| ID | Name |
|---|---|
| T1430.001 | Remote Device Management Services |
| T1430.002 | Impersonate SS7 Nodes |
Adversaries may exploit the lack of authentication in signaling system network nodes to track the to track the location of mobile devices by impersonating a node.[1][2][3][4][5]
By providing the victim’s MSISDN (phone number) and impersonating network internal nodes to query subscriber information from other nodes, adversaries may use data collected from each hop to eventually determine the device’s geographical cell area or nearest cell tower.[1]
| ID | Mitigation | Description |
|---|---|---|
| M1014 | Interconnection Filtering |
Filtering requests by checking request origin information may provide some defense against spurious operators.[7] |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0029 | Network Traffic | Network Traffic Flow |
Network carriers may be able to use firewalls, Intrusion Detection Systems (IDS), or Intrusion Prevention Systems (IPS) to detect and/or block SS7 exploitation.[5] The CSRIC also suggests threat information sharing between telecommunications industry members. |