So they are finally admitting that SS7 is a huge security problem to the point they have to recommend everyone not to use it for 2FA anymore....but they are not going to try and fix SS7.
It's not just the technical problems with SS7 - it's a business issue.
The Telco's prime motivations are to make it easy for their customers to make more calls and send more text messages - that's what make them money. Making it difficult to port phone numbers away from competitors, or making it difficult for customers to redirect phone calls or text messages is bad for business, and will lose them customers and/or increase customer support costs.
There's absolutely no upside to a Telco for doing any of that - they don't really care if that makes their product less secure for use-cases other 3rd parties who aren't paying the Telco - the Telco's never signed up to provide a secure channel for your bank to send secrets to you - and the banks aren't offering to pay them for it. The Telco's customers are paying, and to an overwhelming degree they demonstrate that they prefer convenience over security - you get pissed off and potentially change carriers very quickly if you cant call them up from a friend's phone when yours get broken/stolen and get your calls/texts redirected to another number immediately. The fact that that same ability give access to social engineers to get hold of banking pins and internet service 2fa secrets is a vanishingly small concern for the people paying the Telco's.
So they just don't care. Not their problem. Sucks to be a bank.
My idea is get rid of minutes and text and simply have data on your phone. Then you can use the call/sms service of your choice to provide those features over https. Basically unbundle the whole deal. The carriers would never go for it but I think it would work.
I've got a nephew who sort-of does that with an iPod touch. It doesn't even have a cellular data connection - he relies on glomming on to free wifi at school/home/friend's houses/the library/the shopping mall/wherever, and gets iMessage and Skype only when he's got wifi - which is "good enough" for him to not even bother upgrading to a phone with a pre-paid account... (He's even managed to convince his Mom to leave the wifi hotspot on her phone running all the time, so he can make/receive calls in the car...)
SS7 attacks get a lot of news coverage but they still aren't practical for most non-government attackers. What generally happens is that they trick the phone provider into issuing them a new SIM card for the account or redirecting the number to one they control.
Comments
So they are finally admitting that SS7 is a huge security problem to the point they have to recommend everyone not to use it for 2FA anymore....but they are not going to try and fix SS7.
It's not just the technical problems with SS7 - it's a business issue.
The Telco's prime motivations are to make it easy for their customers to make more calls and send more text messages - that's what make them money. Making it difficult to port phone numbers away from competitors, or making it difficult for customers to redirect phone calls or text messages is bad for business, and will lose them customers and/or increase customer support costs.
There's absolutely no upside to a Telco for doing any of that - they don't really care if that makes their product less secure for use-cases other 3rd parties who aren't paying the Telco - the Telco's never signed up to provide a secure channel for your bank to send secrets to you - and the banks aren't offering to pay them for it. The Telco's customers are paying, and to an overwhelming degree they demonstrate that they prefer convenience over security - you get pissed off and potentially change carriers very quickly if you cant call them up from a friend's phone when yours get broken/stolen and get your calls/texts redirected to another number immediately. The fact that that same ability give access to social engineers to get hold of banking pins and internet service 2fa secrets is a vanishingly small concern for the people paying the Telco's.
So they just don't care. Not their problem. Sucks to be a bank.
Isn't migrating to a pure LTE network a legitimate option to fixing SS7 ?
Not that I think we'll be rid of SS7 even a decade from now, but there is a reasonable path to take, yes ?
My idea is get rid of minutes and text and simply have data on your phone. Then you can use the call/sms service of your choice to provide those features over https. Basically unbundle the whole deal. The carriers would never go for it but I think it would work.
I've got a nephew who sort-of does that with an iPod touch. It doesn't even have a cellular data connection - he relies on glomming on to free wifi at school/home/friend's houses/the library/the shopping mall/wherever, and gets iMessage and Skype only when he's got wifi - which is "good enough" for him to not even bother upgrading to a phone with a pre-paid account... (He's even managed to convince his Mom to leave the wifi hotspot on her phone running all the time, so he can make/receive calls in the car...)
SS7 attacks get a lot of news coverage but they still aren't practical for most non-government attackers. What generally happens is that they trick the phone provider into issuing them a new SIM card for the account or redirecting the number to one they control.