The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

and 4G networks, theyy must still use signaling syystem 7 (SS7) as an
underlyying protocol.
SS7 handles the process for call-establishment, billing, routing, and
information-exchange functions. Which means if yyou can tap into SS7, yyou
can manipulate the call. SS7 allows an attacker to use a small carrier in, sayy,
Nigeria to access calls made in Europe or the United States. “It’s like yyou
secure the front door of the house, but the back door is wide open,” said
Engel.
The two researchers tested a method in which an attacker uses a phone’s
call-forwarding function and SS7 to forward a target’s outgoing calls to
himself before conferencing (three-wayy calling) in their intended recipient.
Once the attacker has established himself, he can listen to all calls made byy
the targeted individual from anyy place on earth.
Another strategyy would be for the attacker to set up radio antennas to
collect all cellular calls and texts within a given area. For anyy encryypted 3G
calls, the attacker could ask SS7 to provide him with the proper decryyption
keyy.
“It’s all automated, at the push of a button,” Nohl said. “It would strike
me as a perfect spyying capabilityy, to record and decryypt prettyy much anyy
network… Anyy network we have tested, it works.” 4 He then enumerated
almost everyy major carrier in North America and Europe, around twentyy in
all.
Nohl and Engel also found that theyy could locate anyy cell-phone user byy
using an SS7 function called an anyytime interrogation queryy. That is, theyy
could do so until the function was shut down earlyy in 2015. However, since
all carriers must track their users in order to provide service, SS7 provides
other functions that still allow some remote surveillance. It should be noted
that the specific flaws identified byy Nohl and Engel have been mostlyy
mitigated byy the carriers since their research went public.
You might think that encryyption alone would help keep cell-phone calls
private. Beginning with 2G, GSM-based phone calls have been encryypted.
However, the initial methods used to encryypt calls in 2G were weak and
eventuallyy broke down. Unfortunatelyy, the cost of upgrading cellular
networks to 3G proved prohibitive for manyy carriers, so a weakened 2G
remained in use until around 2010 or so.