Listen to this Post
Introduction:
Signaling System No. 7 (SS7) is the backbone of global telecommunications—a protocol suite developed in the 1970s and standardised in the 1980s that enables call setup, routing, billing, and roaming across the world‘s mobile networks. Yet this foundational technology was designed in an era when trust among operators was assumed and security was never a priority. The result is a sprawling attack surface: SS7 lacks authentication and encryption, allowing malicious actors to intercept voice calls, read SMS messages, track device locations in real time, and commit financial fraud—all without touching the target’s device. As Ryan Williams, Editor of HVCK Magazine, prepares to drop “a little SS7 love” at BSides Brisbane 2026 and announces the MVP launch of MetisRed, the cybersecurity community is once again forced to confront the uncomfortable reality that our most personal data travels over infrastructure designed before the internet was public.
Learning Objectives:
- Understand the architectural flaws in SS7 that enable location tracking, call interception, and SMS redirection.
- Learn how attackers exploit TCAP encoding anomalies and Global (GT) leasing to bypass carrier-grade firewalls.
- Gain hands-on knowledge of SS7 exploitation frameworks like Rodan and practical mitigation strategies for enterprises and mobile operators.
- Explore the potential impact of MetisRed as an AI-driven offensive security tool and what its MVP status signals for the threat intelligence landscape.
You Should Know:
- The SS7 Trust Model: Why Your Phone Is Never Truly Private
The SS7 protocol stack operates on a fundamental assumption: all network nodes—Service Switching Points (SSPs), Signal Transfer Points (STPs), and Service Control Points (SCPs)—are legitimate and trustworthy. Messages traverse the network in plaintext, with no cryptographic verification of origin or integrity. This design made sense in a world of state-owned monopolies; today, it is a catastrophic vulnerability.
Global (GT) leasing has amplified the problem. GTs function like IP addresses for telecom infrastructure, uniquely identifying signalling endpoints. These identifiers are now leased globally, often without rigorous identity verification, enabling attackers to operate anonymously or masquerade as legitimate operators. A surveillance vendor can simply lease a GT, route SS7 commands through trusted interconnections, and request subscriber location data as if they were the home network.
The most chilling demonstration of this came via Citizen Lab, which documented two campaigns where surveillance vendors exploited SS7 and Diameter protocols to track targets without any user interaction. Over 90% of unauthorised traffic in the mobile signalling environment is now generated by third parties, according to the report‘s authors—a systemic, unaddressed issue in global telecom infrastructure.
Step‑by‑step: How an SS7 Location Tracking Attack Works
- Reconnaissance: The attacker identifies the target’s mobile phone number and determines which mobile network operator (MNO) serves that number.
- GT Leasing or Spoofing: The attacker obtains SS7 access via a leased Global or spoofs a legitimate GT to impersonate a trusted network node.
- Crafting the PSI Request: The attacker constructs a Provide Subscriber Information (PSI) or AnyTime Interrogation (ATI) message—standard GSM-MAP commands used by operators for billing and mobility control.
- TCAP Encoding Manipulation: To bypass SS7 firewalls, the attacker alters the TCAP encoding of the Information Element (IE) containing the IMSI (International Mobile Subscriber Identity). By extending the Tag code, the IMSI field is effectively “hidden” from security checks.
- Submission: The malformed PSI request is sent to the target’s Home Location Register (HLR) or Home Subscriber Server (HSS).
- Data Exfiltration: The HLR/HSS returns the subscriber‘s location information (cell ID, often convertible to GPS coordinates). The attacker processes this data to determine the target’s approximate location in real time.
Linux Command Example (Educational Use Only):
While direct SS7 attacks require specialised telecom hardware or access to signalling gateways, researchers can simulate SS7 traffic using tools like `ss7sim` or the Rodan framework. Below is a Docker-based setup for Rodan, an SS7/Diameter exploitation framework developed by Etisalat Egypt Research Labs:
Prerequisites: Docker and Docker Compose installed Download the docker-compose.yml file wget https://github.com/Etisalat-Egypt/Rodan/blob/main/build/docker/docker-compose.yml Start the Rodan Intruder and SS7 simulation network docker-compose up -d Attach to the Rodan Intruder container docker exec -ti intruder rlwrap java -jar /app/app.jar Inside the Rodan console, type 'help' to view available modules
- The TCAP Bypass Attack: How Surveillance Firms Outsmart SS7 Firewalls
In mid-2025, cybersecurity firm Enea uncovered an active SS7 bypass technique being used by a surveillance company since at least the fourth quarter of 2024. The attack exploits TCAP (Transaction Capabilities Application Part) anomalies—specifically, manipulating the encoding of Information Elements within SS7 PDUs (Protocol Data Units).
