PoC video of How to Hack Gmail and Bitcoin Wallet using SS7 flaw

A long time ago we published a report about how someone can hack WhatsApp with the SS7 by default. The standard SS7 exists for eons now with corrections, but GSM and telecom companies do not bother or trouble to repair their infrastructure against the standard.

Now a Cyber ​​Security Company called Positive Technologies has released a video detail as anyone in any Gmail account can hack with a name and a phone number with the standard SS7. After the abduction of the Gmail account of the victim, the investigators then tried to steal a Bitcoin wallet with the same SS7 defect. Positive researchers sent their video to Thomas Fox-Brewster, an investigating reporter for Forbes, as well as details about hacking.

What is the SS7 error?

The vulnerability is found in the signaling system 7 or SS7, the technology used by telecommunication operators where the high-security message system and telephone calls depend. SS7 is a set of telephone signaling protocols developed in 1975 that make it possible to configure and dismantle the majority of the telephone calls from the public switched telephone network (PSTN). It also performs number translation, local number portability, prepaid billing, short message service (SMS), and other mass market services.

SS7 is vulnerable to piracy and this is known since 2008. In 2014, the media reported on a susceptibility to the SS7 protocol, according to which government agencies and non-governmental actors can track the movements of mobile phone users from virtually anywhere in the world with a success rate of about 70%. In addition, it is possible to listen in secret with the protocol to send calls and also to facilitate the decryption by requiring the caller of each caller to release a temporary encryption key to unlock the communication after it has been recorded. The researchers have created a tool (SnoopSnitch) that can warn if certain SS7 attacks occur against a phone and recognize IMSI microphones.

How to attach Gmail with SS7 standard

In the PoC video, the researchers used a phone number to open the Gmail Google Mail service. Once the e-mail account has been identified, the investigators have sent a password request to the Gmail servers. According to the protocol, Gmail sent the unique authorization codes to the victim's phone. Positive technology researchers then used SS7 to intercept the SMS text that contained the OTP. Once they got the OTP, the Gmail account of the victim hacked and resetting the password was easy. They immediately chose a new password and took over the Gmail account.

With these details they went to the Coinbase website. Again, the same mode is used, that is, to reset another password with the e-mail I hacked. Coinbase also sent an OTP to the victim's smartphone, which was hacked by investigators with the same SS7 defect. Once they had access to the office of the prosecutor, they were able to reset the victim's bitcoin portfolio and access all bitcoins in the portfolio.

"This hack would work for any resource - real money or virtual currency - that uses SMS for password recovery," said positive researcher Dmitry Kurbatov at Forbes. "This is a vulnerability in mobile networks, which ultimately means that it is a problem for everyone, especially those who use the mobile network to send security codes."

Access to SS7 hackers has also been facilitated with easily accessible IMSI receivers. Kurbatow said Forbes that there are many dark websites like Interconnector that sell SS7 services. "The risk lies in the fact that cybercriminals can buy potentially illegal access to the obscure web," said Kurbatov.