--- title: SS7 and Diameter Attacks: How Signaling Flaws Expose... description: Flaws in the SS7 and Diameter signaling protocols let attackers track phone locations, intercept calls and SMS codes, and impersonate subscribers without... canonical: https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone | daily.dev og:description: Flaws in the SS7 and Diameter signaling protocols let attackers track phone locations, intercept calls and SMS codes, and impersonate subscribers without... og:url: https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys og:image: https://api.daily.dev/og/posts/DuzmVQJYs.png og:image:alt: SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 8 min read · 0 upvotes · 0 comments ## Summary Flaws in the SS7 and Diameter signaling protocols let attackers track phone locations, intercept calls and SMS codes, and impersonate subscribers without touching the device. SS7 dates to the 1970s and has essentially no process for authenticating the machine making a request; Diameter supports stronger authentication but carriers often skip it. Research by carrier Cape measured Diameter location updates from visited networks arriving as infrequently as every two to ten hours. Citizen Lab documented an actor that repeatedly tried to track a target by rotating through eleven operator identities in nine countries. The piece, sponsored by Cape, describes its defenses: daily IMSI rotation, no SS7 support, a Network Lock that verifies attach requests against the device, and ongoing penetration testing. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between SS7 and Diameter signaling attacks? SS7, used in 2G and 3G networks since the 1970s, has essentially no mechanism for authenticating the machine making a request. Diameter, its successor used in 4G and most 5G, supports stronger authentication on paper, but operators often skip encryption and other protections, falling back on the same peer-to-peer trust model that makes both protocols exploitable. _Anyone weighing carrier security trade-offs can follow signaling-attack coverage like this on daily.dev._ ### Why do carrier signaling firewalls fail to stop SS7 and Diameter location spoofing attacks? Carrier firewalls rely on velocity checks comparing a subscriber's last known location to a newly claimed one, but that location data can be hours old. Research measured Diameter updates from visited networks arriving as infrequently as every two to ten hours, and over 250 distinct networks are reachable within an hour of travel in the US and Germany, giving attackers plenty of plausible roaming identities to exploit. _Engineers assessing telecom threat models can track signaling security research like this via daily.dev._ ### How did attackers rotate through multiple operator identities to track targets via SS7 and Diameter? Citizen Lab documented a surveillance actor it calls STA1 rotating through eleven operator identities across nine countries to make tracking requests look like legitimate roaming traffic. The actor also pivoted between SS7 and Diameter protocols, since most carriers defend each with separate firewalls that have little coordination between them. _Security researchers monitoring telecom surveillance tactics can follow writeups like this on daily.dev._ ## Similar posts on daily.dev - [Surveillance vendors caught abusing access to telcos to track people’s phone locations, researchers say](https://daily.dev/posts/surveillance-vendors-caught-abusing-access-to-telcos-to-track-people-s-phone-locations-researchers--2puwjln6z) · TechCrunch · 0 upvotes · 0 comments - [Telecom Attack Surface: SS7, BGP & Nation-State Intrusions](https://daily.dev/posts/telecom-attack-surface-ss7-bgp-nation-state-intrusions-v1wejqstm) · Cyble · 0 upvotes · 0 comments - [Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors](https://daily.dev/posts/bad-connection-uncovering-global-telecom-exploitation-by-covert-surveillance-actors-0xrralmoy) · Hacker News · 0 upvotes · 0 comments - [NDSS 2025 – Detecting IMSI-Catchers By Characterizing Identity Exposing Messages In Cellular Traffic](https://daily.dev/posts/ndss-2025-detecting-imsi-catchers-by-characterizing-identity-exposing-messages-in-cellular-traffic-4mqtyq4ay) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone","url":"https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys"},"datePublished":"2026-10-30T14:03:17.007Z","dateModified":"2026-10-30T14:03:46.433Z","description":"Flaws in the SS7 and Diameter signaling protocols let attackers track phone locations, intercept calls and SMS codes, and impersonate subscribers without...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d59b2996d6684d5c53b22b5855de64ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d59b2996d6684d5c53b22b5855de64ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone-duzmvqjys#faq","mainEntity":[{"@type":"Question","name":"What is the difference between SS7 and Diameter signaling attacks?","acceptedAnswer":{"@type":"Answer","text":"SS7, used in 2G and 3G networks since the 1970s, has essentially no mechanism for authenticating the machine making a request. Diameter, its successor used in 4G and most 5G, supports stronger authentication on paper, but operators often skip encryption and other protections, falling back on the same peer-to-peer trust model that makes both protocols exploitable. Anyone weighing carrier security trade-offs can follow signaling-attack coverage like this on daily.dev."}},{"@type":"Question","name":"Why do carrier signaling firewalls fail to stop SS7 and Diameter location spoofing attacks?","acceptedAnswer":{"@type":"Answer","text":"Carrier firewalls rely on velocity checks comparing a subscriber's last known location to a newly claimed one, but that location data can be hours old. Research measured Diameter updates from visited networks arriving as infrequently as every two to ten hours, and over 250 distinct networks are reachable within an hour of travel in the US and Germany, giving attackers plenty of plausible roaming identities to exploit. Engineers assessing telecom threat models can track signaling security research like this via daily.dev."}},{"@type":"Question","name":"How did attackers rotate through multiple operator identities to track targets via SS7 and Diameter?","acceptedAnswer":{"@type":"Answer","text":"Citizen Lab documented a surveillance actor it calls STA1 rotating through eleven operator identities across nine countries to make tracking requests look like legitimate roaming traffic. The actor also pivoted between SS7 and Diameter protocols, since most carriers defend each with separate firewalls that have little coordination between them. Security researchers monitoring telecom surveillance tactics can follow writeups like this on daily.dev."}}]} ```