Sponsored overview: SS7 and Diameter signaling flaws enable phone tracking, SMS 2FA interception and impersonation
A sponsored article by mobile carrier Cape explains how SS7 (2G/3G) and Diameter (4G/5G) signaling protocols can be abused to locate subscribers, intercept calls and SMS one-time passcodes, harvest IMSI identifiers, impersonate subscribers and disrupt networks — all without touching the victim's device. The protocols assume peer-to-peer trust between operators; SS7 has essentially no authentication, and Diameter protections are inconsistently deployed. The piece cites Citizen Lab research on two long-running commercial surveillance campaigns, including an actor tracked as STA1 that rotated through eleven operator identities across nine countries and pivoted between SS7 and Diameter to defeat velocity checks. It also references reporting that Iranian-linked actors used legacy network technology to locate phones of US personnel in the Middle East, and the on-air SS7 compromise of Congressman Ted Lieu's phone. The article is marketing content for Cape's privacy-focused carrier service.
Detalhes técnicos
- IMSI harvesting: an attacker with signaling backbone access (leased or via a compromised operator) can request a subscriber's IMSI under the pretext of routing a call or SMS; harvested IMSIs remain usable for years.
- Location tracking: signaling queries return last-attached cell tower or, via emergency-services procedures, actual device-reported coordinates.
- Interception: a false roaming claim redirects calls and SMS to the attacker, defeating SMS-based second factors when combined with stolen credentials.
- Firewall weakness: carrier velocity checks rely on stale location data — Cape measured Diameter updates from visited networks arriving as rarely as every two to ten hours, and over 250 networks are reachable within one hour of travel for US and German subscribers, so plausible-origin spoofing succeeds.
- Separate SS7 and Diameter firewalls with little coordination allow protocol pivoting; GSMA baseline recommendations distributed to 1,200+ providers are equally available to attackers.
Remediação
Cape markets four controls: daily IMSI rotation, no SS7 support or fallback, Network Lock (attach requests validated against the device's own country-level assessment via the Cape app), and continuous third-party signaling penetration testing. For high-risk users — journalists, executives, security staff and anyone relying on SMS verification — the article argues the carrier itself belongs in the threat model; reducing dependence on SMS 2FA in favour of app-based or hardware authenticators is the broader takeaway.
Linha do tempo
-
Sponsored overview: SS7 and Diameter signaling flaws enable phone tracking, SMS 2FA interception and impersonation
ler a análise desta fonte ocultar
A sponsored article by mobile carrier Cape explains how SS7 (2G/3G) and Diameter (4G/5G) signaling protocols can be abused to locate subscribers, intercept calls and SMS one-time passcodes, harvest IMSI identifiers, impersonate subscribers and disrupt networks — all without touching the victim's device. The protocols assume peer-to-peer trust between operators; SS7 has essentially no authentication, and Diameter protections are inconsistently deployed. The piece cites Citizen Lab research on two long-running commercial surveillance campaigns, including an actor tracked as STA1 that rotated through eleven operator identities across nine countries and pivoted between SS7 and Diameter to defeat velocity checks. It also references reporting that Iranian-linked actors used legacy network technology to locate phones of US personnel in the Middle East, and the on-air SS7 compromise of Congressman Ted Lieu's phone. The article is marketing content for Cape's privacy-focused carrier service.
Technical Details
- IMSI harvesting: an attacker with signaling backbone access (leased or via a compromised operator) can request a subscriber's IMSI under the pretext of routing a call or SMS; harvested IMSIs remain usable for years.
- Location tracking: signaling queries return last-attached cell tower or, via emergency-services procedures, actual device-reported coordinates.
- Interception: a false roaming claim redirects calls and SMS to the attacker, defeating SMS-based second factors when combined with stolen credentials.
- Firewall weakness: carrier velocity checks rely on stale location data — Cape measured Diameter updates from visited networks arriving as rarely as every two to ten hours, and over 250 networks are reachable within one hour of travel for US and German subscribers, so plausible-origin spoofing succeeds.
- Separate SS7 and Diameter firewalls with little coordination allow protocol pivoting; GSMA baseline recommendations distributed to 1,200+ providers are equally available to attackers.
Remediation
Cape markets four controls: daily IMSI rotation, no SS7 support or fallback, Network Lock (attach requests validated against the device's own country-level assessment via the Cape app), and continuous third-party signaling penetration testing. For high-risk users — journalists, executives, security staff and anyone relying on SMS verification — the article argues the carrier itself belongs in the threat model; reducing dependence on SMS 2FA in favour of app-based or hardware authenticators is the broader takeaway.