SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone
SS7 and Diameter signaling attacks can track, intercept, and impersonate you.
Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malware, a phishing link, or any access to your device.
SS7 and Diameter signaling attacks can track, intercept, and impersonate you.
Criminals have reportedly exploited signaling protocols in attacks on bank accounts and global telecom infrastructure.
Citizen Lab exposed two long-running commercial surveillance campaigns abusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries.
Every call, text, and mobile data session requires your carrier to verify you’re a paying customer and route your traffic to the right destination.
Combined with a stolen username and password, this delivers your SMS second factor to the attacker instead of you.
Congressman Ted Lieu’s phone was hacked on live TV via SS7 on 60 Minutes Australia Attackers have intercepted SMS one-time passcodes to drain victims’ bank accounts.
Others, normally reserved for emergency responders, can return the actual coordinates your phone reports.
But the vulnerability has been around for decades, and it’s been used for far more everyday crimes, like intercepting bank one-time passcodes.
Most recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war.
What happened
Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malware, a phishing link, or any access to your device.
SS7 and Diameter signaling attacks can track, intercept, and impersonate you.
What changed
Criminals have reportedly exploited signaling protocols in attacks on bank accounts and global telecom infrastructure.
Citizen Lab exposed two long-running commercial surveillance campaigns abusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries.
Who is affected
Every call, text, and mobile data session requires your carrier to verify you’re a paying customer and route your traffic to the right destination.
Combined with a stolen username and password, this delivers your SMS second factor to the attacker instead of you.
Why it matters
Congressman Ted Lieu’s phone was hacked on live TV via SS7 on 60 Minutes Australia Attackers have intercepted SMS one-time passcodes to drain victims’ bank accounts.
Others, normally reserved for emergency responders, can return the actual coordinates your phone reports.
Technical details
But the vulnerability has been around for decades, and it’s been used for far more everyday crimes, like intercepting bank one-time passcodes.
Most recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war.
Diameter supports stronger authentication on paper, but operators don’t always deploy basic protections like encryption, and many fall back on the same peer-to-peer trust model.
Response
Cape collects the minimum amount of information required to provide you with service, deletes call and text metadata after 24 hours, rotates your network ID to prevent tracking, defends against SIM- and network-based attacks, and more.
Phone attaches whenever it gets service; velocity checks can be beaten by plausible spoofing Following every best practice, such as using encrypted messaging, avoiding public Wi-Fi, and enabling 2FA, still leaves your device dependent on networks never built with security in mind.
Attribution
BleepingComputer: SS7 and Diameter signaling attacks can track, intercept, and impersonate you.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.