SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone

SS7 and Diameter signaling attacks can track, intercept, and impersonate you. Here’s how they work and how to stop them.

Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malware, a phishing link, or any access to your device.

The attacks happen inside the telecom network, in the carrier-to-carrier control protocols known as signaling, the automated descendants of the old telephone switchboard. Most users never see them, and most carriers can’t reliably stop them.

Signaling attacks aren’t new. Most recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war.

But the vulnerability has been around for decades, and it’s been used for far more everyday crimes, like intercepting bank one-time passcodes. It has even been demonstrated by popular YouTubers: Veritasium hijacked a tech influencer’s calls and texts using only his phone number.

Criminals have reportedly exploited signaling protocols in attacks on bank accounts and global telecom infrastructure.

Criminals have reportedly exploited signaling protocols in attacks on bank accounts and global telecom infrastructure.

Citizen Lab exposed two long-running commercial surveillance campaigns abusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries.

Citizen Lab exposed two long-running commercial surveillance campaigns abusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries.

Congressman Ted Lieu’s phone was hacked on live TV via SS7 on 60 Minutes Australia

Congressman Ted Lieu’s phone was hacked on live TV via SS7 on 60 Minutes Australia

Attackers have intercepted SMS one-time passcodes to drain victims’ bank accounts.

Attackers have intercepted SMS one-time passcodes to drain victims’ bank accounts.

What is a signaling attack?

Every call, text, and mobile data session requires your carrier to verify you’re a paying customer and route your traffic to the right destination.

Carriers do this with signaling–background messages that identify your location and forward traffic accordingly. Signaling has been the connective tissue between global providers for decades, and it is one of the most overlooked attack surfaces in mobile security.

Two protocols do most of the work: SS7 (from the 1970s, used in 2G/3G) and Diameter (its successor, used in 4G and most 5G).

Both were designed when a small number of large operators could plug into the system, so they assume that traffic claiming to come from a legitimate operator really does. SS7 has essentially no process for authenticating the machine making a request.

Diameter supports stronger authentication on paper, but operators don’t always deploy basic protections like encryption, and many fall back on the same peer-to-peer trust model.

An attacker with access to the global signaling backbone, through a commercial leasing arrangement or a compromised operator, can send messages that carriers worldwide treat as trustworthy.

Signaling lets an attacker ask your carrier questions and make claims on your behalf:

Locate you in real time. Queries can return the cell tower you last connected to. Others, normally reserved for emergency responders, can return the actual coordinates your phone reports.

Locate you in real time. Queries can return the cell tower you last connected to. Others, normally reserved for emergency responders, can return the actual coordinates your phone reports.

Intercept communications. The attacker claims you’ve roamed onto another network, so your calls and texts are redirected to them. Combined with a stolen username and password, this delivers your SMS second factor to the attacker instead of you.

Intercept communications. The attacker claims you’ve roamed onto another network, so your calls and texts are redirected to them. Combined with a stolen username and password, this delivers your SMS second factor to the attacker instead of you.

Impersonate or block you. With your IMSI, an attacker can place calls or send SMS as you. A false roaming claim can also cut off service to your phone.

Impersonate or block you. With your IMSI, an attacker can place calls or send SMS as you. A false roaming claim can also cut off service to your phone.

Disrupt networks. Deliberately misconfigured signaling messages can overwhelm provider systems.

Disrupt networks. Deliberately misconfigured signaling messages can overwhelm provider systems.

None of this touches your device. It happens in automated transactions you can’t see and that leave no trace on your phone.

Why firewalls and velocity checks fall short

Carrier signaling firewalls reliably block messages sent to or from the wrong place. For correctly routed messages, they often run a velocity check to test whether you could physically have traveled from your last known location to the one now claimed. If you were in New York an hour ago and a Turkish carrier says you’re on its network, the request is denied.

The structural problem is that the firewall’s location data is often hours old. In research presented at the Wireless Security conference in 2025, Cape, the privacy-first mobile carrier, measured Diameter updates from a visited network arriving as infrequently as every two to ten hours.

Citizen Lab’s report shows this in practice: the actor it calls STA1 repeatedly tried to track a user by rotating through eleven operator identities in nine countries to look like legitimate roaming traffic. They also pivoted between SS7 and Diameter, which most carriers defend with separate firewalls and little coordination.

Consider a target who boards a flight from Nashville to Berlin and powers off her phone. A message posing as China Mobile claiming she’s roaming there gets rejected, because it’s physically impossible.

A message from a carrier in nearby Nassau, Bahamas, looks plausible, and the carrier can be fooled into routing her calls and SMS to the attacker.

Protect yourself with private cell service.

Cape is America's privacy-first mobile carrier providing unlimited talk, text, and 4G/5G data, built from the ground up with privacy and security at it's core.

Most carriers track everything: where you go, who you call, what you do. Cape collects the minimum amount of information required to provide you with service, deletes call and text metadata after 24 hours, rotates your network ID to prevent tracking, defends against SIM- and network-based attacks, and more.

Privacy shouldn't cost more. Switch today and get $29 off for life.

How Cape defends against signaling attacks

Cape is a privacy-first mobile carrier, whose approach is to assume the global telecom system is compromised and build protections that keep communications private anyway. There are four layers:

2. No SS7. Cape doesn’t support SS7 at all, and there is no SS7 fallback in the network, so SS7-based attacks have nothing to land on. Many carriers still struggle to retire legacy SS7 infrastructure because some revenue-generating part of their network depends on it.

3. Network Lock. Instead of trusting a network’s idea of where you are, Cape asks your device. When a foreign network requests to attach to your phone, Network Lock queries the Cape app, which evaluates the claim locally at the country level and reports back whether it matches. If an attacker tries to attach your IMSI from another country while your phone is at , the request is denied and you’re notified. Cape’s systems learn only whether the claim matches, not where you actually are, and Cape never collects or stores your precise location.

Real-time location tracking

Phone attaches whenever it gets service; velocity checks can be beaten by plausible spoofing

Network Lock verifies attach requests against your device

IMSI harvesting and reuse

IMSI is permanent and stays useful indefinitely

Daily rotation makes previously harvested IMSIs useless

Attackers use several methods to evade SS7 firewalls

Diameter-based attacks

Firewalls rely on widely published GSMA baselines

Firewalls updated from penetration tests using current techniques

You can’t patch the telecom backbone, but you can choose your carrier

Following every best practice, such as using encrypted messaging, avoiding public Wi-Fi, and enabling 2FA, still leaves your device dependent on networks never built with security in mind.

For people who are targeted, such as journalists, executives, security staff, and anyone whose accounts rely on SMS verification, the carrier is part of the threat model.

and written by Cape .