Your phone's security isn't just about the apps you install or the links you click. A significant, often overlooked, attack surface lies deep within the global telecom network, in the very protocols that enable your calls, texts, and data. These are signaling protocols like **SS7** (Signaling System No. 7), used in 2G/3G networks, and its successor, **Diameter**, prevalent in 4G and most 5G. Designed decades ago with an inherent trust model among a few large operators, they lack robust authentication mechanisms, creating fertile ground for exploitation. ### A Persistent Problem Signaling attacks are not new. They gained recent notoriety when Iranian-linked actors reportedly exploited outdated network technology to locate U.S. personnel's phones in the Middle East. However, the vulnerability has a long history of being used for more common crimes, such as intercepting bank one-time passcodes. Even popular YouTubers like **Veritasium** have demonstrated the ease with which a tech influencer's calls and texts can be hijacked using only their phone number. **Notable Incidents Include:** * Criminals exploiting signaling protocols to target bank accounts and global telecom infrastructure. * **Citizen Lab** uncovering two extensive commercial surveillance campaigns abusing SS7 and Diameter, impacting thousands of targets across dozens of countries. * Congressman **Ted Lieu's** phone being hacked live on **60 Minutes Australia** via SS7. * Attackers intercepting SMS one-time passcodes to drain victims' bank accounts. ### Understanding Signaling Attacks Every mobile interaction—a call, a text, a data session—relies on your carrier verifying your identity and routing your traffic. This is handled by signaling, the background messages that identify your location and direct traffic. It's the connective tissue between global providers, yet it remains one of the most overlooked attack surfaces in mobile security. **SS7** and **Diameter** are the primary protocols. SS7, dating back to the 1970s, fundamentally lacks strong authentication. While Diameter theoretically supports stronger authentication, operators frequently fail to deploy basic protections like encryption, often defaulting to the same peer-to-peer trust model as SS7. This trust model means an attacker who gains access to the global signaling backbone—either through a commercial leasing arrangement or by compromising an operator—can send messages that carriers worldwide will treat as legitimate. ### How These Attacks Unfold Signaling attacks allow an adversary to query your carrier and make claims on your behalf: * **Harvest Your IMSI:** Knowing your phone number, an attacker can request your **International Mobile Subscriber ID (IMSI)** under the guise of routing a call or SMS. This IMSI can then be used for subsequent attacks for years. * **Real-time Location Tracking:** Queries can reveal the cell tower you last connected to. More advanced queries, typically reserved for emergency services, can return your phone's precise coordinates. * **Intercept Communications:** The attacker can falsely claim you've roamed onto another network, redirecting your calls and texts to them. This is particularly dangerous when combined with stolen credentials, allowing them to intercept SMS-based second-factor authentication codes. * **Impersonation or Service Disruption:** With your IMSI, an attacker can place calls or send SMS messages as you. A false roaming claim can also effectively cut off service to your phone. * **Network Disruption:** Deliberately misconfigured signaling messages can overwhelm provider systems, leading to denial-of-service. Crucially, none of these attacks require access to your device. They occur within automated network transactions, leaving no trace on your phone. ### The Limitations of Traditional Defenses Carrier signaling firewalls are designed to block improperly routed messages. Many also employ **velocity checks**, attempting to determine if a user could realistically have traveled from their last known location to a newly claimed one. If you were in New York an hour ago and a Turkish carrier claims you're on its network, the request should be denied. However, this defense is often insufficient. Research presented at the Wireless Security conference in 2025 by **Cape**, a privacy-first mobile carrier, revealed that Diameter updates from visited networks can arrive as infrequently as every two to ten hours. For subscribers in the U.S. and Germany, over 250 distinct networks are reachable within an hour of travel. An attacker with enough operator identities can eventually find one that appears plausible. Citizen Lab's report illustrates this: an actor, dubbed **STA1**, repeatedly attempted to track a user by rotating through eleven operator identities across nine countries to mimic legitimate roaming traffic. They also leveraged both SS7 and Diameter, protocols often defended by separate, uncoordinated firewalls. Consider a target who flies from Nashville to Berlin and powers off her phone. A message posing as **China Mobile** claiming she's roaming there would likely be rejected as physically impossible. However, a message from a carrier in nearby Nassau, Bahamas, might look plausible, potentially tricking the home carrier into routing her calls and SMS to the attacker.  ### **Cape**'s Approach to Signaling Attack Defense **Cape**, a privacy-first mobile carrier, adopts a proactive stance, assuming the global telecom system is compromised and building protections to maintain communication privacy. Their multi-layered defense includes: 1. **Daily IMSI Rotation:** Most targeted signaling attacks begin with an IMSI. On traditional carriers, your IMSI is permanent. Cape, however, rotates your IMSI daily, rendering databases of harvested IMSIs useless against their subscribers. 2. **No SS7:** Cape's infrastructure is designed to avoid SS7 entirely, mitigating a significant portion of legacy signaling vulnerabilities. For IT security professionals and privacy-conscious users, understanding these underlying network vulnerabilities is crucial. While individual users have limited control over carrier infrastructure, choosing providers that prioritize advanced network-level security, like daily IMSI rotation and modern protocol avoidance, can significantly enhance personal privacy and security against these silent threats.