1. Home
  2. Techniques
  3. Mobile
  4. Exploit SS7 to Track Device Location

Exploit SS7 to Track Device Location

An adversary could exploit signaling system vulnerabilities to track the location of mobile devices. [1] [2] [3] [4] [5]

ID: T1450
Sub-techniques:  No sub-techniques
Tactic Type: Without Adversary Device Access
ⓘ
Tactic: Network Effects
ⓘ
Platforms: Android, iOS
ⓘ
MTC ID: CEL-38
Version: 1.1
Created: 25 October 2017
Last Modified: 03 February 2019
Provided by LAYER 8

Procedure Examples

ID Name Description
S0602 Circles

Circles can track the location of mobile devices.[6]

Mitigations

ID Mitigation Description
M1014 Interconnection Filtering

Detection

Network carriers may be able to use firewalls, Intrusion Detection Systems (IDS), or Intrusion Prevention Systems (IPS) to detect and/or block SS7 exploitation.[7] The CSRIC also suggests threat information sharing between telecommunications industry members.

References

  1. Tobias Engel. (2014, December). SS7: Locate. Track. Manipulate.. Retrieved December 19, 2016.
  2. Tobias Engel. (2008, December). Locating Mobile Phones using SS7. Retrieved December 19, 2016.
  3. 3GPP. (2000, January). A Guide to 3rd Generation Security. Retrieved December 19, 2016.
  4. Positive Technologies. (n.d.). SS7 Attack Discovery. Retrieved December 19, 2016.
  1. Communications Security, Reliability, Interoperability Council (CSRIC). (2017, March). Working Group 10 Legacy Systems Risk Reductions Final Report. Retrieved May 24, 2017.
  2. Bill Marczak, John Scott-Railton, Siddharth Prakash Rao, Siena Anstis, and Ron Deibert. (2020, December 1). Running in Circles Uncovering the Clients of Cyberespionage Firm Circles. Retrieved December 23, 2020.
  3. CSRIC-WG1-FinalReport