SoylentNews

upstart writes:

A surveillance vendor was caught exploiting a new SS7 attack to track people's phone locations:

Security researchers say they have caught a surveillance company in the Middle East exploiting a new attack capable of tricking phone operators into disclosing a cell subscriber's location.

The attack relies on bypassing security protections that carriers have put in place to protect intruders from accessing SS7, or Signaling System 7, a private set of protocols used by the global phone carriers to route subscribers' calls and text messages around the world.

SS7 also allows the carriers to request information about which cell tower a subscriber's phone is connected to, typically used for accurately billing customers when they call or text someone from overseas, for example.

Researchers at Enea, a cybersecurity company that provides protections for phone carriers, said this week that they have observed the unnamed surveillance vendor exploiting the new bypass attack as far back as late 2024 to obtain the locations of people's phones without their knowledge.

Enea VP of Technology Cathal Mc Daid, who co-authored the blog post, told TechCrunch that the company observed the surveillance vendor target "just a few subscribers" and that the attack did not work against all phone carriers.

Mc Daid said that the bypass attack allows the surveillance vendor to locate an individual to the nearest cell tower, which in urban or densely populated areas could be narrowed to a few hundred meters.

[...] Surveillance vendors, which can include spyware makers and providers of bulk internet traffic, are private companies that typically work exclusively for government customers to conduct intelligence-gathering operations against individuals. Governments often claim to use spyware and other exploitative technologies against serious criminals, but the tools have also been used to target members of civil society, including journalists and activists.

In the past, surveillance vendors have gained access to SS7 by way of a local phone operator, a misused leased "global title," or through a government connection.

But due to the nature of these attacks happening at the cell network level, there is little that phone subscribers can do to defend against exploitation. Rather, defending against these attacks rests largely on the telecom companies.

Original Submission