Listen to this Post
Introduction
For decades, the global telecommunications infrastructure has been built on a fragile foundation of trust. Two core signaling protocols, the 32-year-old SS7 (Signaling System No. 7) and its newer but still flawed successor Diameter, were designed to enable seamless roaming, not to withstand adversarial attacks. A recent major investigation has uncovered that sophisticated threat actors are actively exploiting these fundamental vulnerabilities to conduct silent, cross‑border espionage, tracking mobile users worldwide by impersonating legitimate operators and manipulating routing data.
Learning Objectives
- Understand the core security weaknesses of SS7 and Diameter protocols.
- Learn to detect and block location‑tracking attacks using signaling firewalls and network hardening.
- Master hands‑on techniques for analyzing and attacking vulnerable telecom stacks.
You Should Know
- The Anatomy of a Silent Ghost Operator Attack
Extended version:
The investigation reveals two distinct surveillance actors, identified as STA1 and STA2. STA1 focuses on aggressive routing manipulation by spoofing legitimate operator hostnames and rapidly switching between SS7 and Diameter to evade firewalls. STA2 combines SS7 probing with a zero‑click binary SMS payload that extracts location data directly from the target’s device using malicious SIM Toolkit commands, without ever triggering a phone alert.
Attackers exploit the “combined attach” procedure that allows a roaming device to register with 3G and 4G networks simultaneously, providing a seamless pivot path between the two protocols.
Step‑by‑step guide – Simulating an SS7 Location Query (Authorized Penetration Testing Only):
1. Set up a Linux environment with SCTP support (Ubuntu/Debian recommended).
2. Install prerequisites:
sudo apt-get update sudo apt-get install lksctp-tools python2.7 openjdk-11-jdk git wireshark tshark
3. Clone a signaling testing framework (e.g., SigPloit):
git clone https://github.com/SigPloiter/SigPloit.git cd SigPloit
4. Prepare the SS7 MAP command – a ProvideSubscriberInfo (PSI) request. In a real test, you would need access to a roaming hub or a lab SS7 gateway. The following Python snippet illustrates the structure:
Pseudo‑code for constructing a TCAP PSI invoke IMSI and GT are required parameters tcap = TCAP() map_psi = MAP_ProvideSubscriberInfo(imsi='310150123456789') invoke = Invoke(operation=map_psi) tcap.append(invoke) Send via SCTP to SCCP address (requires operator interconnection)
5. Monitor the answer – if the network is misconfigured, it will return the cell ID or location area, which can be geolocated.
Mitigation:
Operators must implement SS7/Diameter firewalls that block malformed TCAP PDUs and unexpected PSI, ATI, or SRI requests originating from outside the home network.
Windows equivalent: Most telecom signaling tools are Linux‑only due to SCTP. On Windows, use WSL2 with the same commands, or deploy a dedicated virtual machine.
2. Detecting and Blocking Diameter Exploitation
Step‑by‑step guide: Filtering malicious Diameter messages
Diameter was designed with optional TLS/IPsec, but in practice many operators disable them for interoperability, leaving the protocol vulnerable to fuzzing, replay attacks, and subscriber impersonation.
- Enable Diameter logging on your signaling firewall (e.g., Palo Alto, Cisco, or open‑source SigFW). Configure SCTP inspection:
Example iptables rule for SCTP (Linux) sudo iptables -A INPUT -p sctp --dport 3868 -j LOG --log-prefix "Diameter: " sudo iptables -A INPUT -p sctp --dport 3868 -j DROP Block if not whitelisted
- Use a Diameter firewall or application‑aware gateway. Configure AVP (Attribute‑Value Pair) filtering:
– Block `UpdateLocationRequest (ULR)` with false or foreign origin.
– Block `ProvideLocationInformation` requests from unknown peers.
– Enforce stateful checking: only allow location requests that match the subscriber’s current serving network.
3. Deploy an intrusion detection system (e.g., Snort with custom rules for Diameter). Example rule:
alert sctp $HOME_NET 3868 -> $EXTERNAL_NET any (msg:"Diameter location probe"; content:"|01|ULR"; sid:1000001;)
4. Review GSMA FS.19 guidelines for Diameter interconnect security, and implement mandatory peer authentication using certificates or pre‑shared keys.
- Hardening the Mobile Core – Firewall and GTP Security
Step‑by‑step guide: Configuring a carrier‑grade signaling firewall
The investigation shows many operators rely on third‑party routing hubs with weak traffic screening, allowing attackers to spoof network identifiers.
- Deploy a signaling firewall (e.g., FortiGate with GTP protection profile, or open‑source SigFW).
