SS7 and Diameter Flaws Expose Mobile Networks
Flaws in core telecom signaling protocols continue to expose mobile users to tracking, interception, and impersonation without requiring any device compromise.
Radwan AbdulhadiEditor and technology writer
The Core Vulnerabilities of Telecom Signaling
Every single phone call, text message, and mobile data session relies on backend carrier-to-carrier control protocols known as signaling. Serving as the automated descendants of traditional telephone switchboards, signaling protocols like SS7 and Diameter act as the connective tissue between global providers. However, these underlying systems represent one of the most overlooked attack surfaces in mobile security.
Two primary protocols handle the vast majority of this traffic: SS7, introduced in the 1970s and primarily used in 2G and 3G networks, and Diameter, its successor used in 4G and most 5G networks. Designed in an era when only a small number of large operators interconnected, both protocols fundamentally assume that any traffic claiming to originate from a legitimate operator is trustworthy. SS7 features virtually no process to authenticate the machine making a request. While Diameter supports stronger authentication on paper, operators frequently omit basic protections such as encryption and continue to rely on the same outdated peer-to-peer trust model.
Real-World Exploits and Surveillance Campaigns
While signaling vulnerabilities have existed for decades, they have recently gained prominent attention through high-profile incidents and extensive security research. Signaling attacks were reportedly exploited when Iranian-linked actors used outdated network technology to locate the phones of US personnel in the Middle East, as <span style="color:blue;">reportedly exploited</span> sources detailed. Beyond geopolitical conflicts, researchers and journalists have demonstrated these flaws repeatedly. Veritasium famously hijacked a tech influencer's calls and texts using only his phone number, and US Congressman Ted Lieu’s phone was hacked on live TV via SS7.
Furthermore, Citizen Lab exposed <span style="color:blue;">two long-running commercial surveillance campaigns</span> abusing both SS7 and Diameter protocols, uncovering thousands of attacks targeting individuals across dozens of countries. Criminal enterprises have also leveraged these weaknesses to target <span style="color:blue;">bank accounts</span> by intercepting SMS verification codes.
How Attackers Exploit Signaling Networks
An attacker who gains access to the global signaling backbone—either through commercial leasing arrangements or by compromising a legitimate operator—can transmit messages that telecom carriers worldwide treat as legitimate. Because these operations occur entirely within automated carrier transactions, they leave no trace on the victim's device and require no malware or phishing links.
With network access, malicious actors can execute several distinct malicious actions. They can harvest a subscriber's International Mobile Subscriber ID (IMSI) by pretending to route a call or SMS, harvest real-time location coordinates or cell tower connections, and intercept communications by falsely claiming the subscriber has roamed onto another network. Combining intercepted communications with stolen credentials frequently results in <span style="color:blue;">intercepted SMS one-time passcodes</span>, allowing attackers to bypass two-factor authentication and drain financial assets.
Carrier Defenses and Structural Limitations
Mobile carriers deploy signaling firewalls designed to block improperly routed messages and run velocity checks to determine whether physical travel between locations is plausible. If a subscriber was recently in New York, a sudden roaming claim from a distant network might trigger a denial.
However, structural challenges remain. According to <span style="color:blue;">research</span> presented at the Wireless Security conference, privacy-first mobile carrier Cape measured Diameter updates from visited networks arriving as infrequently as every two to ten hours. In regions like the US and Germany, hundreds of distinct networks are reachable within an hour of travel time, giving sophisticated attackers ample opportunity to find a plausible operator identity. Citizen Lab’s report demonstrated this evasion tactic, showing actors rotating through multiple operator identities across various countries and pivoting between SS7 and Diameter to bypass uncoordinated carrier firewalls.
Mitigation and Security-Focused Services
As telecom networks grapple with systemic signaling flaws, security-focused mobile services are emerging to help defend against protocol exploitation. Companies like <span style="color:blue;">Cape</span> offer alternative mobile services built from the ground up with security and privacy at their core to help protect users from covert tracking and interception.
Sources
- BleepingComputerSS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone
Continue chronologically
Related stories
Targeted Ads Delivered Zero-Click Exploits for Spyware
Researchers reveal that mercenary hackers laced targeted ads with zero-click exploits to install sophisticated spyware on devices without user interaction.
Targeted Ads Delivered Candiru Spyware in Zero-Click Attacks
Researchers reveal zero-click attacks targeting Al Jazeera devices by delivering Candiru spyware through targeted online advertisements.
Israeli Ad Firm Used for Candiru Spyware Delivery
Citizen Lab uncovers AdFection, an operation where an Israeli ad firm delivered zero-click Candiru spyware via targeted advertisements.
Mobile Carriers Store Years of Call Logs and Metadata
Mobile carriers retain years of call and text metadata, exposing sensitive customer relationships, routines, and locations during breaches.
