SS7 and Diameter Attacks: How Signaling Flaws Expose Your Mobile Phone

Flaws in SS7 and Diameter signaling protocols can allow malicious actors to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without ever compromising the target device.

• SS7 and Diameter protocols manage routing and signaling between global telecommunications carriers.
• Vulnerabilities allow attackers to intercept SMS one-time passcodes and drain bank accounts.
• Reports from Citizen Lab highlight commercial surveillance campaigns exploiting these flaws globally.
• Privacy-focused carriers like Cape are introducing network-level protections such as dropping SS7 entirely.

Understanding SS7 and Diameter Vulnerabilities Every mobile call, text message, and data session requires your telecom carrier to verify your subscription and route traffic accurately. This relies on automated control protocols known as signaling—specifically SS7 (dating back to the 1970s for 2G/3G) and Diameter (its successor for 4G and most 5G networks). Designed when only a handful of trusted operators connected to the system, these protocols assume incoming traffic is legitimate. SS7 lacks any machine-level authentication for requests, while Diameter is frequently deployed without basic encryption by operators relying on peer-to-peer trust. An attacker with access to the global signaling backbone can send messages that carriers worldwide treat as trustworthy, enabling real-time location tracking and communication interception.

Real-World Impact and Surveillance Campaigns Signaling attacks are far from new and have been exploited for years in everyday financial crimes as well as geopolitical espionage. Security researchers and media outlets have repeatedly demonstrated how attackers can hijack phone calls, texts, and bank accounts using only a phone number. A prominent report by Citizen Lab exposed commercial surveillance operations running thousands of attacks against targets across multiple countries. These network-level attacks leave zero trace on the user's device and bypass standard phone security. Although carrier firewalls attempt to block improperly routed messages using velocity checks, attackers can spoof roaming data or pivot between SS7 and Diameter to evade detection and trick home carriers into forwarding traffic.

Network Security and Modern Defensive Measures For high-risk individuals such as journalists, corporate executives, and security personnel, relying solely on encrypted apps or standard device security is insufficient because the underlying telecom carrier forms part of the threat model. Innovative privacy-first carriers like Cape are addressing these structural flaws by dropping legacy SS7 support altogether and introducing local device-level validation tools like Network Lock, which prevents foreign networks from spoofing subscriber locations without direct verification.