juanjo tugores - Fotolia
SS7 vulnerabilities enable breach of major cellular provider
News roundup: A major cellular network may have been compromised by exploiting SS7 vulnerabilities, according to reports. Plus, Kaspersky's lawsuits have been dismissed, and more.
The U.S. Department of Homeland Security warned of an exploit of the Signaling System 7 protocol that may have targeted American cellphone users.
The Washington Post reported that DHS notified Sen. Ron Wyden (D-Ore.) last week that malicious actors "may have exploited" global cellular networks "to target the communications of American citizens." The letter has not been made public, but The Washington Post obtained a copy of it and reported that it described surveillance systems that exploit Signaling System 7 (SS7) vulnerabilities. According to the report, the exploit enables intelligence agencies and criminal groups to spy on targets using nothing but their cellphone number.
SS7 is the international telecommunications standard used since the 1970s by telecommunications providers to exchange call routing information in order to set up phone connections. Cellphone providers use SS7 to enable users to send and receive calls as they move from network to network anywhere in the world. The protocol has been criticized by analysts and experts for years because of its vulnerabilities and because it enables spying and data interception.
In a different letter to Ajit Pai, chairman of the Federal Communications Commission, Wyden referenced an "SS7 breach" at a major wireless carrier and criticized the FCC for its inaction regarding SS7 vulnerabilities.
"Although the security failures of SS7 have long been known to the FCC, the agency has failed to address the ongoing threat to national security and to the 95% of Americans who have wireless service," Wyden wrote.
He explained the SS7 vulnerabilities enable attackers to intercept people's calls and texts, as well as hack into phones to steal financial information or get location data.
"In a prior letter to me, you dismissed my request for the FCC to use its regulatory authority to force the wireless industry to address the SS7 vulnerabilities," Wyden wrote to Pai. "You cited the work of the [Communications Security, Reliability and Interoperability Council] as evidence that the FCC is addressing the threat. But neither CSRIC nor the FCC have taken meaningful action to protect hundreds of millions of Americans from potential surveillance by hackers and foreign governments."
In the letter, Wyden included a call to action for Pai to use the FCC's "regulatory authority" to address the security issues with SS7 and to disclose information about SS7-related breaches to Wyden by July 9, 2018.
In other news:
- The U.S. government ban on using Kaspersky Lab products was upheld this week, and the security company's lawsuits were dismissed. U.S. District Judge Colleen Kollar-Kotelly dismissed two lawsuits filed by Kaspersky Lab in response to Binding Operational Directive 17-01 and the National Defense Authorization Act (NDAA), both of which banned the company's products from use in the federal government. Kaspersky argued the ban was unconstitutional and caused undue harm to the company, but Kollar-Kotelly dismissed the argument and said while there may be "adverse consequences" for Kaspersky, the ban is not unconstitutional. Kaspersky Lab has said it will file an appeal of the ruling.
- The U.S. House of Representatives advanced a bill that would require law enforcement to get a warrant before collecting data from email providers. The Email Privacy Act was added as an amendment to the NDAA, which is the annual budget for the Department of Defense. The bill passed the House 351-66 and will now move to the Senate for approval. The amendment was authored by Rep. Kevin Yoder (R-Kan.) and is the latest version of the 2016 Email Privacy Act that received unanimous support in the House. If the NDAA passes with this amendment included, it will provide warrant protections to all email, chats and online messages that law enforcement might want or need for investigations. the Electronic Frontier Foundation has been a proponent of email privacy in law, saying, "The emails in your inbox should have the same privacy protections as the papers in your desk."
- The private equity investment firm Thoma Bravo is acquiring a majority share in the security company LogRhythm. LogRhythm offers its users a security information and event management platform that also has user and entity behavior analytics features. The company has been in business for 15 years and has more than 2,500 customers worldwide. "LogRhythm believes it has found an ideal partner in Thoma Bravo," said LogRhythm's president and CEO, Andy Grolnick, in a statement. "As we seek to take LogRhythm to the next level and extend our position as the market's preeminent NextGen SIEM vendor, we feel Thoma Bravo's cybersecurity domain expertise and track record of helping companies drive growth and innovation will make this a powerful and productive relationship." The deal is expected to close later in 2018. Thoma Bravo owns the certificate authority company DigiCert, which recently purchased Symantec's CA operations, and has previously invested in other cybersecurity companies, including SonicWall, SailPoint, Hyland Security, Deltek, Blue Coat Systems, Imprivata, Bomgar, Barracuda Networks, Compuware and SolarWinds.
