Signaling Protocol Flaws (SS7/Diameter) Enable Phone Tracking, SMS Interception, and Call Hijacking
What Happened — SS7 (used in 2G/3G) and Diameter (used in 4G/5G) are carrier‑to‑carrier signaling protocols that route calls, texts, and data. Because they were designed for a trusted, closed network of operators, they lack robust authentication of the requesting entity. Attackers who gain access to the global signaling backbone—through a leased line, a compromised carrier, or a malicious third‑party service—can inject fraudulent signaling messages. Those messages are accepted as legitimate by carriers worldwide, allowing the adversary to locate a target’s device, intercept SMS one‑time passcodes, and impersonate the victim’s phone number. Recent public examples include Iranian‑linked actors targeting U.S. personnel, a YouTuber hijacking a tech influencer’s calls, and multiple campaigns uncovered by Citizen Lab that affected thousands of users across dozens of countries. The attacks require no malware on the victim’s device and bypass typical phishing or credential‑theft defenses.
Why It Matters for Trust & Control Assurance — The incident highlights the need for rigorous third‑party network oversight and continuous verification that carriers enforce strong authentication on inter‑operator signaling.
Who Is Affected — Telecom carriers, enterprises that rely on mobile carriers for authentication (e.g., banking, SaaS), and any end‑users whose phone numbers are used for two‑factor authentication.
Recommended Actions
- Map carrier‑level signaling security to your vendor‑risk framework and require evidence of authentication controls.
- Incorporate signaling‑protocol monitoring into your continuous assurance program; validate that carriers encrypt and authenticate SS7/Diameter traffic.
- Update incident‑response playbooks to include signaling‑based interception scenarios for SMS OTPs.
Source: BleepingComputer
Technical Notes
- Protocols: SS7 (legacy 2G/3G) and Diameter (4G/5G).
- Core weakness: lack of mutual authentication and optional encryption, enabling message spoof‑injection.
- Attack vector: exploitation of carrier‑to‑carrier signaling via compromised or leased network access.
Source: same as above