SS7 Fraud Enablement Attacks

Attacks that facilitate financial fraud

Overview
Understanding SS7 fraud enablement vulnerabilities

SS7 fraud enablement attacks exploit vulnerabilities in the Signaling System No. 7 protocol to facilitate financial fraud and unauthorized service usage. These attacks target subscriber identity information, authentication data, and network configurations to enable various fraudulent activities, including SIM cloning, call hijacking, and roaming fraud. Unlike other SS7 attacks focused on surveillance or disruption, fraud enablement attacks are primarily aimed at financial gain.

Security Implications

  • Financial losses for subscribers and operators
  • Unauthorized service usage and billing fraud
  • Identity theft and account takeover
  • Bypass of billing and charging systems
  • Exploitation of roaming agreements
  • Reputational damage to network operators

Technical Prerequisites

  • Access to SS7 network (direct or via compromised operator)
  • Knowledge of target's MSISDN (phone number)
  • SS7 message crafting capabilities
  • Global Title (GT) spoofing ability
  • Understanding of authentication procedures
  • SIM card programming capabilities (for some attacks)

Fraud Enablement Techniques

SendIMSI Attack
High Impact
Low Complexity
Obtaining subscriber IMSI for SIM cloning

Technical Details

The SendIMSI MAP operation is legitimately used by network entities to obtain a subscriber's IMSI (International Mobile Subscriber Identity) from their MSISDN (phone number). This operation is typically used for routing and billing purposes.

In this attack, the attacker sends a fraudulent SendIMSI message to the target's HLR, impersonating a legitimate network entity. The HLR responds with the subscriber's IMSI, which is a critical piece of information for SIM cloning and other fraud scenarios.

Once the attacker has obtained the IMSI, they can use it to create a duplicate SIM card or as part of more complex attacks involving authentication vector theft.

Attack Flow

  1. Attacker obtains target's MSISDN (phone number)
  2. Attacker crafts a SendIMSI message with the target MSISDN
  3. Attacker spoofs a legitimate network entity as the source
  4. Message is sent to target's home network HLR
  5. HLR processes the request without adequate authentication
  6. HLR responds with the subscriber's IMSI
  7. Attacker captures the IMSI for use in further attacks
  8. IMSI can be used for SIM cloning or other fraud scenarios

Mitigation

Restrict SendIMSI operation access

  • Restrict SendIMSI operation access
  • Implement strict whitelist for entities allowed to use SendIMSI
  • Monitor for unusual patterns of SendIMSI requests
  • Consider implementing alternative procedures that don't expose IMSI
  • Implement SS7 firewall rules specific to SendIMSI operations
SendAuthenticationInfo Attack
Critical Impact
Medium Complexity
Obtaining authentication vectors for SIM cloning

Technical Details

The SendAuthenticationInfo (SAI) MAP operation is legitimately used by the VLR to request authentication vectors from the HLR when a subscriber attempts to register on the network. These vectors are used to authenticate the subscriber's SIM card.

In this attack, the attacker sends a fraudulent SendAuthenticationInfo message to the target's HLR, impersonating a VLR. The HLR responds with authentication vectors (triplets or quintuplets) that contain the information needed to authenticate as the subscriber.

With these authentication vectors, the attacker can potentially clone the subscriber's SIM card or create a rogue base station that can authenticate the subscriber without actually knowing their Ki (authentication key).

Attack Flow

  1. Attacker obtains target's IMSI (possibly via SendIMSI attack)
  2. Attacker crafts a SendAuthenticationInfo message with the target IMSI
  3. Attacker spoofs a legitimate VLR as the source
  4. Message is sent to target's home network HLR/AuC
  5. HLR/AuC processes the request without adequate authentication
  6. HLR/AuC generates and responds with authentication vectors
  7. Attacker captures the authentication vectors
  8. Authentication data can be used to clone SIM or create rogue base station
  9. Attacker can now impersonate the legitimate subscriber

Mitigation

Implement SAI filtering and monitoring

  • Implement SAI filtering and monitoring
  • Verify the source GT against known legitimate VLRs
  • Limit the number of authentication vectors provided in response
  • Implement rate limiting for authentication requests
  • Consider implementing mutual authentication between network elements
UpdateLocation for Roaming Fraud
High Impact
Medium Complexity
Impersonating roaming partners to enable fraudulent usage

Technical Details

This attack exploits the UpdateLocation MAP operation to enable fraudulent roaming scenarios. The attacker impersonates a VLR from a roaming partner network to trick the target's HLR into believing the subscriber is roaming.

