Signaling System No. 7 (SS7), the backbone protocol suite managing call setup, routing, and subscriber management across legacy telephone networks worldwide, was designed in the 1970s with an implicit trust model. There was no authentication between signaling nodes. No integrity verification. No encryption. Decades later, this trust-by-default architecture remains the single largest systemic vulnerability in global telecommunications — affecting an estimated 800+ mobile network operators and billions of subscribers.
The severity of this vulnerability cannot be overstated. SS7 attacks are not theoretical — they are actively exploited by nation-state intelligence agencies, commercial surveillance vendors, and financially motivated criminals. The protocol was designed for a world where only a handful of government-controlled telephone companies existed. Today, with thousands of entities holding SS7 access through MVNOs, roaming hubs, SMS aggregators, and VoIP interconnects, the trust model is irreparably broken.
Understanding SS7 is foundational to telecom security because its vulnerabilities cascade into every generation of mobile network. Even subscribers on 5G networks remain exposed through legacy interworking gateways, and the Diameter protocol that replaced SS7 in 4G inherited many of the same architectural trust assumptions. The 3GPP releases has progressively addressed these issues, but backward compatibility requirements ensure SS7 remains active on most networks worldwide.
This research examines how SS7 MAP (Mobile Application Part) messages are exploited to track subscribers in real time, intercept SMS, and redirect voice calls. We dissect the specific message types abused, the attack infrastructure required, the real-world case studies that have exposed these vulnerabilities, and the defensive countermeasures available today.
I. SS7 Architecture and the Trust Problem
SS7 was built as a closed network connecting a small number of trusted national telephone operators. Every node on the SS7 network — whether a Home Location Register (HLR), Mobile Switching Center (MSC), or Visitor Location Register (VLR) — implicitly trusts every message it receives. There is no built-in source authentication or message integrity verification. This architecture is fundamentally different from IT networks, where authentication and encryption are standard practice.
The deregulation of telecom markets and the rise of Mobile Virtual Network Operators (MVNOs), SMS aggregators, and VoIP providers has dramatically expanded the number of entities with direct or indirect SS7 access, making the trust model fundamentally broken. As of 2025, GSMA estimates that over 1,200 entities have some form of SS7 interconnect access globally.
The SS7 Protocol Stack
SS7 operates as a layered protocol stack, with the Mobile Application Part (MAP) sitting at the application layer. Understanding the stack is essential for both attack and defense:
| Layer | Protocol | Function | Security Impact |
|---|---|---|---|
| Application | MAP / CAP / INAP | Subscriber management, location, charging | Direct attack target — no auth on any operation |
| Transaction | TCAP | Transaction management | Session hijacking via component manipulation |
| Transport | SCCP | Global Title routing | GT spoofing enables source impersonation |
| Network | MTP3 | Network-level routing | Point Code spoofing in IP-based SIGTRAN |
| Link | MTP2 / M2PA | Link-level reliability | Physical access historically required; now IP |
| Physical | MTP1 / SIGTRAN (IP) | DS0 timeslots / IP transport | SIGTRAN over IP massively expanded access surface |
The migration from TDM-based SS7 to SIGTRAN (SS7 over IP) was intended to reduce infrastructure costs, but it inadvertently made SS7 access available to anyone who could establish an IP connection to a signaling transfer point — dramatically lowering the barrier for attackers.
Historical Context: How We Got Here
The SS7 trust crisis didn't emerge overnight. Key milestones:
- 1975–1980: SS7 designed by AT&T/Bell Labs for the US telephone network. Nodes are physically secured government infrastructure.
- 1990s: Telecom deregulation globally opens networks to new operators. SS7 access broadens.
- 2008: Tobias Engel presents SS7 location tracking at the Chaos Communication Congress (25C3), marking the first public disclosure of these vulnerabilities.
- 2014: German researchers demonstrate SS7 tracking of a German politician's phone on live television, triggering international media coverage and regulatory attention.
- 2017: O2 Germany confirms that SS7 attacks were used to bypass SMS-based 2FA and drain bank accounts.
