Overview
A BleepingComputer feature, sponsored by mobile vendor Cape, highlights long-known weaknesses in the SS7 and Diameter signaling protocols. These protocols let carriers route calls, texts, and roaming data, and they were designed around trust between networks. Attackers who gain access to that signaling layer can abuse the trust without compromising a phone at all.
Note: The source article is vendor-sponsored. The attack classes below are well documented independently of the vendor's product claims.
What SS7 and Diameter Do
- SS7 underpins 2G and 3G networks and handles call setup, SMS delivery, and subscriber location lookups.
- Diameter is the 4G/LTE successor, handling authentication, authorization, and mobility.
Both assume that any network sending a signaling message is a legitimate carrier. Access to the signaling network can be obtained through a compromised carrier, a rogue operator, or commercial surveillance vendors that lease access.
What Attackers Can Do
| Attack | Result |
|---|---|
| Location tracking | Query the serving cell or network to find a subscriber's approximate location |
| Call interception and redirection | Forward or reroute voice calls through attacker-controlled numbers |
| SMS interception | Redirect text messages, including one-time passcodes and verification codes |
| Subscriber impersonation | Pose as the subscriber to the network for fraud or account takeover |
| Denial of service | Disrupt a subscriber's service by manipulating registration state |
Because the abuse happens inside the carrier network, a patched, fully updated phone gives no protection and the victim sees no sign of it.
Why It Matters for Security Teams
SMS-based one-time codes are the biggest exposure for organizations. An attacker who can intercept an SMS can complete password resets and bypass SMS two-factor authentication for banking, email, and corporate accounts.
Mitigations
- Stop using SMS for MFA where possible. Prefer phishing-resistant options such as passkeys, FIDO2 security keys, or authenticator apps.
- Protect high-risk users. Executives, journalists, and administrators are the most likely targets of signaling-based surveillance.
- Prefer end-to-end encrypted messaging and calling for sensitive communications, since it protects content even if routing is hijacked.
- Ask carriers about signaling firewalls and filtering of unexpected signaling traffic.
- Monitor accounts for unexpected password reset or login activity that could indicate intercepted codes.
Key Takeaways
- SS7 and Diameter weaknesses are protocol-level and cannot be fixed by patching a phone
- SMS verification codes are the most practical target for attackers
- Moving off SMS MFA is the highest-impact step for most organizations