- Enable GTP‑C and GTP‑U inspection – GTP tunnels carry user traffic and are often not authenticated, enabling IP spoofing and session hijacking.
On a Cisco ASA firewall:
policy-map type inspect gtp gtp_policy parameters rate-limit total-messages 500 rate-limit message Echo-Request 100 class class-default drop
On a Palo Alto firewall, navigate to Objects > Security Profiles > Mobile Network Protection and enable GTP‑in‑GTP detection, blocking malformed TEIDs.
3. Apply GSMA FS.11 SS7 filtering:
- Block any `SendRoutingInfo (SRI)` or `PSI` requests that originate from a foreign network but ask for a home subscriber.
- Whitelist known trusted roaming partners’ Global Titles (GTs).
- Enable anti‑spoofing: ensure the GT and SCCP address match registered interconnects.
- Monitor for GT spoofing – attackers often impersonate operators from countries like Cuba or Myanmar. Use real‑time anomaly detection like P1 Telecom Monitor (PTM) to flag unexpected GT changes.
4. Exploitation and Reconnaissance Using Open‑Source Tools
Step‑by‑step: Authorized security assessment of telecom protocols
Ethical hackers can use SigPloit to test their own lab environments; never attempt against live networks without written permission.
1. Install SigPloit as shown in Section 1.
2. Run Diameter exploitation:
cd SigPloit/diameter java -jar dvdn.jar Vulnerable Diameter emulator
3. Use Sigshark to analyze PCAPs of SS7/Diameter traffic:
git clone https://github.com/2b-as/sigshark.git cd sigshark python sigshark.py -r capture.pcap
This tool flattens SCTP chunks and groups transactions for easier analysis.
4. Perform fuzzing with ProtoCrawler (commercial) or custom scripts – send malformed TCAP tags to trigger parsing errors. Enea observed that extended‑tag encoding can hide the IMSI from weak firewalls, allowing location requests to sneak through.
5. Real‑World Indicators of Compromise (IoCs)
Prepare your SOC team to detect ongoing attacks. From the Citizen Lab report and Enea threat intelligence:
SS7‑specific IoCs:
- Unexpected `ProvideSubscriberInfo (PSI)` commands from unknown foreign GTs.
- TCAP messages with malformed IEs where the IMSI field is “hidden” via extended Tag lengths.
- Sudden surge in `SendRoutingInfo (SRI)` requests for a single IMSI from multiple GTs.
- Silent SMS (binary SMS) that does not trigger any user notification – indicative of STA2’s SIM exploit.
Diameter‑specific IoCs:
– `UpdateLocationRequest (ULR)` from a peer that is not the current serving network.
– Large number of `Credit‑Control Request (CCR)` messages causing exhaustion attacks on the PCRF/OCS.
– Diameter messages with missing AVPs or obviously spoofed Origin‑Host/Realm.
Network‑wide IoCs:
- SCTP association attempts on ports 3868 (Diameter) or 2905 (SS7 over SIGTRAN) from IP addresses not belonging to known roaming partners.
- Unusual GTP‑C messages (e.g.,
Delete PDP Context Request) from unfamiliar sources.
What Undercode Say
- Trust is the weakest link – The investigation confirms that the telecom industry’s “inter‑operator trust model” is a gaping security hole. Attackers only need to compromise a single roaming partner or set up a ghost operator to track millions of subscribers.
- Protocol insecurity is systemic, not just legacy. While SS7 lacks basic authentication, Diameter’s optional security measures are rarely fully enforced, leaving 4G and even 5G networks exposed.
- Attribution is nearly impossible – Attackers blend malicious signaling into billions of legitimate messages, and the opaque routing of international roaming makes tracing back to the source almost futile.
- Regulation is starting to catch up: The FCC probe and GSMA’s FS.11/FS.19 recommendations are steps in the right direction, but without mandatory, enforceable standards, carriers will continue to prioritize interoperability over security.
Prediction
Over the next 12 to 18 months, we will see a significant increase in regulatory actions. The FCC is likely to mandate SS7/Diameter security audits for all US carriers, similar to the STIR/SHAKEN mandate for robocalls. Meanwhile, 5G standalone (5G SA) networks that rely on HTTP/2 and Service‑Based Architecture (SBA) will introduce a new wave of API‑related vulnerabilities, shifting attacker focus from signaling protocols to cloud‑native interfaces. Operators who fail to deploy cross‑protocol signaling firewalls and adopt zero‑trust interconnect policies will become prime targets for nation‑state surveillance and commercial espionage, with mobile users paying the ultimate privacy price.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Cybersecuritynews Share – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
