SS7 and Diameter signaling attacks can be used to track mobile phones, intercept messages and spoof numbers. Here is how these attacks work and what carriers can do to limit the risk.
Mobile phones can be tracked, SMS two-factor authentication codes can be intercepted, and phone numbers can be spoofed without malware, phishing links or access to the device itself. These attacks take place inside telecommunications networks through signaling protocols—automated messages exchanged between carriers to authenticate subscribers and route calls, texts and mobile data.
Most users never see signaling traffic, and many carriers cannot reliably block every malicious request. The underlying weaknesses have existed for decades, although signaling attacks have recently drawn renewed attention because of activity linked to Iran. A New York Times report said outdated network technology was reportedly exploited to locate the mobile phones of US soldiers in the Middle East during the Iran war.
The same weaknesses have also been used for more routine crimes, including the interception of one-time bank passcodes. In 2025, the YouTube channel Veritasium demonstrated how calls and text messages belonging to technology influencers could be hijacked using only their phone numbers.
What is a signaling attack?
Every call, text message and mobile data session requires a carrier to verify that the subscriber is authorized to use the network and to route communications to the correct destination. Carriers perform these tasks through signaling, a system of background messages that helps determine a subscriber’s location and direct network traffic.
Signaling has connected telecommunications providers around the world for decades, but it remains one of the least visible attack surfaces in mobile security. Two protocols handle much of this work:
- SS7: Used by 2G and 3G networks and introduced in the 1970s.
- Diameter: Used by the successor technologies, including 4G and most 5G networks.
Both protocols were designed around a relatively small number of large carriers and assume that messages claiming to come from legitimate operators can generally be trusted. SS7 has essentially no mechanism for authenticating the machine sending a request.
Diameter supports stronger authentication in principle, but carriers do not always deploy basic protections such as encryption. Many also continue to rely on a similar peer-to-peer trust model.
An attacker who gains access to the global signaling backbone—through a commercial lease arrangement or a compromised carrier—may be able to send messages that carriers in other countries treat as legitimate.
How signaling attacks work
Signaling can allow an attacker to query a carrier and make claims on behalf of a subscriber. Depending on the attacker’s access and the carrier’s defenses, the attacker may be able to:
- Collect an IMSI: After learning a target’s phone number, an attacker can pretend to route a call or SMS and request the subscriber’s International Mobile Subscriber Identity (IMSI). The identifier may then be reused in later attacks, potentially for years.
- Track a phone’s location: A query may return the last mobile base station connected to the phone. Other capabilities, typically reserved for emergency responders, may return coordinates reported by the device.
- Intercept calls and messages: An attacker can claim that the subscriber has roamed onto another network and request that calls or text messages be redirected. This can allow an attacker who has also obtained a username and password to receive an SMS-based second factor instead of the account owner.
- Impersonate or block a subscriber: An IMSI can allow an attacker to place calls or send SMS messages while impersonating the target. False roaming claims may also cause the target’s mobile service to be cut off.
- Disrupt a network: Deliberately misconfigured signaling messages can place additional demands on carrier systems.
These actions do not require changes to the victim’s device. They occur through invisible, automated network transactions and may leave no obvious trace on the phone.
Why firewalls and speed checks are not enough
Carrier signaling firewalls can block messages sent to or from incorrect locations. When a message is routed through a seemingly valid path, however, carriers may rely on a “speed check.” This compares the subscriber’s last known location with the location claimed by the visited network.
For example, if a phone was recorded in New York an hour earlier and a Turkish carrier suddenly reports that it is connected to its network, the request may be rejected because the journey would be physically implausible.
The structural problem is that firewall location data may be several hours old. In a study, Cape, a privacy-focused mobile carrier announced at the 2025 Wireless Security Conference, measured Diameter updates from visited networks arriving every two to 10 hours.
Subscribers in the United States and Germany can access more than 250 different networks within an hour of travel time. An attacker with enough operator IDs may eventually find one that appears plausible to a carrier’s defenses.
A Citizen Lab report documented this type of activity. The attacker, identified as STA1, repeatedly tried to track users by rotating 11 operator IDs across nine countries to make the traffic resemble legitimate roaming. The actor also moved between SS7 and Diameter, which most carriers protect with separate firewalls that may have little coordination between them.
Consider a target who flies from Nashville to Berlin and turns off the phone during the journey. A message claiming that the device is roaming through China Mobile would be rejected because the reported movement would be physically impossible.
A message from a carrier near Nassau in the Bahamas could appear more plausible, potentially tricking domestic carriers into routing calls and SMS messages to the attacker.
How Cape says it defends against signaling attacks
Cape describes itself as a privacy-first mobile carrier offering unlimited talk, text and 4G/5G data. The company says it assumes that the global communications system may be compromised and uses several layers of protection for subscriber communications.
Cape says most carriers track information such as where subscribers travel and who they contact. The company says it collects the minimum information needed to provide service, deletes call and text metadata after 24 hours, rotates network identifiers to reduce tracking and protects against SIM- and network-based attacks.
Daily IMSI rotation
According to Cape, many targeted signaling attacks begin with an IMSI. Once obtained, the identifier can remain useful to an attacker for as long as it remains unchanged. A Citizen Lab report found that the same IMSI had been targeted in operations separated by months or years.
Most carriers assign a permanent IMSI when a SIM is activated. Cape says it rotates IMSIs daily, which the company says makes previously collected identifiers less useful against its subscribers.
No SS7 support
Cape says it does not support SS7 and has no SS7 fallback in its network. As a result, the company says there is no SS7 connection on which an SS7-based attack can operate. Many other carriers continue to maintain legacy SS7 infrastructure, partly because it remains tied to network operations and revenue.
Network lock
Instead of relying only on a network’s reported location, Cape says its Network Lock feature asks the subscriber’s device to evaluate connection requests. When an external network requests a connection, the Cape app checks the request locally at the country level and reports whether the claim matches.
If an attacker attempts to attach an IMSI from another country while the phone is at home, Cape says the request will be rejected and the subscriber will receive a notification. The company says its system learns only whether the claim matches and does not collect or store the subscriber’s exact location.
Continuous penetration testing
Many signaling firewalls are compliance tools based on baseline recommendations from the GSMA, whose guidance is distributed to more than 1,200 member providers. Cape says attackers who can send signaling messages may therefore benefit from widely available information about common defenses.
The company says it uses third-party specialists in current signaling abuse techniques to test its infrastructure and harden the network against identified attacks, particularly those that threaten subscriber privacy.
| Attack | Other carriers | Cape |
|---|---|---|
| Real-time location tracking | Phones connect whenever they receive service, and plausible spoofing may bypass speed checks. | Network Lock validates connection requests to devices. |
| Collecting and reusing IMSIs | IMSI identifiers are persistent and may remain useful indefinitely. | Daily rotation is intended to make previously collected IMSIs less useful. |
| SS7-based attacks | Attackers may use multiple methods to bypass SS7 firewalls. | SS7 is not supported. |
| Diameter-based attacks | Firewalls rely on widely published GSMA baselines. | Firewall protections are updated using penetration testing focused on current techniques. |
Carriers remain part of the mobile security threat model
Encrypted messaging, avoiding public Wi-Fi and enabling two-factor authentication can all improve security, but they do not remove a device’s dependence on telecommunications networks that were not originally designed to withstand today’s threats.
For journalists, executives, security personnel and anyone whose accounts depend on SMS authentication, carrier security remains part of the threat model. Cape is offering $29 off for life to customers who switch through its promotion.
Learn more about Cape’s approach to signaling security →
Sponsored and written by Cape.
Source: www.bleepingcomputer.com