We know public Wi-Fi networks can be unsecured, and we’ve tailored our use to deal with those problems. But now, hacking cellular networks may be a growing danger as more cracking devices and techniques become more available. You and the cellular industry will need to step up your games. You’ll need to be more aware of the problem and more proactive in adopting safeguards, and the industry will need to develop better safeguards.

Here’s what we’re up against, as reported recently in The New York Times in an opinion piece by Cooper Quintin, a senior staff technologist at the Electronic Frontier Foundation. Our cellular networks have been vulnerable to breach through the use of spy tools. While it’s easy to accept that the CIA and the spy agencies of other countries are always looking to gain information by any means possible, it’s unacceptable that 1.) our government has not paid more attention to shoring up security flaws and that 2.) the prices for spy technology have come down while technology capabilities have gone up. That second factor enables thieves to intercept cellular transmissions that can contain sensitive financial and health data.

We’ve published articles about all the steps you need to take verify a Wi-Fi network is secure or use your cellular service instead of Wi-Fi for better security for banking and financial transactions, including online purchases. But now, thieves are more capable of exploiting vulnerabilities in the backbone of the global telephone system (known as Signaling System 7, or SS7) to track mobile users, intercept calls and text messages, and disrupt mobile communications. In Germany, it’s reported, thieves exploited SS7 weaknesses to redirect and intercept text messages containing one-time passwords for bank customers and steal money from the victims’ accounts.

SS7 relies on technology introduced in 1975, which might be before some of you were born. The introduction of GSM or 2G technology in 1991 allows your cellphone to communicate with a cell tower to make and receive calls and transmit data. It doesn’t verify that the tower that your phone connects to is authentic, making it easy for anyone to use a cell-site simulator and impersonate a cell tower to obtain your location or eavesdrop on your communications. While 2G systems are being dismantled and later generations of GSM solve many of the problems, there are still vulnerabilities that allow new generations of cell-site simulators to keep working. Those new systems are manufactured in Russia, China, Israel and other countries, and their low cost and ease of set up are attractive to criminal elements.

Legal remedies to force technology changes seem to be thwarted, the report’s author notes, by the sheer size of the problem and by the fact that law enforcement agencies can use the same technology to deal with criminal and terrorist elements. And those are international issues, not just national issues. The potential for widespread abuse of SS7 by both government intelligence agencies and non-state actors has been reported for the last four years. TV news program 60 Minutes even demonstrated an attack on a Congressman’s cellphone number.

SS7 vulnerabilities underscore the risks of relying on text messages for two-factor authentication and the need, instead, to rely on cryptographically based security keys as a second authentication factor. We believe you should also look at security apps that are dedicated to smartphone technology. We discussed some of them in a recent article about going password-less. You may also want to think about encryption for your phone.

Call us – 973-433-6676 – or email us if you have any questions about cellular security or need help in setting up your system.