Citizen Lab exposed "two long-running commercial surveillance campaigns abusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries." That blunt finding captures a persistent, low-visibility threat: attackers that never touch your phone can still track, intercept, impersonate, or silence it by abusing the telecom signaling systems that carriers use to route calls and texts.
SS7 and Diameter: the signaling rails that carry your identity
Signaling is the background traffic carriers use to verify subscribers and route calls, SMS, and data. Two protocols do most of this work: SS7, the decades-old system used in 2G/3G, and Diameter, its successor in 4G and most 5G networks. Both were designed for an era when a small number of trusted operators interchanged messages; they assume that a message claiming to come from a legitimate operator is legitimate.
SS7 has essentially no process for authenticating the machine making a request. Diameter, while able to support stronger authentication on paper, is often deployed without basic protections such as encryption, and many operators fall back on the peer-to-peer trust model that SS7 relies on. An attacker who gains access to the global signaling backbone — whether through a commercial leasing arrangement or by compromising an operator — can send messages that carriers worldwide treat as trustworthy.
What attackers can do inside the network
- Harvest IMSI. Given a phone number, an attacker can request the International Mobile Subscriber ID (IMSI) and reuse it for follow-on attacks for years.
- Locate the device. Signaling queries can return the last-seen cell tower or, in some cases, the actual coordinates the phone reports — the same kinds of data used by emergency services.
- Intercept communications. By falsely claiming a subscriber has roamed to another network, attackers can redirect calls and SMS; combined with stolen credentials, this can funnel SMS second factors to the attacker.
- Impersonate or block a subscriber. With an IMSI an attacker can place calls or send SMS as the victim, or the attacker can deny service to the real user by faking roaming status.
- Disrupt networks. Malformed or malicious signaling messages can overwhelm provider systems.
None of these actions requires malware, a phishing link, or any access to the target device; they happen entirely within automated inter-operator transactions and typically leave no trace on the phone itself.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPublic demonstrations and real-world incidents
These are not theoretical risks. The reporting catalogues public incidents and demonstrations: Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war; Citizen Lab documented long-running commercial surveillance campaigns; the YouTube channel Veritasium demonstrated hijacking a tech influencer's calls and texts using only his phone number; and Congressman Ted Lieu's phone was hacked on live TV via SS7 on 60 Minutes Australia. Criminals have reportedly used signaling protocols to intercept bank one-time passcodes and to attack global telecom infrastructure.
Why common carrier defenses often fall short
Carrier signaling firewalls can block messages that are routed from the wrong place and run velocity checks that test whether a claimed movement is physically plausible. But these defenses depend on timely, accurate location data — which carriers often do not have.
Research presented at the Wireless Security conference in 2025 by Cape measured Diameter updates from a visited network arriving as infrequently as every two to ten hours. For subscribers in the US and Germany, more than 250 distinct networks are reachable within a single hour of travel time, creating many plausibly valid operator identities an attacker can rotate through. Citizen Lab observed an actor it calls STA1 repeatedly rotating through eleven operator identities in nine countries and pivoting between SS7 and Diameter, exploiting the fact that most carriers run separate firewalls with little coordination.
Cape's defensive model — and what users should know
The article presenting these findings is sponsored and written by Cape, which positions itself as a "privacy-first mobile carrier" that assumes the global telecom system is compromised and builds protections accordingly. Cape describes four layers of defenses:
- Daily IMSI rotation. Cape says it rotates subscribers' IMSIs daily to invalidate harvested IMSIs that attackers reuse over months and years.
- No SS7 support. Cape asserts it does not support SS7 and that there is no SS7 fallback in its network, denying SS7-based attacks a target.
- Network Lock. When a foreign network requests to attach to a Cape subscriber, the carrier's systems query the Cape app on the device, which evaluates the claim locally at the country level and reports whether it matches. Cape says it learns only whether the claim matches and never collects or stores precise location.
- Continuous penetration testing. Cape reports it hires third parties that specialize in signaling exploitation techniques to test and harden its infrastructure against active threats.
The carrier also advertises operational privacy practices in the piece, saying it deletes call and text metadata after 24 hours, rotates network IDs to prevent tracking, and defends against SIM- and network-based attacks. The article includes a consumer offer: "Switch today and get $29 off for life."
Signaling attacks expose a structural weakness: the backbone of global telephony and mobile data was built on assumptions of mutual trust that no longer hold. The specifics reported here — public demonstrations, long-running commercial campaigns, and measured delays in diameter updates — show how a determined attacker can exploit that gap. Whether operators harden their signaling stacks, adopt more frequent location verification, or alter roaming trust models will determine how many of these attacks remain feasible; for some users, the report suggests, choosing a carrier designed to assume compromise is an available mitigation.
Original reporting: SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone — BleepingComputer
