STUDY PAPER ON SS7 Security - tec.gov.in security.pdf · SS7 was traditionally served over Time...
Transcript of STUDY PAPER ON SS7 Security - tec.gov.in security.pdf · SS7 was traditionally served over Time...
1 | P a g e
STUDY PAPER ON
SS7 Security
……TSA Division, TEC
2 | P a g e
INDEX:
i. Introduction………………………………………….…3
ii. Signalling System No. 7…………………………….….4
iii. Security Issues in SS7…………………………....…….5
iv. Mitigation of Attacks………………………………….12
v. Best Practices………………………………………….13
vi. Future Relevance of Attacks………………………….14
vii. Worldwide Attacks in SS7…………………………….15
viii. Conclusion……………………………………………...16
ix. Glossary………………………………………………...17
x. References……………………………………………...18
3 | P a g e
1. INTRODUCTION:
Common Channel Signalling System No. 7 (SS7 or C7) is a global standard for
telecommunications defined by the International Telecommunication Union (ITU)
Telecommunication Standardization Sector (ITU-T). The standard defines the procedures and
protocol by which network elements in the public switched telephone network (PSTN)
exchange information over a digital signalling network to effect wireless (cellular) and wireline
call setup, routing and control.
Traditionally SS7 is based on “Walled Garden approach” which means solely based on mutual
trust between the interconnecting operators. Operators relied on their trust in other operators to
play by the rules, and the SS7 network has been regarded as a closed trusted network.
But in present scenario this is not valid. Network providers are opening up their SS7 networks
for third parties as their commercial offerings which may introduce vulnerabilities in the
existing network.
Attacks on SS7 sometime may have a severe effect and depending upon the nature of protocol
it will allow access to information such as user location and call/SMS details and in turn also
effect financial services. Hence an urgent need rises to analyse the security gaps in such
networks and implement the needed controls to close these gaps
In this paper we will examine the attacks against SS7 and look into the basic security
mechanism aiming the mitigation of those attacks. This paper also addresses the best practices
which needs to be adopted to address SS7 insecurities and increase the core network security
posture.
4 | P a g e
2. Signalling System No. 7:
The Signalling System Number Seven (SS7) is a suite of protocols that were standardized in
the 1980s in ITU-T Q.700 series. New protocols added in the 1990s and 2000s by ETSI and
3GPP to support mobile phones and the services they need (roaming, SMS, data).
Fig 1: CCS7 Protocol Stack
The Mobile Application Part (MAP) is an SS7 protocol that provides an application layer for
the various nodes in GSM and UMTS mobile core networks and GPRS core networks to
communicate with each other in order to provide services to mobile phone users. The Mobile
Application Part is the application-layer protocol used to access the Home Location Register,
Visitor Location Register, Mobile Switching Centre, Equipment Identity Register,
Authentication Centre, Short message service Centre and Serving GPRS Support Node
(SGSN).
The Customized Applications for Mobile Network Enhanced Logic (CAMEL) was introduced
to allow mobile operators to build custom services that were not possible through MAP.
SS7 was traditionally served over Time Division Multiplexing (TDM) networks but with the
evolvement of IP networks, SIGTRAN was introduced as part of the SS7 protocol family and
uses an IP protocol called Stream Control Transmission Protocol (SCTP) as the transport layer
for SS7.
SS7 protocol suite has its diverse application across the global telecommunication network. It
is the signalling protocol used between the control elements in the mobile core network. When
a mobile is switched on, the identification, authentication and registration of the Subscriber
MTP Level 1
MTP Level 2
Ethernet
IP
SCTP
MTP Level 3
ISUP
SCCP
TCAP
M2UA
CAP MAP
SS7
SIGTRANN
5 | P a g e
Identity Module takes place through SS7 based signalling. SS7 is also needed each time we
make a telephone call which goes beyond local exchange.
Other than as mentioned above SS7 network and protocol has following applications:
1.Call establishment, management and release.
2. Short Message Service (SMS)
3. Supplementary services by the mobile operators such as Call Number Display (CND), call
waiting and call forwarding.
4. Line Information Database (LIDB) which has information related to subscriber's identification such as name and address along with billing information.
5. Local Number Portability (LNP)
6. Toll-free numbers for telemarketing
7. Televoting
8. Enhanced Messaging Services (EMS) such as logos and ringtone delivery.
9. Call blocking (Do-not-call enforcement)
3.SECURITY ISSUES IN SS7:
SS7 protocols was designed on time when it was used by only closed community of telecom
operators and mainly built on mutual trust and cooperation between those operators.
