International Journal of Scientific Engineering and Research (IJSER)

www.ijser.in
ISSN (Online): 2347-3878, Impact Factor (2015): 3.791

SS7 Signaling Protocol – Security

Garima Sharma 1, Dr. Harish Mittal2
1
Research Scholar, Sat Priya Group of Institutions, MD University, Rohtak, India
2
Director, Sat Priya Group of Institutions, MD University, Rohtak, India

Abstract: In this era of mass surveillance and cybercrimes, numerous attacks are conducted by government agencies and evil hackers
on mobile users. Recent report in the media revealed that one of the major government surveillance agencies is collecting bulk
information from the mobile traffic. Yet another leaked report from Ukrainian communication regulators (NKRZ) and Ukrainian
Security Services (SBU) disclosed that suspicious mobile network packets from one of the telecommunication partners from Russia was
revealing location of mobile users and there were high chances that their voice calls were being intercepted. The attacks are serious
because SS7, despite its age, remains the main signaling protocol in the mobile networks and will still long be required for
interoperability and background compatibility in international roaming.

Keywords: Attack Mitigation, Attack Analysis, Protocol Stack, SS7, Security, Vulnerabilities, Mobile Network.

1. Introduction 2. SS7
With the vast coverage of cellular networks and more Signaling System No. 7 is one of the most widely used
affordable smart phones, the number of mobile users is network architecture and a protocol used for commutations
increasing day by day. The telecommunication sector is purposes in telephony world. SS7 is standardized by
growing continuously with a total of 3.6 billion unique mobile International Telecommunication Union Telecommunication
subscribers at the end of year 2014 [3]. At present, half of the Standardization Sector (ITU-T). This standard articulates
world population is using mobile phones and subscriptions in specific set of protocol about information exchange over a
their day to day life, and it is estimated that an additional of digital signaling network in the public switched telephone
one billion mobile subscribers will be using network (PSTN) systems. SS7 is widely used in cellular
telecommunication services at the end of year 2020. (wireless) and fixed-line (wire line) for call establishment,
billing, routing and information exchange. Though it is not
In today's world, mobile networks have not only become the going to last in the industry for various outdated methods and
most vital part of communication infrastructure but also a security vulnerabilities, many aspects of SS7 will be
major driving force behind global economic progress and replicated in the signaling networks.
welfare. Repeated incidents of private calls, messages or
pictures of government officials, celebrities and businessmen 3. Application of SS7
being leaked over the Internet have demonstrated concrete
evidence about vulnerability of telecommunication systems. Being the backbone of Public Switched Telephone Network
These incidents not only question the capability and (PSTN), SS7 protocol suite has its diverse application across
responsibility of mobile operators, but also agitate common the global telecommunication network. SS7 is also needed
laymen about their personal privacy. While most attacks in each time we make a telephone call which goes beyond local
the public eye have exploited weaknesses in the end-device exchange. Despite being used in daily routine for mobile
software, less known attacks that exploit weaknesses of the telephony, many of the end users are unaware of its existence
mobile network have also become an everyday problem. This or diverse applications.
thesis focuses on such attacks against the mobile backbone
and signaling systems.  Call establishment, management and release.
 Short Message Service (SMS)
The attackers were able to locate the mobile users and  Supplementary services by the mobile operators such as
intercept voice calls and text messages. Call Number Display (CND) call waiting and call
forwarding.
The attacks are presented in a uniform way, in relation to the  Local Number Portability (LNP)
mobile network protocol standards and signaling scenarios.
 Toll-free numbers for telemarketing
 Enhanced Messaging Services (EMS) such as logos and
The attacks are serious because SS7, despite its age, remains
ringtone delivery.
the main signaling protocol in the mobile networks and will
 Call blocking (Do-not-call enforcement)
still long be required for interoperability and background
compatibility in international roaming. Moreover, the number
Besides its applications in telecommunication networks, it
of entities with access to the core network, and hence the
also acts as a connection to the data communication world by
number of potential attackers, has increased significantly
providing features like Internet call-waiting, games based on
because of changes in regulation and opening of the networks
locations, services which uses browser based
to competition.
telecommunication, Hotspot billing, etc.