- 2020–present: Commercial SS7 surveillance platforms (like Circles, documented by Citizen Lab) proliferate, offering turnkey subscriber tracking for government clients.
II. Location Tracking Attack Vectors
There are three primary MAP operations that are systematically abused for subscriber location tracking:
1. SendRoutingInfo (SRI)
The SendRoutingInfo message is legitimately used during call setup to determine which MSC a subscriber is currently registered with. An attacker who sends an SRI request with a target MSISDN (phone number) receives back the subscriber's current MSC address and IMSI, which reveals their approximate geographic location (city or region level).
The SRI response is especially dangerous because it also returns the target's IMSI — the permanent subscriber identity. Combined with IMSI catchers techniques, this enables precise physical-layer targeting.
2. ProvideSubscriberInfo (PSI)
Once the attacker knows the VLR address from SRI, they can send a ProvideSubscriberInfo request directly to that VLR. The response contains the subscriber's Cell-ID — the exact cell tower they are connected to — enabling location precision down to hundreds of meters in urban environments and within a few kilometers in rural areas. When combined with cell tower databases (publicly available from sources like OpenCellID), this translates directly to geographic coordinates.
3. AnyTimeInterrogation (ATI)
AnyTimeInterrogation is a single-step location query that combines the functionality of SRI and PSI. It directly requests the HLR for the subscriber's Cell-ID and current serving MSC. While many operators now block ATI from external sources (this is one of the GSMA's most basic recommendations), it remains functional on numerous networks globally — particularly in regions with less mature regulatory oversight.
Attack Vector Comparison Matrix
| Technique | Message | Precision | Detectability | GSMA Blocking Status |
|---|---|---|---|---|
| SRI | SendRoutingInfo | City/Region (MSC area) | Low — looks like legitimate call setup | Rarely blocked (breaks roaming) |
| PSI | ProvideSubscriberInfo | Cell tower (~100m urban) | Medium — unusual external source | Recommended block for external GTs |
| ATI | AnyTimeInterrogation | Cell tower (~100m urban) | High — no legitimate external use case | Widely blocked but not universal |
| SRI-SM | SendRoutingInfoForSM | MSC/VLR area | Low — looks like SMS delivery | Mitigated by SMS Home Routing |
III. SMS Interception via UpdateLocation
Beyond tracking, SS7 enables full SMS interception through a technique called HLR manipulation. By sending a fraudulent UpdateLocation message to the target's home HLR, the attacker registers a fake MSC/VLR address for the subscriber. All incoming SMS messages — including two-factor authentication codes — are then routed to the attacker's infrastructure. This is often the precursor to SIM swap fraud and account takeover attacks.
<CodeBlock language="text" is-terminal code=" # Simplified attack flow:
- Attacker sends UpdateLocation(IMSI=target, newVLR=attacker_GT)
- HLR updates subscriber record → SMS routes to attacker
- Attacker captures SMS OTP codes
- Attacker sends RestoreData to revert the record
Total attack duration: 30-120 seconds
Detection difficulty: HIGH (temporary record change)">
The Banking Fraud Epidemic
This attack has been documented extensively in real-world bank fraud cases. In the 2017 O2 Germany incident, attackers intercepted SMS-based 2FA codes to drain customer bank accounts. The attack chain combined credential phishing (to obtain bank login details) with SS7 SMS interception (to capture the OTP), demonstrating how SS7 vulnerabilities amplify traditional cybercrime. The attack is temporary and reversible — the attacker restores the original VLR record within seconds — making detection extremely difficult without active SS7 monitoring.
Voice Call Interception and Redirection
The same UpdateLocation technique can redirect voice calls. By registering an attacker-controlled MSC, incoming calls are routed through the attacker's infrastructure, enabling real-time wiretapping. The attacker forwards the call to the legitimate destination to avoid detection, creating a transparent man-in-the-middle position.
