Wireless carriers and mobile device makers are furiously trying to ramp up to 5G as the next generation of cellular technology. In the meantime, 4G has become the preferred option in more parts of the world.

But this doesn’t mean that 2G and 3G are going away, at least not anytime soon. As such, the security flaws inherent in 2G and 3G will continue to plague us for many years to come, according to a report released Tuesday by Positive Technologies.

SEE: 5G mobile networks: An insider’s guide (free PDF) (TechRepublic)

For its “SS7 network security analysis” report, Positive Technologies analyzed the networks of 28 telecom providers across Europe, Asia, Africa, and South America, between 2018 and 2019. As a result of certain vulnerabilities, the company found that hackers could compromise 2G and 3G network to potentially track the location of users, listen to calls, intercept SMS messages, and even cut off service.

Much of the problem lies in the underlying Signaling System No. 7 (SS7) protocol used to exchange signaling messages in 2G and 3G networks. Designed years ago, SS7 contains specific architectural flaws that render it vulnerable to a variety of threats and attacks, including eavesdropping, SMS interception, and fraud. Beyond these security holes, cybercriminals can also potentially buy access to SS7 networks via the Dark Web.

Though the wireless industry has gradually been beefing up the security of SS7, companies have become so focused on rolling out 5G that they’re neglecting the risks still inherent in 2G and 3G, according to the report. In fact, the vulnerabilities have become stronger. Researchers at Positive Technologies found that over the past three years the number of vulnerable networks has grown in almost all types of threats, including information disclosure, location disclosure, call interception, and subscriber denial of service.

“Although there are talks amongst mobile operators to retire and shut down their 2G and 3G networks, GSMA reports that these previous generation networks will still be available to the public over the next five years,” Positive Technologies Chief Technology Officer Dmitry Kurbatov said in a press release.

“This means that SS7 won’t be a thing of the past anytime soon,” Kurbatov added. “Whilst operators have been hasty in turning their attention away from 2G and 3G, the reality is that the newer networks are also built using previous generation networks’ infrastructure, meaning they are plagued with the same SS7 security issues. For example, some 4G features are still dependent on 2G/3G systems, including sending SMS messages and establishing call connections.”

Though network providers are aware of the risks and potential threats, many don’t understand how to properly prevent them, according to the report. For its research, Positive Technologies that it found a low standard of security even where expensive solutions had already been put in place.

To help wireless carriers protect their 2G and 3G networks against security threats, Positive Technologies offered the following recommendations:

  • Adhere to GSMA security recommendations. Compromised of companies in the mobile industry, the GSMA offers guidelines on several aspects of mobile communications, including how to monitor SS7 traffic. But only 30 percent of telecom operators in the European Union and less than 0.5% of operators in developing countries have implemented these recommendations.
  • Monitor and analyze signaling traffic. Signaling traffic that crosses network boundaries must constantly be monitored and analyzed to identify both potential threats and configuration errors. The GSMA also recommends the use of monitoring systems with specialized threat identification to analyze signaling traffic in real time and identify suspicious activity from external sources. These systems can block illegitimate messages without affecting network functionality and without disconnecting legitimate customers. They can also work with other security solutions.

“The first step is to make sure the right processes are in place to ensure that operators don’t have any blind-spots in their mobile networks,” Kurbatov said. “Only a comprehensive approach, which includes regular monitoring of any anomalies to detect illegitimate activities and by following GSMA guidelines, can operators ensure a higher level of protection against criminals. Operators need to learn from lessons of the past to avoid making the same mistakes with 4G and 5G.”


Image: Olivier Le Moal, Getty Images/iStockphoto