Volume 4 Issue 5, May 2016

Paper ID: IJSER15811 31 of 34
Licensed Under Creative Commons Attribution CC BY
 International Journal of Scientific Engineering and Research (IJSER)
www.ijser.in
ISSN (Online): 2347-3878, Impact Factor (2015): 3.791
4. SS7 Network
Signaling Network Architecture

Definition of signaling according to ITU-T is as follows “The Figure 2: Switch base signaling
exchange of information (other than by speech) specifically
concerned with the establishment, release and other control of 5. Signaling Architecture
calls, and network management, in automatic
telecommunications operations” [4]. SS7 uses bi-directional channels called signaling links where
it transfers the messages. These signaling links connect the
Subscriber signaling happens on the link between subscribers building blocks of the network known as signaling points.
(end users) and the nearby local switch; whereas the signaling There are three signaling points namely Signal Switching
that takes place between the nodes of core network is known Point (SSP), Signal Transfer Points (STP) and Signal Control
as network signaling. Network signaling is complex Points (SCP). Each of these points is identified by a unique
compared to subscriber signaling as it supports various code, and that code will be carried in the signaling message
database-driven functionalities such as calling plan validation, between such the signaling points. This code identifies the
Local Number Portability and roaming. Since the SS7 source and destination.
protocol stack comes under the network signaling, the rest of
this thesis will consider only network signaling. Brief descriptions of the signaling points are as follows:

Implementation of network signaling is possible by two Signal Switching Point (SSP): These are the telephone
methods namely Channel Associated Signaling (CAS) and switches which initiate, switch or terminate calls. They
Common Channel Signaling (CCS). In CAS systems, most of communicate with other SSPs to establish, manage and
the signaling takes place in a deterministic manner. Major release voice circuits. They are capable of communicating
disadvantage of CAS based systems is that signaling cannot with SCP's database to check the routing information in case
be done in the in the call connection phase, which imposed of a toll-free number.
limits on signaling states. Another drawback is that the
resource allocation is inefficient because of its deterministic
nature.

Figure 3: SS7 link

Figure 1: SS7 network signaling
Signal Transfer Points (STP): These are the packet switches
SS7 is a purely CCS based protocol and is packet based which perform routing of incoming signaling message from
carrying 200 bytes of information in each SS7 packet. The the source towards the destination based on the information
advantage of being a packet based approach is that it can contained in the SS7 message.
support two different ways of signaling:
Signal Control Points (SCP): These are nothing but databases
which aid the services that are supplementary to normal
1) Circuit based signaling: This indicates the primary
calling. Usually SCPs are deployed in pairs with the STPs for
purpose of signaling such as set up, management and
reliability.
dropping telephone calls.
2) Non-circuit based signaling: This type of signaling
facilitates data transfer between network entities for 6. SS7 Protocol Stack
purpose other than telephone calls.

Since SS7 is based on CCS, it indeed makes sense to know

more about it. Signaling mode refers to the type of
relationship that the network traffic and signaling path holds.
This matters to CCS mainly because of the reason that it is
not a fixed path. So the efficiency and performance would
matter on the relationship between the signaling modes. The
brief description of signaling modes of CCS follows:

Associated mode
Non – Associated mode
Quasi – Associated mode
Figure 4: SS7 protocol stack

Volume 4 Issue 5, May 2016

Paper ID: IJSER15811 32 of 34
Licensed Under Creative Commons Attribution CC BY
 International Journal of Scientific Engineering and Research (IJSER)
www.ijser.in
ISSN (Online): 2347-3878, Impact Factor (2015): 3.791
7. Attacks in SS7 8. Attacks Based On Communication Networks
Entry Points to Core Network 8.1 Attacks based on the GSM networks