IV. Defensive Countermeasures
While the underlying SS7 protocol cannot be patched without breaking backward compatibility, several layered defense strategies exist. The effectiveness of each depends on consistent deployment across all interconnect points — a single unprotected gateway negates the entire defensive posture.
01 SS7 Firewalls
Deploy signaling firewalls at all interconnect points. These filter incoming SS7 messages based on source Global Title (GT), message type, and subscriber context to block unauthorized queries like external ATI or PSI requests. Modern SS7 firewalls can correlate message sequences to detect multi-step attack chains that individual message filters would miss.
02 GSMA CAT/DASS
The GSMA's Categories, Address Screening and Sending (CAT/DASS) framework provides a standardized rule-set for operators to validate the legitimacy of SS7 messages based on the sender's role and the message context. Operators are categorized (Category 1 through 3), and message permissions are enforced accordingly.
03 Home Routing for SMS
By routing all SMS through an SMS home router, operators can verify that the delivering MSC matches the subscriber's actual serving network, preventing UpdateLocation-based interception. This is one of the most effective single countermeasures against SMS-based 2FA bypass.
04 Migration to Diameter/5G
The ultimate solution is migrating signaling to Diameter protocol (4G) and HTTP/2 SBA (5G), which support TLS and mutual authentication. However, legacy interworking will persist for years, and Diameter vulnerabilities must also be addressed.
Defense Effectiveness Matrix
| Countermeasure | Blocks Location Tracking | Blocks SMS Interception | Blocks Call Redirect | Deployment Complexity | Industry Adoption |
|---|---|---|---|---|---|
| SS7 Firewall | Partial (ATI/PSI) | Partial | Partial | Medium | ~60% of Tier-1 operators |
| GSMA CAT/DASS | Good (with proper rules) | Good | Good | High (coordination needed) | ~40% globally |
| SMS Home Routing | No | Yes | No | Low-Medium | ~50% globally |
| Diameter/5G Migration | Full (when complete) | Full | Full | Very High | Ongoing (~15% SA) |
| Network Monitoring | Detection only | Detection only | Detection only | Medium | ~70% of Tier-1 operators |
V. SS7 Security Testing Methodology
Validating SS7 firewall effectiveness requires systematic security assessment. Telecom penetration testing for SS7 networks follows a structured approach:
- Reconnaissance: Map the target operator's signaling infrastructure — identify STPs, GTs, and interconnect partners.
- Passive Monitoring: Analyze legitimate signaling patterns to establish baseline traffic profiles.
- Active Probing: Send controlled MAP messages (SRI, PSI, ATI) from authorized test GTs to validate firewall blocking rules.
- Bypass Attempts: Test advanced evasion techniques — GT spoofing, SCCP relay abuse, multi-hop routing through compliant intermediary networks.
- Reporting: Document findings against GSMA FS.11 and IR.82 frameworks, map to MITRE FiGHT techniques.
TelcoSec's dedicated lab environments provide isolated signaling infrastructure for safe SS7 security testing without impacting production networks. The TelcoSec Tools suite includes protocol analyzers specifically designed for signaling security assessment.
VI. Signaling Protocol Security Evolution
SS7's vulnerabilities did not exist in isolation — they directly influenced the design (and limitations) of successor protocols. Understanding this evolution is critical for assessing the security posture of any telecom network:
| Aspect | SS7 (2G/3G) | Diameter protocol (4G) | HTTP/2 SBA (5G) |
|---|---|---|---|
| Transport Security | None (cleartext) | Optional TLS (rarely deployed) | Mandatory TLS 1.3 + mTLS |
| Authentication | None — implicit trust | Optional (IPsec/TLS available) | OAuth2 + NRF service authorization |
| Message Integrity | None | Optional (DTLS) | JWS for N32 (PRINS) |
| Access Control | Global Title screening (manual) | Diameter Edge Agent (DEA) | SEPP + API gateway policies |
| Identity Protection | IMSI sent in cleartext | IMSI in signaling messages | SUCI (encrypted identity) |
| Specification | 3GPP TS 29.002 | 3GPP TS 29.272 | 3GPP TS 29.500 |
The progression shows clear improvement, but each generation maintains backward compatibility with its predecessor — meaning SS7 vulnerabilities propagate forward through interworking gateways until legacy networks are fully decommissioned. The complete 3GPP specification timeline provides detailed context on how each release addressed (or deferred) these security challenges.
