Pierluigi Paganini
June 03, 2016
Israeli-based company Ability is planning a big marketing push aimed at law enforcement in the United States. Ability Unlimited Interception System (ULIN) promises unlimited surveillance capabilities of revealing the location, calls, and texts of any cell phone on the planet. The price tag, US$20 million, but with the necessity of responding to the more and more criminal activity being facilitated over mobile networks, the price could be well worth it to keep citizens safe.
“Launched in November last year, it can cost as much as $20 million, depending on how many targets the customer wants to surveil.” reported Forbes. “All a ULIN customer requires is the target’s phone number or the IMSI (International Mobile Subscriber Identity), the unique identifier for an individual mobile device. Got those? Then boom – you can spy on a target’s location, calls and texts.”
Ability was founded in 1993 by experts with military intelligence and communications backgrounds. Specializing in off-air interception of cellular and even satellite communications, Ability’s ULIN technology is a leap forward in espionage capabilities. ULIN’s strength is its ability to capture GSM, MTS, and LTE phone traffic without the need of having to be within close proximity of the device, or with the consent of the mobile carrier, which the phone may belong too.
At the core of ULIN, is its ability to exploit a vulnerability in Signaling System No. 7 (SS7), an international telecommunications standard that defines how public switched telephone networks (PSTN) exchange information over digital networks for mobile phones. The SS7 nodes are called “signaling points” that use out-of-band signaling providing network efficiency and other services such as call forwarding.
Ability licenses this vulnerability from an unknown third party and claims to solely granted access to, or knowledge of, the SS7 vulnerability. All that is required by law enforcement to tap into a phone is the mobile phone number of the target.
Hacking of SS7 is nothing new. In 2015, the FCC launched a probe into the problem after “60 Minutes” aired a report showing German computer scientist Karsten Nohl tapping into U.S. Representative Ted Lieu’s mobile phone. In a counter argument, John Marinho, vice president of the mobile industry group CTIA, claimed Nohl was giving “extraordinary access” for his demonstration for 60 minutes. Ability’s UNIL system appears to overcome that challenge, exploiting the bridge between end-of-life technology SS7, and fully digital networks.
It is likely that civil liberties groups will take exception to Ability’s push into
“This system means that law enforcement will have the ability to conduct wiretaps and location tracking without anybody scrutinizing what they’re doing, and nobody may have the opportunity to push back and demand appropriate legal process.”
Additionally, it has yet to be determined how ULIN runs afoul of U.S. laws on wiretapping and electronic eavesdropping – a federal crime that carries stiff penalties in fines and even imprisonment.
In the end, the opportunities for U.S. law enforcement may be too great an offer to refuse. Even at a $20 million price tag, the capability of conducting criminal investigations bypassing the need of the consent of mobile carriers may reduce time and cost significantly enough to justify the expenditure. The reality is, domestic surveillance is likely here to stay. The efficiency at which information flows between the federal government down to the hands of municipal law enforcement has been questionable in recent years, including the Boston Marathon bombing in 2013, which the real-time sharing of information prior to the bombing was called into question.
The argument will ultimately boil down to safety versus privacy. Which side Ability and its ULIN technology lands is yet to be seen.
Written by: Rick Gamache
Rick Gamache is a freelance writer with 25 years’ experience in the cyber security field. His past work includes the Managing Director of Wapack Labs, CIO of the Red Sky Alliance, and lead FISMA auditor for the US Navy’s destroyer program. Rick has written several high-level cyber and general risk reports with an emphasis on the Nordic countries, India, Russia, and Ukraine and has traveled extensively, speaking on strategic cyber threat intelligence matters as they relate global supply chains.
LinkedIn – https://www.linkedin.com/in/rick-gamache-cissp-021ab43
Twitter – https://twitter.com/thecissp
[adrotate banner=”9″]
(Security Affairs – Mobile, surveillence)