The number and complexity of interfaces between The attacker may try to break the encryption of the mobile
heterogeneous network entities pose major vulnerabilities to network. The GSM network encryption algorithms belong to
the SS7 mobile core network. Additionally, expanding the family of algorithms called A5. Due to the policy of
interdependence and interconnectivity between the security through obscurity it has not been possible to openly
telecommunication networks and Internet has elevated the test the robustness of these algorithms.
threats. Changes in the regulation and opening of the
telephony industry to competition have given rise to easier 8.2 Attacks based on Wi-Fi
ways to get into the mobile core network. For example, the
United States “Telecommunications Act of 1996” [5] Access Point spoofing – An attacker can try to eavesdrop on
enforces laws to “let anyone enter any communication Wi-Fi communications to derive information (e.g. username,
business – to let any communication business to enter any password). This type of attack is not unique to smartphones,
market against any other” [6]. It also mandates the but they are very vulnerable to these attacks because very
implementation of Legal Interception Gateways (LIGs) [7] often the Wi-Fi is the only means of communication they
which allows government agencies to lawfully intercept have to access the internet.
mobile communication. The “Telecommunications Act of
1996” allowed the small scale Competitive Local Exchange 8.3 Bluetooth-based attack
Carriers (CLECs) to introduce new trends in
telecommunication industry by breaking the monopoly Security issues related to Bluetooth on mobile devices have
business of Incumbent Local Exchange Carriers (ILECs). Any been studied and have shown numerous problems on different
of the CLECs, including ones established by malicious phones. One easy to exploit vulnerability: unregistered
attackers, can gain access to the SS7 core network at a services do not require authentication, and vulnerable
reasonably low cost [5]. Since STPs and SCPs have human applications have a virtual serial port used to control the
facing frontend systems, an attacker can compromise them in phone.
a CLEC environment and thus gain control over the core
networks. 9. Attacks Based On Vulnerabilities in Software
Application
By injecting malicious ISDN (ISUP) messages, an attacker
can connect to SSPs, which bridges end users to SS7 entry 9.1 Web Browser
points and hence enter the core network. The attacker can
also execute Distributed Denial of Service (DDoS) attacks by The mobile web browser is an emerging attack vector for
overloading the SSP entities beyond its capabilities and harm mobile devices. Just as common Web browsers, mobile web
interconnection between SSPs and STPS [8]. browsers are extended from pure web navigation with widgets
and plug-ins, or are completely native mobile browsers.
Yet another threat of attacker gaining access to the core
network comes from Local Number Portability (LNP) [9]. 9.2 Operating system
The Application Programming Interface (APIs) to SCPs to
incorporate LNP has been exploited by the attackers to gain Sometimes it is possible to overcome the security safeguards
knowledge of secret subscriber information and mobile user by modifying the operating system itself.
location
10. Attacks Based On Hardware Vulnerabilities
In 2015, researchers at the French government agency ANSSI
demonstrated the capability to trigger the voice interface of
certain smartphones remotely by using "specific
electromagnetic waveforms".

10.1 Juice Jacking

Juice Jacking is a method of physical or a hardware

vulnerability specific to mobile platforms.

10.2 Password cracking

Figure 5: SS7 attacks entry points
In 2010, researcher from the University of Pennsylvania
investigated the possibility of cracking a device's password
through a smudge attack.

Volume 4 Issue 5, May 2016

Paper ID: IJSER15811 33 of 34
Licensed Under Creative Commons Attribution CC BY
 International Journal of Scientific Engineering and Research (IJSER)
www.ijser.in
ISSN (Online): 2347-3878, Impact Factor (2015): 3.791
11. Future Work
Lots of concepts are left which plays an important role in
providing security to the SS7 protocol. As SS7 is still widely
used and we can say that SS7 is the largest used protocol in
the communication purposes. Thus to provide security to our
communication a techniques can be developed in this field.
New possible attacks are discovering which can affect the
security. To block all such attacks lots of development is
needed.

References
[1] A. &. G. B. Soltani, "New documents show how the
NSA infers relationships based on mobile location data,”
Washington Post, [Online]. Available:
http://wapo.st/1hrSi9F.
[2] "Taking up the Gauntlet: SS7 Attacks, " Adoptive
Mobile, 16 December 2014. [Online]. Available:
http://bit.ly/13VDJdi.
[3] G. Association, "The Mobile Economy 2015, " [Online].
Available: http://bit.ly/1Gh19cQ.
[4] International Telecommunication Union, "Vocabulary of
switching and signaling terms".
[5] "Telecommunications Act of 1996,” US government
Publication Office, Public Law 104-104 section 301,
104th Congress, 1996.
[6] "Telecommunications Act of 1996,” Federal
Communications Corp, 1996. [Online]. Available:
https://transition.fcc.gov/telecom.html.
[7] "ETSI TR 101.943: Lawful Interception (LI); Concepts
of Interception in a Generic Network Architecture, "
European Telecommunications Standards Institute.
[8] T. Moore, T. Kosloff, J. Keller, G. Manes and S. Shenoi,
"Signaling system 7 (SS7) network security,” in The
2002 45th Midwest Symposium on Circuits and Systems,
2002. {MWSCAS}-2002. 2002.
[9] 3GPP, "3GPP TS 23.066: Support of Mobile Number
Portability (MNP); Technical realization; Stage 2".

Author Profile
I, Garima Sharma received the degree of B.Tech
(CSE) in 2015 from Sat Priya Group of
Institutions, MD University, Rohtak. Presently
pursuing M.Tech (CSE) from Sat Priya Group of
Institutions, MD University, Rohtak, India.

Dr. Harish Mittal, Director, Sat Priya Group of Institutions,

MD University, Rohtak, India

Volume 4 Issue 5, May 2016

Paper ID: IJSER15811 34 of 34
Licensed Under Creative Commons Attribution CC BY