelberg.

/daniel

SS7 hack explained

Technology is, in its nature, developing based on current progress. Sometimes it is worth going back to the blue box era to discover something in today’s world. More or less recent scandals involving NSA’s practice to track, listen, and intercept communication without authorisation made a splash, but not many took the time and effort to understand the magic behind. Kudos for Washington Post: they went looking into this.

After little research taking me 50 years back in time, I will explain the technology behind and demonstrate that one does not need NSA resources or an army of hackers to repeat the trick on you.

Ss7 Download For Windows 10 32-bit

The calling protocol that is used for one network to “talk” to another was developed in 1970’s and is called SS7. The protocol was somewhat refined around 2000 with a SIGTRAN specification, which made it IP network environment friendly. This, however, meant that all the weak links on the upper level of SS7 infrastructure were carried over.

Picture that the communication is made possible not by one, but in fact several hundreds of links, which result a chain that triggers phone on the other end of your call ringing. Referencing back to my earlier post on “Evolution of Authentication”, I would like to demonstrate that the same principle of security level assessment applies here: the chain is as safe as it’s weakest link. Consider WhatsApp hacking methods, message virus trends, phone number exploits, Skype lock services.

Ss7 Tools Free Download

During my time in Deutsche Telekom Consulting, I was involved in review of a number of networks (fun times included climbing down sewers following copper lines laid there in 50s-60s-70-s, which were used by corporations and governments in 2003-2004 and likely still to be in place). The hardware and software providers vary from network to network and are extremely segmented, which leads to a simple result: they have to keep their chains wide open to make sure that the next chain link can integrate.

So did anyone know about these vulnerabilities until 2013? In short: of cause. First reference I have discovered dates back to a report published in 2001, which I (admittedly) could not read to full extent due to my neglected Swedish. Google Translate may help you.

It was also made public by Tobias Engel during a Chaos Computer Club Congress held in 2008, when Tobias made a live demo of tracking abilities:

A white paper on SS7 hack SS7: locate track manipulate (pdf file; original here)

And, of cause, it was most widely reported during NSA scandal involving Edward Snowden, that revealed how NSA was exploiting the weaknesses of SS7 to create a very intelligent and complex series of solutions enabling them to simultaneously track and analyse millions of citizens without their nor carrier’s knowledge or approval.

SS7 hack software

So what does one require to make this work? The list is quite short:

Ss7 Download For Windows 10 Download

• Computer
• Linux OS
• SDK for SS7

Apart from the computer itself, remaining ingredients are free and publicly available on the Internet.

It may have slipped under your radar, but apparently now there is a legal way to use this technology to track anyone worldwide, and NSA is not involved at all: the service offering is open to public and provided by a NASDAQ listed Verint Systems Inc. (NASDAQ: VRNT). In their product description, which was made public, they refer to the system as “Skylock”. During search I even stumbled upon a certification of encryption capabilities of this product by NIST (certificate scan).

Verdict? Abandon illusions of privacy if you still had them.

Sources:

• A study of Location-Based Services including design and implementation of an enhanced Friend Finder Client with mapping capabilities (Aug. 2001)
• Uncut video of Tobias Engel’s speech “Locating mobile phones using signalling system #7” at 25th Chaos Computer Club Congress (12/27/2008 21:45:00)
• Skylock product description (2013)

Disclaimer: this article is a warning to regular citizens about low technological barrier protecting their privacy specifically in relation to mobile phone hacking using ss7 protocol. It is not a guide to hack-a-phone. I will intentionally leave a few aspects uncovered. I urge all readers NOT to use this technology and hope that the solution to restrict this ability to track phones will be implemented soon.