Regardless of the advancement in IP-based mobile technologies, SS7 still continues to
dominate the telecommunication world because it has become the backbone of Global System
for Mobile Communications (GSM) systems and all new cellular technologies based on it.
However, the mobile networks are no longer the realm of a few trusted national operators.
Newer technologies like SIGTRAN and Session Initiation Protocol (SIP) have increased the
entry points to mobile core network and the opening of the telecommunications market for
competition has increased the number of “trusted” operators far beyond what was originally
intended. Hence, today SS7 is no longer a close network and is also used for interconnectivity
between mobile network operator networks and to enable roaming and cellular services across
operator domains.
Due to security point of view SS7 was designed with very few and weak mechanism of
Authentication and authorization.
In the last quarter of 2014, several successful attacks using the SS7 network such as
eavesdropping, tracking of user, SMS spoofing and SMS redirect, have been demonstrated.
However, an in-depth technical research of these attacks from the mobile network provider’s
point of view to understand the vulnerabilities in the existing systems has been lacking.
In the next sections, we will examine some of the attacks against SS7 controls and eventually
propose certain mechanisms that can limit the effect of these attacks.
3.1 Call and SMS interception:
Intercepting communications has always been the ultimate target for any espionage operations.
In the old days of wired phones, the attackers physically tap into the wire to be able to listen to
an ongoing call.
In the age of mobile communication, the call is transmitted over the radio between the calling
parties and the mobile networks. Normally the traffic is encrypted over the air interface. The
encryption is done using either A5/1 or A5/3 protocols. Recently the A5/1 suite has also been
6 | P a g e
broken and it is possible to decrypt the calls transferred over the air interface using cheap radio
interceptors and rainbow tables. As a result, the operators started to roll out the stronger
ciphering protocol A5/3 to combat such attacks.
A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for
cracking password hashes.
3.1.1 Call Interception using send Identification:
Fig 2 : Using sendIdentification for call Interception
Send Identification is a MAP message which is used in inter MSC Handover process.
The mobile switching center MSC normally holds the encryption keys used by each subscriber
to be able to establish the call. When the subscriber is moving, due to handover process the
smooth transition of the subscriber between the different radio cells happens while maintaining
the call progress.
In some cases the subscriber moves from one cell to another which may be in different VLR.
In this case, the new VLR does not initially have the authentication information that would
facilitate the call, hence an inter MSC handover process is needed to transfer the keys to the
new MSC.
This is done through “sendIdentification”. The new VLR sends a “sendIdentification “ message
to the old VLR, which in turn responds with the keys needed to maintain the ongoing
call.Among these keys are the key used to encrypt the traffic over the air.
During the attackes, the attacker captures the targets traffic over the air interface (requiring
physical proximity from the target). With access to SS7, he can then use the sendIdentification
message to retrieve the decryption keys for the target and use it to decrypt the traffic.
3.1.2 Interception using 3G IMSI Catcher:
Second Generation (2G) networks did not offer the concept of mutual authentication, where
the network authenticates itself to the subscriber. This made the subscriber vulnerable to an
attack known as the 2G IMSI catcher. In this scenario,the attacker using a rogue radio cell
could announce the same network as a legitimate network with higher power than the normal
network. The target would then connect unknowingly to the rogue cell instead of the legitimate
network. The attacker intercepts the call, and then forwards it to its destination.
In 3G networks, such attack was not possible, since the network has to authenticate back to the
subscriber before a call is established. However with access to SS7, the attacker can send
MSC Global SS7 MSC
PVLR VLR Send identification
7 | P a g e
another MAP message called sendAuthenticationInfo to the HLR to get the info needed to
successfully impersonate the legitimate network.
Fig 3: 3G IMSI Catcher with sendAuthentication Info
3.1.3 SMS Interception :
The update Location message is used to update the subscriber’s location in the network. It
informs the network of which VLR/MSC the subscriber is currently connected to.
Figure 4. Update subscriber location with a fake location
8 | P a g e
Figure 5. Attacker receives SMS intended to the user
Using a fake updateLocation message the attacker claims that the victims MS is connected to
their MSC. In this case, the subscriber SMSs will be forwarded to the attacker’s SMS center to
be delivered to the MS. In addition to intercepting personal SMSs of the target, this attack can
be used against authentication systems that utilize SMS verification (SMS token, Facebook
verification, etc.) and could lead to the compromise of the target’s identity.
