Surveillance Vendors Caught Abusing Telecom Infrastructure

Security researchers have uncovered two separate spying campaigns that are abusing well-known weaknesses in the global telecoms infrastructure to track people's locations.

The Campaigns: A Deliberate and Well-Funded Operation

The two campaigns are likely a small snapshot of what researchers believe to be widespread exploitation of surveillance vendors seeking access to global phone networks. The surveillance vendors behind them operated as “ghost" companies that pretended to be legitimate cellular providers, and would piggyback their access to those networks to look up the location data of their targets.

SS7 and Diameter Vulnerabilities

One of the campaigns exploited the insecurity of Signaling System 7, or SS7, a set of protocols for 2G and 3G networks that for years has been the backbone of how cellular networks connect to each other and route subscribers’ calls and text messages around the world. The other campaign used a different method, relying on sending a special type of SMS message to one specific "high-profile" target, as the researchers explained.

• The first campaign relied on trying to abuse flaws in SS7, and then switching to exploiting Diameter if those attempts failed.
• The second campaign used different methods, relying on sending a special type of SMS message to one specific "high-profile" target.
• These attacks are difficult to detect and appear to be geographically-targeted, indicating that actors employing SIMjacker-style attacks likely know the countries and networks most vulnerable to them.

Surveillance Vendors and Their Government Customers

The two spy campaigns have at least one thing in common: Both abused access to three specific telecom providers that repeatedly acted “as the surveillance entry and transit points within the telecommunications ecosystem.” This access gave the surveillance vendors and their government customers behind the campaigns the ability to “hide behind their infrastructure,” as the researchers explained.

• The first one is Israeli operator 019Mobile, which researchers said was used in several surveillance attempts.
• British provider Tango Networks U.K. was also used for surveillance activity over several years, the researchers say.
• The third cellphone provider, Airtel Jersey, an operator on the Channel Island of Jersey now owned by Sure, a company whose networks have been linked to prior surveillance campaigns.

Response from Telecom Providers and Researchers

Sure CEO Alistair Beak told TechCrunch that the company “does not lease access to signalling directly or knowingly to organisations for the purposes of locating or tracking individuals, or for intercepting communications content.”

Gary Miller, one of the researchers who investigated these attacks, told TechCrunch that some clues point to an “Israeli-based commercial geo-intelligence provider with specialized telecom capabilities,” but did not name the surveillance provider.

Conclusion

The two spy campaigns are just the tip of the iceberg, according to the researchers. The exploitation of weaknesses in the global telecoms infrastructure is a widespread issue that needs to be addressed.

In the words of Lorenzo Franceschi-Bicchierai, Senior Reporter for Cybersecurity at TechCrunch, “We only focused on two surveillance campaigns in a universe of millions of attacks across the globe.”

The researchers urge that the findings in this report are a call to action for the industry and governments to take immediate action to address these vulnerabilities and ensure that the global telecoms infrastructure is secure.