An SS7 attack exploits weaknesses in Signalling System No. 7, the protocol suite that telecom operators use to route calls and SMS, to track phones, intercept messages or redirect calls.
How SS7 attacks work
SS7 was designed in the 1970s for a closed club of national telephone companies that trusted each other. It has no strong authentication of who sends a signalling message. Today, hundreds of operators, roaming hubs and service providers worldwide have access to the network, and access can also be bought or obtained through a compromised operator. With it, an attacker can:
- query a subscriber’s location by phone number;
- register the victim’s number at a fake “roaming” network and receive their SMS, including one-time passwords;
- forward or listen in on calls as a man in the middle;
- disrupt a subscriber’s service.
Researchers Tobias Engel and Karsten Nohl publicly demonstrated tracking and interception at the Chaos Communication Congress in December 2014. The Diameter protocol used in 4G networks has similar trust problems.
Why SS7 attacks matter
In 2017, criminals in Germany combined phishing with SS7 attacks to intercept SMS transaction codes and empty victims’ bank accounts – a real-world proof that SMS-based two-factor authentication can be bypassed without touching the phone. SS7 tracking is also offered by surveillance vendors to governments and has been used against journalists and activists. Unlike SIM swapping, the victim often notices nothing.
How to protect against SS7 attacks
- Prefer authenticator apps, push approval or FIDO2 security keys over SMS codes for important accounts.
- Use end-to-end encrypted messengers and calls for sensitive communication.
- Operators should deploy signalling firewalls and follow GSMA security guidelines for SS7 and Diameter.
- Banks and services should monitor for suspicious SIM and roaming changes before sending codes.