3.2 Location Tracking:
With growing number of mobile phone users, number of services that the mobile user demands
is increasing. There exists many location based services in which user allows the application
vendors to learn about their location. However, the insufficiently protected nodes in mobile
communication networks would also disclose the location without user's consent.Some of SS7
vulnerabilities that can facilitate location tracking are as follows:
3.2.1 Attack using call setup messages
This attack using the normal working message flow of the call set up messages to know the
approximate location of the user (or MS). Successful completion of this attack as per would
reveal the IMSI (which is supposed to be a secret), global title of the MSC (which identifies
the MSC uniquely in the global network and its geo-location) and error messages if the phone
is turned off.
9 | P a g e
Figure 6: Location disclosure using call setup messages.
In this scenario Attacker impersonate as GMSC, send MAP SRI message enclosing the
MSISDN (phone number) to the HLR. Since there is no authentication check made, HLR thinks
someone is trying to call to the provided MSISDN and processes the message,which in turn
through communication with VLR get knowledge about MSRN containign IMSI and GT of
MSC/VLR to which subscriber is connected.This information inturn passes to attacker
impersonating as GMSC and thus location of subscriber will get passed to attacker.
3.2.2 Location disclosure using CAMEL Location Management Function Messages:
Customized Applications for Mobile Networks Enhanced Logic (CAMEL) is an overlay on
MAP logical layer. As part of location management function, the net-work providers can send
Any Time Interrogate (ATI) messages to the HLR from CAMEL platforms to obtain the cell
ID or location of the user along with which it can provide the subscriber information such as
billing data and International Mobile Station Equipment Identity (IMEI).
This Cell-ID can be acquired by attacker which can be thus used to determine the actual
location of subscriber.
Figure 7: Abusing anyTimeInterrogation message to acquire target’s location
10 | P a g e
3.2.3 Location tracking (ProvideSubscriberInfo (PSI)):
In case the ATI message has been filtered, the attacker can still send the provideSubscriberInfo
message directly to the MSC/VLR that the subscriber is currently connected. The attacker will
first need to find out the IMSI and address of the MSC using a message like
sendRoutingInfoForSM that returns the Global Title (GT) address of the MSC.
Figure 8. Acquiring cell ID using ProvideSubscriberInfo
3.2.4 Hybrid Attack using SMS and CAMEL messages:
Though anyTimeInterrogation is part of some of the location finder application services , many
network operators block (filter) it for security purposes and hence attacker might not get
anyTimeInterrogation request message in return always. However, attacker can bypass that
using a hybrid attack by directly querying the MSC/VLR. The Figure 9 below, describes such
hybrid attacks of circumventing anyTimeInterrogation filters imposed by network operators.
Attacker can send Provide Subscriber Info request to the MSC/VLR by impersonating as HLR.
However this will be treated by MSC/VLR only if the IMSI is provided by the HLR. Since we
assume that the attacker just knows the MSISDN or phone number of the victim, the attacker
should get the IMSI first.
11 | P a g e
Figure 9: Location disclosure hybrid attack.
3.3 SS7 AND SIGTRAN:
Being an addendum of SS7 suite, SIGTRAN supports call management and application models
of SS7 but over the Internet Protocol (IP) and the transport-layer called Stream Control
Transmission Protocol (SCTP). SIGTRAN facilitates adaptation of Voice over IP (VoIP)
networks to the PSTN signalling. An attacker can use SCTP stealth scanning methodologies to
explore the vulnerable ports in the SS7 core network.
One of the useful tools to scan SCTP-enabled network elements is SCTPScan which scans
machines having major operating systems such as Linux, BSD, MacOS X and Solaris. It allows
the attacker to find entry points to the telecom core network infrastructure along with mapping
them.
SCTPScan uses the INIT (Initiation) chunk of SCTP packet and listen to the INIT ACK
message to learn the live host machines and open ports.
12 | P a g e
Figure 10: (a) SCTP full 4 way handshake (b) SCTP scan by attacker
4. MITIGATION OF ATTACKS: Since mobile core network consists of assorted protocols, applications, platforms and
implementations, a concrete amalgamation between the underlying systems is required to build
a defense mechanism against the attacks. A heterogeneous attack management system to
protect the distributed architecture of telecommunication core network should facilitate secure
communication infrastructure through authentication, encryption and access control
mechanisms.