TCAP messages contain building blocks called Information Elements (IEs), each with three fields: Tag (governs interpretation), Length, and Contents (the actual data). In a legitimate PSI request, the IMSI is placed in the Contents field with a standard Tag. The attacker extends the Tag code—an unexpected but technically valid encoding—which causes the receiving SS7 software stack to ignore the IMSI field entirely.
Mobile operators‘ firewalls typically check PSI packets by verifying that the IMSI belongs to the home network. If the source is not the home network but the IMSI is from the home network, the PSI should be blocked. By hiding the IMSI via extended Tag encoding, the attacker renders this check useless. The firewall sees no IMSI to validate and permits the request, allowing the attacker to retrieve location data for home subscribers.
Enea notes that the success of this attack is vendor- and software-specific, as it depends on whether the SS7 decoding stack implements the necessary logic to understand extended TCAP codes. However, its use as part of a commercial surveillance suite indicates it has proven valuable in the wild.
Step‑by‑step: Detecting and Mitigating TCAP Bypass Attacks
- Monitor for Malformed PDUs: Deploy SS7 firewalls with deep packet inspection capable of detecting PDUs where an IMSI is expected but not found within the decoded PDU.
- Block Undecodable Structures: Configure screening policies to reject any MAP PDU with malformed or unexpected TCAP encoding.
- Implement GSMA FS.07 Recommendations: Follow the GSMA‘s FS.07 security guidelines for SS7 and SIGTRAN networks, which describe possible attacks and propose best-practice countermeasures, including screening policies for MAP messages.
- Integrate SS7 Threat Intelligence: Leverage platforms like the GSMA T-ISAC (Telecommunication Information Sharing and Analysis Center), which has been pivotal since 2022 in enabling telecom operators to exchange SS7-related Indicators of Compromise (IoCs) and TTPs.
- Conduct Regular Penetration Testing: Use frameworks like Rodan in controlled environments to test your own SS7 edge defences. The Rodan framework includes modules for location tracking, call interception, and advanced filtering bypass (e.g., malformed ACN, global OpCodes, double MAP components).
Windows Command Example (Network Monitoring):
While SS7 traffic is not typically visible on standard Windows networks, security analysts can monitor SIGTRAN (SS7 over IP) traffic using Wireshark:
Install Wireshark via Chocolatey (requires admin) choco install wireshark -y Launch Wireshark and filter for SIGTRAN traffic (port 2905) Alternatively, use tshark from command line: & "C:\Program Files\Wireshark\tshark.exe" -i "Ethernet" -f "port 2905" -Y "sigtran"
- MetisRed: A New Player in Offensive Security and What MVP Means
Ryan Williams announced that MetisRed has officially reached MVP (Minimum Viable Product) status. While specific technical details about MetisRed remain scarce, the name suggests a fusion of “Metis” (Greek goddess of wisdom and cunning) and “Red” (red teaming, offensive security). Given Williams‘ background as a penetration tester and his role as Editor of HVCK Magazine—a publication dedicated to “all things hacking”—MetisRed is likely an offensive security tool or platform.
The broader cybersecurity landscape has seen a surge in AI-driven offensive tools. Arm‘s Metis, for example, is an open-source, AI-driven tool for deep security code review that uses agentic AI to help developers address vulnerabilities faster, with 50% fewer false positives compared to leading static analysis tools. Another Metis framework, recently published on arXiv, reformulates LLM jailbreaking as inference-time policy optimisation within an adversarial Partially Observable Markov Decision Process (POMDP).
If MetisRed follows this trajectory, it could be an AI-augmented red teaming platform designed to automate the discovery and exploitation of vulnerabilities in telecom signalling, web applications, or cloud infrastructure. Its MVP status indicates that Williams and his team have a functional core product, likely with basic modules for reconnaissance, exploitation, and reporting.
Step‑by‑step: What to Expect from an AI-Driven Offensive Security Tool
- Automated Reconnaissance: AI agents scan target environments (telecom networks, cloud APIs, web applications) to identify potential entry points.
- Vulnerability Discovery: Machine learning models correlate CVEs, misconfigurations, and behavioural anomalies to prioritise high-risk weaknesses.
- Exploit Generation: The tool crafts custom payloads or adapts existing exploits to bypass specific defences (e.g., TCAP encoding tricks, WAF rules).
- Persistence and Lateral Movement: AI-driven decision trees suggest the most efficient paths to high-value assets.
- Reporting and Remediation: Generate actionable reports with step-by-step remediation guidance, tailored to the target‘s specific environment.
