SS7 and Diameter Signaling Flaws Enable Tracking, Interception, and Impersonation

Signaling Protocol Vulnerabilities

SS7 and Diameter signaling protocols, fundamental to mobile network operations, expose users to tracking, interception, and impersonation. These attacks occur within the telecom network itself, bypassing device-level security measures like malware or phishing. The vulnerabilities are present in the carrier-to-carrier control protocols that manage calls, texts, and mobile data sessions.

How Signaling Attacks Work

Signaling protocols, specifically SS7 (used in 2G/3G) and Diameter (used in 4G and most 5G), were designed with an assumption of trust between a limited number of large operators. SS7 lacks authentication for incoming requests, while Diameter's stronger authentication is often not fully implemented by operators, leading to similar peer-to-peer trust issues. This allows malicious actors to exploit these protocols to verify user location and route traffic, enabling unauthorized access to user data and services.

Real-World Impact and Exploitation

These vulnerabilities have been exploited in various real-world scenarios. Criminals have used signaling attacks to target bank accounts by intercepting one-time passcodes sent via SMS. Commercial surveillance campaigns have also abused SS7 and Diameter, affecting thousands of targets across multiple countries. High-profile incidents include the reported exploitation by Iranian-linked actors to locate US personnel and the live demonstration of an SS7 hack on Congressman Ted Lieu's phone.

Ongoing Threat

Despite being known for decades, these signaling flaws persist. The underlying issue is the inherent trust model of the protocols and the inconsistent implementation of security measures by mobile operators. This makes signaling attacks a continuous threat to mobile security, impacting privacy and financial security without requiring direct access to a user's device.