4.1 BOUNDARY DEFENSES:
Security of network can be strengthened by creating hardened network perimeter. i.e by
establishing a clear and secure boundary to the network. Boundary defenses such as an SS7-
aware firewalls and IDS/IPSs that has the capability of understanding SS7/MAP traffic and
detect/block these attacks. Some of mechanisms are explained below:
i. SSPs are the entry points to SS7 core network from the RAN network, an authentication
component deployed at each every SSP will restrict the attacks that try to gain core network
access.
ii. While studying the attacks abusing mobile core network, it was evident that attackers misuse
the interconnection between multiple operators at STPs. Attackers often masquerade as
roaming partners and try to establish connection to target STPs by their GT or SSN, and then
exploit the system by issuing unexpected network internal commands. Such malicious
activities can be stopped by implementing a sophisticated STP firewall system to monitor the
interconnection.
An intuitive firewall can be overlaid onto the existing network; by situating the firewalls at SS7
interconnect points. An advanced analysis and reporting module accompanying the firewall
can perform real-time inspection and report it to the firewall for policy changes.
iii. Since SCPs deal with sensitive data, the messages addressed to SCPs have to be scrutinized
carefully for their authenticity. An access control module situated just before SCPs can control
restrict illegitimate messages from unauthenticated network entities. Furthermore, a real-time
13 | P a g e
fraud analyser interfaced with SCPs in conjuncture with the access control module can be
useful to analyse doubtful messages that have bypassed the access control mechanisms. These
measures can help to protect the subtle subscriber information residing in the SCPs (such as
HLR and EIR) from illegitimate accesses.
4.2 Maintenance, Monitoring & Analysis of Audit Logs:
Log the usage of specific MAP messages, either using native logging capabilities of the core
network elements or through logs provided by quality of service nodes deployed to monitor
network quality. These logs can then be analysed for abnormalities such as those resulting from
all category of attacks.
An example of correlation would be receiving an update Location message from an external
entity in a short period of time after receiving another message internally. This scenario is not
normal in reality since it means that the user has travelled abroad in a very short period of time,
indicating an attack against that user.
5.BEST PRACTICES:
Some of the best practices that can be incorporated by both mobile network operators and
providers are enlisted below:
i. High priority messages like Any Time Interrogation and MAP Send Parameters is purely
internal. Hence any such message from an external network should be filtered out.
ii. Mobile network operators should completely remove dependency on handing over subscriber
IMSI and MSC GT to external networks. This mechanism can be adapted using proper
implementation of SMS home routing and optimal routing within the network. This forbids the
attackers at first place from executing interception and fraudulent attacks as they cannot locate their
victims.
iii. Messages like Insert Subscriber Data should be processed only after authenticating the origin
of the message. In case if they are originated from external networks or APIs, such requests should
be denied.
iv. Any information being sent out of HLR should be filtered based on checking the origin of
requester. Messages such as Update Location have to be checked with the previous MSC/VLR to
confirm the legitimacy of new VLR.
v. Network operators without roaming agreements should be blocked at interconnect STPs.
Transport layer firewalls (Layer 2 firewalls) as part of SCCP Routing Control (SCRC) to enforce
legitimate GT and SSN routing can be implemented to provide more security to the system. This
firewall can also be accompanied with application level firewalls (Layer 7 firewalls) to filter out
malicious MAP, CAP and supplementary (SS) service messages.
vi. Mobile operators should educate their subscribers to be aware of RAN network attacks such as
IMSI catchers, fake base stations and silent SMS by enforcing them to use user applications such
as ‘SnoopSnitch’ and ‘Darshak’.
14 | P a g e
6. FUTURE RELEVANCE OF ATTACKS
6.1 3G,4G and Beyond: Though SS7 protocol seems to be outdated, vulnerabilities in SS7 have affected newer
standards such as UMTS and LTE. SS7 enables the exchange of encryption keys and, hence,
even the UMTS encrypted communication over RAN can also be decrypted by mounting the
attack as explained above.
