Ataques a redes móveis usando vulnerabilidades do SS7 :uma análise de tráfego real e proposta de auditoria

• Ano de defesa: 2019
• Autor(a) principal: Macedo, Luiza Odete Herback de Carvalho
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Federal do Rio de Janeiro; Brasil; Instituto Alberto Luiz Coimbra de Pós-Graduação e Pesquisa de Engenharia; Programa de Pós-Graduação em Engenharia Elétrica; UFRJ
• Palavras-chave em Português: Redes móveis; Telefonia celular; SS7; Corrente de blocos; Telecomunicações
• Link de acesso: http://hdl.handle.net/11422/23159

Signaling System 7 (SS7) defines a stack of protocols used primarily in the interconnection of networks from Service Providers, for example, in mobile networks. Originally, such protocols were based on mutual trust relationships between components, i.e., SS7 was not designed focusing on network security. With the emergence of the so-called ”IP world” and the growth in the number of carriers, mobile networks got exposed to attacks on SS7. By means of SS7, attackers can locate users, obtain private data, and even trigger a denial of service attack. Several countermeasures have been proposed for SS7 attacks, such as firewalls and asymmetric cryptography, but none of these were fully effective. From the data analysis of a real traffic, this work has as purposes: the network vulnerability evaluation of a large brazilian telecommunications operator and the characterization of the threats obtained for modeling the attackers. Additionally, it is proposed to use blockchain technology as an approach to introduce auditability and traceability of network operations, suited as a complement to existing countermeasures. This makes it becomes possible to identify threats and determine their impact on the network, leading to an improved security of mobile networks. Finally, the proposal feasibility is evaluated through computational resource consumption measurements, flow and latency of blockchain transactions, in order to measure the result of the adoption of the technology to the network elements already implemented. Through performance analysis, it is shown that it is possible to adhere to the proposed technology, without causing major impacts to the existing infrastructure in the operator’s network.