SS7 and Diameter Flaws Expose Phone Users to Tracking and Interception

Attackers exploit the lack of authentication in SS7 and Diameter carrier signaling to track phone locations in real time, intercept SMS verification codes and voice calls, and impersonate subscribers using stolen identities, while CISA’s Kevin Briggs documented unauthorized SS7 and Diameter location tracking inside the United States in March and April 2022….

SS7 was standardized in the late 1970s and early 1980s for landline and early mobile networks, built on the assumption that a few operators could trust one another. The peer-to-peer trust model leads carriers to accept spoofed requests as legitimate. Diameter replaced SS7 for 4G and 5G and supports stronger authentication in theory, but is often deployed without encryption or proper configuration, leaving both protocols vulnerable to exploitation. Diameter location data reaches carrier firewalls as rarely as every two to 10 hours.

Global roaming leaves users exposed to SS7 and Diameter risks even on modern networks because legacy protocols still carry international traffic. Carrier firewalls use velocity checks that compare a phone’s last-known location with a claimed roaming destination, but attackers exploit update delays by claiming to be in nearby countries. Inconsistent carrier implementation weakens Diameter’s theoretical security improvements, and 5G Standalone networks address only some of the risks.

Attackers run queries such as ProvideSubscriberInfo and AnyTimeInterrogation to read cell-tower connections or device-reported coordinates and follow a handset’s precise location with no action required from the user. Spoofed roaming claims and fake UpdateLocation messages cause networks to reroute calls and text messages, including verification codes, to attacker-controlled infrastructure. A harvested International Mobile Subscriber Identity (IMSI) stays usable for years, allowing call and SMS spoofing or service disruption, while attackers lease Global Titles despite no central authority regulating them. Downgrade attacks force handsets from 4G or 5G back to 2G or 3G, reopening SS7 weaknesses on modern networks.

One surveillance actor rotated through 11 operator identities across 9 countries to mimic legitimate roaming traffic and avoid detection while tracking targets. Citizen Lab documented STA1 and STA2, two long-running espionage campaigns targeting high-value individuals around the world; STA1 manipulates routing data, while STA2 blends network queries and zero-click SIM exploits to silently pull location data. Iranian-linked actors reportedly used SS7 and Diameter to locate U.S. personnel in the Middle East amid the Iran war, using outdated network technology to get past carrier defenses, demonstrating real-world exploitation….

During a 60 Minutes Australia broadcast, attackers hacked Congressman Ted Lieu’s phone through SS7, showing the protocol can intercept communications without the user’s awareness. CISA’s Kevin Briggs also reported thousands of suspicious SS7 messages in May 2022, saying the activity suggested broader exploitation….

Citizen Lab found Saudi Arabia sent millions of IMSI queries over several months to geolocate U.S. travelers using SS7, querying some people multiple times daily, exploiting SS7’s lack of authentication. Verizon, T-Mobile and AT&T say they follow CSRIC and GSMA best practices and have seen no unauthorized SS7 or Diameter incidents since 2018, yet CISA and independent reports describe undocumented tracking that conflicts with those statements….

The FCC’s CSRIC V on March 15, 2017 and CSRIC VI on March 28, 2018 recommended firewalls, operator identity checks and GSMA security guidelines, including blocking SendMSI and SendID messages and limiting roaming access to providers with agreements. On March 27, 2024 the FCC issued a public notice seeking details on SS7 and Diameter exploitation, Global Title leasing and carrier security measures, and providers gave mixed responses….

EFF urged the agency to audit SS7 and Diameter security, warning that the flaws endanger SMS two-factor authentication, bank accounts, medical records and dissidents under authoritarian regimes. “An attacker could use SS7 attacks to intercept text messages and then gain access to your bank account, medical records, and other important accounts,” the Electronic Frontier Foundation said. The group said SS7’s lack of encryption allows attackers to intercept one-time passcodes and location data worldwide.

Cape protects customers by rotating subscriber identities daily, not supporting SS7, using Network Lock to verify device location through app-based queries, and running continuous penetration testing, a combination that nullifies long-term tracking. GhostSims cuts exposure by limiting network identity visibility and using encrypted SIMs that separate a person’s identity from traditional carrier infrastructure, protecting against telecom-level surveillance….

The exploitation takes place inside carrier signaling, so it requires no action from the phone’s user. BleepingComputer and Cyber Security News reported that a harvested International Mobile Subscriber Identity remains usable for years.