Contrary to all the attacks analysed in this paper against the mobile core network, there exist a
large number of attacks that exploit other vulnerabilities in SIM cards and the mobile Internet
(GPRS) as well as enable sniffing the RAN traffic. Even with the implementation of the latest
cryptography standards, mobile phones are still prone to clandestine surveillance programs, as
the encryption keys used at the root level (SIM cards) are too short to resist cyber espionage.
The attackers exploit basic cellular service workflow such as voice calls and text messages,
and hence not all the SS7 attacks can be blocked with simple filtering as it might affect the
regular working mechanisms of telecommunication systems. Furthermore, attacks on value-
added services such as Unstructured Supplementary Service Data (USSD), which is used for
monetary transactions can incur considerable financial loss to the victim or wipe out personal
data from the phone. Since banks and other governmental agencies are also involved besides
the mobile phone subscribers, USSD-based attacks can be catastrophic to a larger community.
6.2 SS7 and DIAMETER:
Currently through 4G everything is moving towards ‘all-IP’ connections and the IP based
Diameter protocol. Since the IP-based signalling protocols by default use IPsec to authenticate
connections, they have higher chances of providing sufficient security than SS7.
Diameter addresses a broader range of emerging technologies than just cellular access, such as
Mobile IP and the Internet of Things (IoT). Diameter is considered to be a peer-to-peer (P2P)
communication protocol. Being a P2P network, every node within the Diameter system can act
as a client or a server depending on the network deployment. Every peer within the system uses
dynamic peer discovery strategies including peer tables, which removes the need for the
manual configuration of the NAS.
One of the key measures to protect the core telecommunications network against network
breaches is by hiding the critical elements from outside exposure. In SS7, the Global Title
Translation (GTT) functionality helps to achieve network exposure by reducing the need of
disclosing the entire network’s element addresses in the routing tables of each and every node
of the network. GTT hides the critical infrastructure such as HLR and EIR, as STPs can resolve
the actual addresses of these elements using internal routing tables. This concept in Diameter
protocol is implemented by default in the Home Subscriber Service (HSS) which takes care of
GTT as well as mutual network terminal authentication. GTT and mutual terminal
authentication jointly can protect the system against SCTP port scanning and impersonation
attacks.
Another concern of the GSM/UMTS core networks is mapping the boundaries of the core
network by an attacker by penetrating deeper into the network using vulnerable ports exploiting
the interconnection gateways. The Diameter protocol prevents such penetration by topology
hiding in terms of critical infrastructure as well as routing paths.
15 | P a g e
Diameter uses Network Access Identifier (NAI), Challenge Handshake Authentication
Protocol (CHAP), Extensible Authentication Protocol (EAP) and Password Authentication
Protocol (PAP) for authentication which makes it relatively more secure than SS7.
One of issue in Diameter protocol is that is standardizes the use of IPSec and TLS in mobile
communication but use of them is mandatory. Also, there is no procedure to verify whether
IPSec or TLS have been used underneath the Diameter implementation of VPLMN. Moreover,
being a P2P protocol, Diameter is application based. The rate at which Diameter can send or
handle messages and the disclosure of interconnected peers or routes are dependent on the
application. The packets that a Diameter system can send depend on the application that
generates them rather than network settings. In such application driven environments, if there
is insufficient traffic to piggyback the acknowledgement messages, the underlying TCP or
SCTP protocols may cause more traffic with encrypted data. Furthermore, the application
decides the penetration or reachability of the signaling messages. The attacker can impersonate
at the application level and penetrate deeper into the core network. Hence Diameter cannot
completely ensure the core network security against spoofing and interception during
interconnection.
Yet another issue with Diameter protocol is that, it does not secure the system against DoS
attacks. Though the peers can recognize the malicious flooding messages, the failover
algorithms within Diameter implementation try to respond to the attacker with error messages.
The attacker can exploit this vulnerability to submerge the target peer with flooding messages
and hence execute a successful DoS attack.
But compared to SS7 ,DIAMTER through its AAA mechanism may provide a better and secure
solution.
7. WORLD WIDE ATTACKS IN SS7:
i. Attack in Ukraine SS7 Network :
This is one of the major incidents of SS7 attack as registered by NKRZI (which is the National
Commission for the State Regulation of Communications and Informatization in Ukraine),a
Ukrinian Telecom regulator in 2014.As per published reports, many Ukrainian mobile phones
holders have been affected by notorious SS7 packets that possibly derived from some other
nation. As a result,every details of mobile phones including addresses,contacts etc were
intercepted by attackers.
