What Is SS7 Attack? What Can Hackers Use It For?

This guide explains SS7 Attack? What Can Hackers Use It For, why it matters, how it works, and how to evaluate or use it in practical situations.

What is SS7?

SS7, short for Signalling System No 7, is a system used to connect mobile devices together. It has been in development since 1975 and comes in many different variants.

SS7 is a set of protocols that allow a telephone network to exchange information necessary for calling and texting. It also allows users on one mobile network to roam to another while traveling.

What can a hacker do with an SS7 attack?

When having access to SS7 system, hacker has access to sensitive user information. They can forward a call to record or eavesdrop. They can also read SMS messages sent and received between phones. Besides, they can also track the user's location by the system used by the network operator to help maintain the stability and continuity of calls, messages and mobile data.

When a hacker accesses an SS7 system, anyone using that cellular network can become a victim.

Currently, two-factor authentication (2FA) message stealing is the target most hackers target when carrying out SS7 attacks. The 2FA authentication system is based on unencrypted SMS messages and when hacking SS7, hackers can collect and then block these messages from being sent to the victim's computer. For example, the hacker can use the SS7 attack method to get 2FA authentication messages from the victim's bank, transferring all the money from the victim's account without the victim's knowledge.

In addition, hackers can also use SS7 attack method to get 2FA authentication messages and then infiltrate and hijack the victim's social network accounts, email.

What can you do to avoid being affected by SS7 attacks?

In the SS7 attacks, hackers target vulnerabilities in the mobile network. As a result, ordinary consumers cannot do much to protect themselves.

For important messages, use encrypted messaging services like iMessage, WhatsApp. Avoid using the 2-factor authentication system with SMS messages. You can also use calling applications over an internet connection instead of calling over a mobile network. Call encryption applications include Signal, WhatsApp, Telegram.