-
BSides Brisbane 2026: Community-Driven Security and the SS7 Deep Dive
BSides Brisbane 2026, running from 28 June 2026, is a community-driven cybersecurity conference focused on interactive workshops, hands-on demos, and meaningful conversations. The theme, “Time Travel – Journey through the past, present, and future of cybersecurity,” perfectly aligns with Williams‘ SS7 presentation. SS7 is a legacy protocol from the past, actively exploited in the present, and its mitigation will shape the future of 5G and beyond.
Williams‘ session—described as “dropping a little SS7 love”—is likely a practical demonstration of SS7 attack techniques, possibly using the Rodan framework or a custom tool like MetisRed. Attendees can expect to see live location tracking, SMS interception, or call redirection, followed by a discussion of mitigation strategies and the role of threat intelligence sharing.
For security professionals unable to attend, the GSMA T-ISAC provides a centralised intelligence-sharing platform where telecom providers exchange SS7-related IoCs. Additionally, the ITU-T Q.3066 recommendation (January 2026) establishes a framework for detecting and mitigating signalling attacks in both legacy (SS7) and modern (Diameter, SIP, GTP) protocols.
Step‑by‑step: Preparing for Telecom-Level Attacks in Your Organisation
- Assess Your Exposure: Identify which employees, executives, and high-value individuals are most likely to be targeted by commercial surveillance.
- Engage Your Mobile Carrier: Ask your enterprise carrier what SS7 and Diameter monitoring and filtering controls are in place, and whether they participate in GSMA T-ISAC threat intelligence sharing.
- Implement Device-Level Hardening: While telecom-level attacks bypass device controls, enable Wi-Fi calling where possible (which uses IP-based encryption) and use end-to-end encrypted messaging apps for sensitive communications.
- Consider Dedicated Threat Intelligence: Include telecom-layer exploitation in your threat model and evaluate whether your current intelligence sources cover this category of attack.
- Develop an Incident Response Plan: If you suspect SS7-based surveillance, have a protocol for engaging your carrier‘s security team and legal counsel immediately.
What Undercode Say:
- Key Takeaway 1: SS7 vulnerabilities are not theoretical—they are actively commercialised by surveillance vendors and available as a service. The TCAP encoding bypass discovered by Enea demonstrates that even carrier-grade firewalls can be defeated with relatively simple protocol manipulation.
- Key Takeaway 2: The MVP launch of MetisRed signals a growing trend toward AI-augmented offensive security tools. As these tools become more accessible, the barrier to entry for sophisticated telecom and network attacks will lower, forcing defenders to adopt proactive, intelligence-driven strategies.
Analysis: The persistence of SS7 vulnerabilities after more than a decade of public awareness is a sobering reminder of the inertia inherent in global telecom infrastructure. Upgrading or replacing SS7 would require coordinated action across thousands of operators worldwide—a logistical and economic impossibility in the short term. Instead, the industry has relied on layered defences: SS7 firewalls, GT leasing codes of conduct, and threat intelligence sharing. Yet as the TCAP bypass attack shows, these defences are only as strong as their implementation. The variability in SS7 software stacks means that some operators remain vulnerable while others are protected—a patchwork that surveillance vendors can systematically probe. MetisRed, if it incorporates AI-driven fuzzing or protocol analysis, could accelerate the discovery of such bypass techniques, putting pressure on vendors to standardise and harden their SS7 implementations. The BSides Brisbane session is a critical educational moment, bridging the gap between telecom engineers and the broader security community.
Prediction:
- +1 The growing awareness and commercialisation of SS7 attacks will accelerate adoption of GSMA FS.07 and ITU-T Q.3066 standards, leading to more consistent SS7 firewall deployments and GT leasing controls over the next 18–24 months.
- -1 AI-driven offensive tools like MetisRed will lower the technical barrier to SS7 exploitation, enabling a new wave of non-state actors—including cybercriminals and hacktivists—to conduct telecom-level surveillance and fraud at scale.
- +1 The integration of SS7 threat intelligence into SOAR platforms will enable real-time, automated mitigation, such as blocking malicious GTs or tagging anomalous signalling traffic.
- -1 The transition to 5G and Diameter protocols does not inherently solve SS7‘s trust problems; as Citizen Lab demonstrated, Diameter attacks are already occurring where operators have not implemented security protections. The legacy of SS7 will haunt telecommunications for another decade.
- +1 Community-driven events like BSides Brisbane and open-source research repositories (e.g., the SS7 Vulnerability Research and Tutorial on GitHub) will foster a new generation of security professionals who understand telecom signalling, driving innovation in both offensive testing and defensive hardening.
▶️ Related Video (68% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Ryan Williams – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
