ITU Workshop on “SS7 Security” Geneva, Switzerland 29 June 2016 Security in SS7 networks Gerhard Ott Test expert, Deutsche Telekom AG, gerhard.ott@telekom.de Gerhard Ott

Security in SS7 networks The SS7 stack Application TCAP ISUP SCCP Level 3 Level 2 Physical

Security in SS7 networks Security in SS7 networks - what are the risks security reasons, fraud spoof intercept DOS

Security in SS7 networks Target affected Provider Network User

Security in SS7 networks Examble of a SS7 relationship Network foreign B Network (own) Network foreign A

Security in SS7 networks Target affected Provider Network Attack on level 3 functionalities Link management Trunk group management Denial of Service attack

Security in SS7 networks Examble for a redirection Network foreign B Network (own) Network foreign A

Security in SS7 networks Target affected User The user will recall misled (there is a number is in the caller list pointing to a service with special prices) User see a faked calling number (e.g. emergency number 110)

Security in SS7 networks Target affected User The user is intercepted SMS spam SMS read along Track the location(s) of a mobile user Change the data base of a mobile user

Security in SS7 networks Security in SS7 networks – what to do about the risks level 3 issues OPC/DPC depended routing (level 3 firewall) Separation in two networks (use of network indicator) It is assumed that these proposals already applied

Security in SS7 networks Security in SS7 networks – what to do about the risks User issues Anomaly Detection on Incoming MAP messages (Monitoring system) Filtering of MAP application context (at application level) Configuration Software upgrade (Vendor action, change request)

Security in SS7 networks Thank you for your attention Questions? Comments?