A series of SS7 packets were received by MTS Ukraine's SS7 network which modified control
information stored in network switches for a number of MTS Ukraine mobile users. In doing
so, when one of the affected mobile subscribers tried to ring someone else, their call would be
forwarded to a physical land line number in other location for interception.Through this
attackers also intercepted the calls illegaly.
ii. In 2010,due to malformed SS7 traffic, HLR of an European MNO crashed resulting into
12 hour downtime of the complete network.
16 | P a g e
8. CONCLUSION:
Telecommunication network is an intricate system made up of diverse subsystems built on
different technologies. While legacy systems are there to survive for the years to come, the
security of the whole system can be defined by the security level of the weakest link and
partner. The SS7 protocol was built for signaling between a handfuls of trusted
telecommunication partners, but it is still being used in the backbone of mobile communication
with an open market for new operators to serve more than half of the world population. SS7
may still continue to dominate mobile core network system for at least the next few years.
Moreover, integration of Internet technologies with telecommunication systems have produced
new ways for attackers to penetrate into the system. Popular hardware, software and operating
systems on personal computers provide the same functionality as sophisticated equipment used
in earlier day’s telecommunication environment, which means that the attacks no longer limited
by access to hardware or software.
Hence Security issues of SS7 may cause a serious concerns for Indian telecom Scenario and
operators should address these weakness and identify all possible mechanisms for addressing
those issues. In CERTIN ,Presently no seperate mechanism to report SS7 incidents and hence
proposed T-CERT should be encouraged to address SS7 security issues.
17 | P a g e
8. GLOSSARY:
i. AAA: Authentication, Authorization and Accounting
ii. BSS: Base Station Subsystem
iii. CHAP: Challenge-Handshake Authentication Protocol
iv. CAMEL: Customised Applications for Mobile network Enhanced Logic
v. EAP: Extensible Authentication Protocol
vi. GSM: Global System for Mobile communication
vii. GPRS:General Packet Radio Service
viii. GT: Global Title
ix. GT: Global Title Translation
x. HLR : Home Location Register
xi. IDS: Intrusion Detection System
xii. IMSI International Mobile Subscriber Identity
xiii. INTI:Initiation
xiv. IPS:Intrusion Prevention System
xv. IOT:Internet of Things
xvi. MAP: Mobile Application Part
xvii. MSC: Mobile Switching Centre
xviii. NAS: Network Access Server
xix. NAI:Network Access Identifier
xx. MSISDN: Mobile Station International Subscriber Directory Number
xxi. MSU: Message Signalling Unit
xxii. MSISDN: Mobile Subscriber ISDN
xxiii. PSTN: Public switched telephone network
xxiv. P2P: Peer to Peer
xxv. PAP: Password Authentication Protocol
xxvi. RAN:Radio Access Network
xxvii. SMS Short Message Service
xxviii. SMS-C SMS Centre
xxix. SS7 Signalling System No. 7
xxx. STP Signalling Transfer Point
xxxi. SCCP Signalling Connection Control Part
xxxii. SCTP: Stream Control Transmission Protocol
xxxiii. SCP: Service Control Point
xxxiv. STP:Signal Transfer Point
xxxv. SCRC: SCCP Routing Control
xxxvi. SIGTRAN Signalling Transport
xxxvii. TCAP Transaction Capabilities Application Part
xxxviii. TLS: Transport Layer Security
xxxix. VPLMN Visited PLMN
xl. VLR Visitor Location Register
xli. VPLMN: Visited Public Land Mobile Network.
xlii. UMTS: Universal Mobile Telecommunications System (3G)
18 | P a g e
9.REFRENCES:
[i] SANS Institute - The Fall of SS7 How Can the Critical Security
Controls Help? Paper
[ii] SS7: Locate, Track & Manipulate: https://www.youtube.com/watch?v=lQ0I5tl0YLY
[iii] SS7 Map.(P1 Security)- http://ss7map.p1sec.com/
[iv] IMSI Catcher. [pdf document]
[v] http://www.emsec.rub.de/media/crypto/attachments/files/2011/04/slides_imsi_cat
cher.pdf
[vi] v4_Sid Master Thesis- on SS7 Security
[vii] IR.7031-GSMA Paper on SS7 Fraud
[viii] http://securityaffairs.co/wordpress/31598/intelligence/ss7-attacks-ukraine.html