The network switching subsystem (NSS) is the ‘heart’ of the GSM network: it
is the same no matter which technology (e.g. 2G, 3G, 4G) is used between the
mobile phones and the base station. It handles the movement of users from one
base station subsystem to another, phone calls into the wired network, and SMS
messaging. It also takes care of charging and accounting. Hence whilst the 2G,
3G and 4G protocols manage the ‘over-the-air link’ between phones and base
stations, the SS7 protocol is responsible for many of the functionalities of the
NSS.
SS7 was developed in 1975 based on a ‘walled garden’ principle. It was implicitly
assumed that all MSCs were trustworthy and that nobody was ever going
to gain illegitimate access to this system. But nowadays MSCs can be purchased
online, and some legitimate MSCs are so poorly configured that they are easy targets
for surveillance and/or manipulation. Once access to the network of MSCs
has been gained, it is possible to find out the current cell-level location of any
user (as long as they keep the same known number).
By exploiting the flaws inherent to SS7, an American–Israeli company named
Verint has been able to develop and market a product named SkyLock that boasts
the ability to track any user anywhere, even for 3G and 4G systems.2
1See https://github.com/CellularPrivacy/Android-IMSI-Catcher-Detector/wiki/
Development-Status.
2See https://assets.documentcloud.org/documents/1275167/
skylock-product-description-2013.pdf