By manipulating the roaming information, the attacker can enable unauthorized usage that will be billed according to roaming agreements, potentially at premium rates. This can be used to generate revenue for compromised operators or to enable usage that bypasses normal billing controls.

This attack can be particularly damaging because it exploits the trust relationships and financial agreements between operators, potentially leading to significant financial losses and disputes.

Attack Flow

  1. Attacker obtains target's IMSI
  2. Attacker identifies a suitable roaming partner for fraud
  3. Attacker crafts an UpdateLocation message with the target's IMSI
  4. Attacker spoofs a VLR from the selected roaming partner
  5. Message is sent to target's home network HLR
  6. HLR processes the request without adequate authentication
  7. HLR updates its database with the new roaming location
  8. HLR sends InsertSubscriberData to the attacker's fake VLR
  9. Attacker acknowledges receipt of subscriber data
  10. Fraudulent usage can now be billed according to roaming agreements

Mitigation

Validate roaming partner identities

  • Validate roaming partner identities
  • Implement strict verification of roaming network elements
  • Monitor for unusual roaming patterns
  • Implement velocity checking for international location updates
  • Consider implementing financial thresholds and alerts for roaming usage

Exploitation Example

IMSI Capture via SendIdentification
Python script to obtain a subscriber's IMSI from their TMSI
from sigploit.ss7.fraud import sendIdentification

# Target TMSI (temporary identity)
target_tmsi = 'a1b2c3d4'

# Attacker's GT (Global Title)
attacker_gt = '20408999999'

# Target VLR GT
target_vlr = '20408000000'

# SS7 connection parameters
ss7_params = {
    'sctp_port': 2905,
    'target_ip': '10.0.0.1',
    'source_ip': '10.0.0.2'
}

# Create SendIdentification request
send_id_req = sendIdentification.SendIdentificationReq(
    target_tmsi=target_tmsi,
    attacker_gt=attacker_gt,
    target_vlr=target_vlr
)

# Execute the attack
result = send_id_req.execute(ss7_params)

# Extract IMSI from response
if result.success:
    imsi = result.get_imsi()
    print(f"[+] Successfully obtained IMSI: {imsi}")
    print(f"[+] This IMSI can now be used for further attacks")
else:
    print(f"[-] Attack failed: {result.error}")

This example demonstrates how an attacker could use the SendIdentification MAP operation to obtain a subscriber's IMSI from their TMSI. The IMSI can then be used for further attacks such as SIM cloning or authentication vector theft.

Note: This code is provided for educational purposes only. Unauthorized use against real networks is illegal and unethical.

Related Attack Vectors

Standards and References

Relevant Standards and Documentation

3GPP Standards

  • 3GPP TS 29.002: Mobile Application Part (MAP) specification
  • 3GPP TS 33.200: 3G Security; Network Domain Security (NDS); MAP application layer security
  • 3GPP TS 33.204: 3G Security; Network Domain Security (NDS); Transaction Capabilities Application Part (TCAP) user security

Security Recommendations

  • GSMA FS.11: SS7 Interconnect Security Monitoring and Firewall Guidelines
  • GSMA FS.07: SS7 and SIGTRAN Network Security
  • GSMA IR.82: SS7 Security Network Implementation Guidelines
  • ENISA: Signaling Security in Telecom SS7/Diameter/5G

Research Papers

  • Engel, T. (2014): "SS7: Locate. Track. Manipulate."
  • Nohl, K. (2014): "Mobile self-defense"
  • P1 Security (2016): "Practical attacks on SS7 networks"