Security flaws could help Iran attack US soldiers in the Gulf

Since the conflict broke out in late February, Iran and pro-Tehran militia groups have repeatedly attacked positions or residences of US soldiers in the Middle East, including the 5th Fleet headquarters in Bahrain, a number of hotels in Iraq and most recently the raid on the Muwaffaq Salti base in Jordan that killed 3 US soldiers on July 17.

In addition to the possibility of Iran receiving intelligence support, the US military news site We Are The Mighty Quoting experts, Tehran also seems to be able to track the location of US soldiers in the Middle East thanks to vulnerabilities in Signal System No. 7 (SS7), the protocol used in international roaming services, as well as the advertising delivery system to users on smartphones.

Theo Financial Timesthe monitoring effort began during the period when the US and Israel were preparing to launch a campaign to attack Iran and continued after the outbreak of the conflict, when Tehran launched responses with missiles and drones (UAVs) targeting Washington’s garrison bases in the Middle East.

Data from the Mobile Surveillance Monitor project, based in the US, shows that telecommunications networks in the Middle East have received a wave of information requests from SS7 to determine the location of phones roaming internationally. Two cybersecurity experts assessed this as a “coordinated information exploitation campaign”.

According to a source familiar with the matter, Gulf officials once suspected Iran or armed groups pro-Tehran were taking advantage of roaming agreements with network operators to locate US soldiers. A US official also mentioned the possibility that Iranian-backed militias used advertising databases to track phones in the Kurdish region of Iraq, where US forces are present.

“Iran is fully capable of collecting information and location in real time, instantly and continuously. I would be very surprised if they did not take advantage of SS7 or regional mobile network access to track American users,” Gary Miller, an expert at the cybersecurity monitoring organization Citizen Lab, stated his opinion.

According to Miller, this campaign targeted a specific group of users, of which “a portion can be traced directly to the mobile network provider in Iran”.

SS7 includes a set of protocols developed in the 1970s that allows phones to operate across borders, helping carriers determine where subscribers are, route calls and transfer messages from other countries.

However, SS7 has a number of security holes such as no authentication or encryption measures, unable to verify the party sending the information, and unable to distinguish the network operator from the enemy intelligence agency.

Once accessing the telecommunications network, people can send information to any phone if they know the subscriber number, and find out the location of the base station connecting to the device, redirect calls or block text messages.

Access to SS7 requires a Global Title, a unique identifier assigned to the network device. Carriers own the equipment and can lease it to third parties, sometimes it’s unclear what purpose they’ll be used for.

The risk of security vulnerabilities in SS7 has been warned by security experts since 2016 and repeated many times over the past 10 years. Senator Ron Wyden once wrote a letter to former President Joe Biden’s administration, accusing the US Cybersecurity and Infrastructure Security Agency (CISA) of “hiding information about the threat from SS7 from the people”.

In addition to taking advantage of SS7’s security vulnerabilities, Iran is said to also use another cheap, easily accessible tool that can track smartphones anytime, anywhere, which is an advertising identifier on iOS or Android operating systems.

When a mobile app displays an ad, the user’s unique identifier and approximate location are passed to the ad provider and data aggregator. The information will be packaged into a list of where the phone has been and sold to anyone willing to pay.

This operation is completely legal, requires no background verification, and has no constraints that the buyer is not a military force searching for the target. US officials even made a similar move, when the US Customs and Border Protection Agency earlier this year said it had used phone location data from Internet ads.

After American soldiers evacuated their bases and moved to hotels and civilian offices in the Kurdish region of Iraq during the early stages of the conflict, Iranian military intelligence is said to have used commercial location data to find their new whereabouts.

Some experts also raised the possibility that social media posts and hotel reviews by US soldiers were also the reason why they were targeted.

A bipartisan group of 14 lawmakers, including Mr. Wyden, sent a letter to Pentagon Chief Information Officer Kirsten Davies with three proposals: turning off ad recognition on soldiers’ phones, replacing Chrome with a web browser with privacy protection features on government phones and putting soldiers on the data collection refusal list.

These measures have been recommended by American cybersecurity experts for many years.

When asked to comment on information about Iran taking advantage of security vulnerabilities on mobile devices to locate targets and conduct attacks against US soldiers in the Middle East, a US official said that all such information “is false”.

Central Command (CENTCOM), the agency in charge of US military operations in the Middle East, announced that it had taken “force protection measures” and declined to elaborate.