VII. Authoritative References
- 01 GSMA IR.82SS7 and SIGTRAN Network SecurityGSMA Security Resources & Guidelines →
- 02 ENISA SS7/Diameter ReportSignaling Security in Telecom NetworksENISA SS7/Diameter Signalling Security Report →
- 03 3GPP TS 29.002MAP Protocol Specification3GPP TS 29.002 – SS7 MAP Protocol →
- 04 GSMA FS.11SS7 Interconnect Security Monitoring and Firewall GuidelinesGSMA SS7 Firewall Guidelines →
- 05 Citizen Lab — Running in CirclesUncovering the Clients of Cyberespionage Firm CirclesCitizen Lab: Circles Spyware Investigation →
- 06 DHS — SS7 Vulnerabilities and Feasibility of OversightU.S. Department of Homeland Security Report on SS7 SecurityDHS IMSI Catcher Security Report →
VIII. Frequently Asked Questions
If your carrier connects to the global SS7 network (virtually all carriers do), then yes — your approximate location can be queried by any entity with SS7 access. The effectiveness depends on whether your carrier has deployed SS7 firewalls and message filtering. Even with firewalls, SRI-based tracking (city-level) is extremely difficult to block completely because it mimics legitimate call setup signaling.
No. SS7 tracking operates at the network signaling layer, completely independent of the data plane. A VPN encrypts your internet traffic, but your phone's signaling connection to the cellular network remains unchanged and vulnerable. Even encrypted messaging apps cannot prevent SS7-based location tracking — they protect content, not location.
5G Standalone (SA) networks do not use SS7. However, most current 5G deployments are Non-Standalone (NSA) and still rely on 4G core infrastructure with Diameter protocol and SS7 interworking. Until legacy shutdown is complete, SS7 attacks remain viable even for 5G subscribers due to inter-generation handover and fallback mechanisms.
SS7 tracking is network-side — it queries the telecom infrastructure for a subscriber's location without any interaction with the target device. GPS tracking requires software on the target device. SS7 tracking works on any phone (even basic feature phones), requires no physical access, and is invisible to the target. The precision is lower (cell tower level vs. meter-level GPS), but the stealth is absolute.
SS7 SMS interception and SIM swap attacks both target SMS-based authentication, but through different vectors. SS7 interception redirects SMS at the network level without changing the SIM. SIM swap involves social engineering the carrier to transfer the victim's number to an attacker-controlled SIM. Both exploit the fundamental weakness of SMS as a second authentication factor.
Not independently — SS7 security testing requires authorized interconnect access and specialized signaling analysis tools. Organizations can commission telecom pentesting methodology engagements that include SS7 firewall validation. TelcoSec offers corporate training programs that include hands-on SS7 security assessment labs.
Conclusion & Next Steps
SS7 location tracking remains one of the most pervasive and underestimated threats in telecommunications security. The protocol's inherent trust model — designed for a different era — creates vulnerabilities that no amount of patching can fully address. While the protocol itself cannot be redesigned, proactive deployment of signaling firewalls, GSMA CAT/DASS rule-sets, SMS home routing, and active monitoring can dramatically reduce exposure.
The long-term solution is complete migration to 5G Standalone architecture with proper SEPP deployment and legacy interworking gateway hardening. Until that transition is complete (estimated 2030+ globally), SS7 security must remain a top priority for every mobile network operator. Understanding Diameter protocol evolution provides essential context for building a comprehensive defense strategy.
TelcoSec provides comprehensive SS7 security assessments, including simulated attack campaigns to validate your signaling firewall effectiveness. Explore the TelcoSec Academy for structured learning paths, review our 3GPP specification navigator for standards reference, or browse the TelcoSec research library for additional signaling intelligence.
