Mobile networks have spent decades improving encryption, subscriber authentication, and the security of wireless communications, yet some of their most significant vulnerabilities exist within the infrastructure responsible for connecting those systems. Signaling protocols such as Signaling System No. 7 (SS7) and Diameter handle the exchange of information between telecommunications operators, coordinating everything from subscriber registration and roaming to SMS delivery, authentication, and mobility management. Their operation depends on trusted relationships between network elements, creating security concerns that extend well beyond the devices connected to them.
Unlike conventional attacks targeting mobile operating systems or applications, signaling attacks exploit the control plane responsible for managing communications across telecommunications infrastructure. Depending on the protocols involved and the access available to an attacker, weaknesses in signaling authentication and authorization can expose subscriber identifiers, reveal location information, interfere with service availability, or manipulate the routing of incoming communications. An attacker with unauthorized access to a trusted signaling network may be able to influence these operations without compromising the subscriber’s handset or directly interacting with its software. The underlying problem is architectural, stemming from telecommunications protocols developed around assumptions about which networks could be trusted and how participating operators would exchange sensitive information.
SS7 and the Origins of Mobile Network Trust
SS7 provides one of the clearest examples of these historical security assumptions. Developed during the transition to digital telephone networks, SS7 established a standardized method for exchanging control information between switching systems without relying on the same channels carrying voice communications. Its architecture separates signaling transport, routing, transaction management, and application functionality into several components. The Message Transfer Part (MTP) handles basic signaling transport and routing, the Signaling Connection Control Part (SCCP) supports extended addressing and routing services, and the Transaction Capabilities Application Part (TCAP) facilitates transaction-oriented exchanges between distributed applications. The Mobile Application Part (MAP) uses these capabilities to support operations such as subscriber authentication, location updates, roaming, and SMS routing.
These protocols became central to second- and third-generation mobile networks, where subscriber information was distributed across several interconnected network elements. The Home Location Register (HLR) maintains subscriber profiles, service authorization information, and the identity of the network currently serving a subscriber. The Visitor Location Register (VLR) maintains temporary subscriber information within a serving area, and the Mobile Switching Center (MSC) handles circuit-switched call control and related mobility functions. When a subscriber moves between networks, these systems exchange MAP messages to update registration information and maintain service continuity. The design assumes that participating telecommunications infrastructure can exchange the information required to support these operations, with the original environment relying heavily on the trustworthiness of interconnected operators.
The problem is that traditional SS7 signaling does not provide comprehensive native authentication and authorization for every application-layer operation crossing network boundaries. Historically, access to the signaling network itself was treated as a significant indication of trust, since the infrastructure was primarily accessible to established telecommunications providers. As global interconnection grew to include additional operators, roaming intermediaries, and signaling service providers, that assumption became increasingly difficult to defend. A message arriving through an accepted signaling route could still contain an unauthorized request, and the receiving network might lack sufficient controls to distinguish a legitimate roaming transaction from an attempt to retrieve subscriber information or manipulate network state. The distinction between authenticating a signaling connection and authorizing an individual operation became one of the central security problems affecting SS7.
Global Title (GT) addressing introduces another dimension to this problem. Within SCCP, Global Titles identify signaling destinations and allow messages to be routed between operators through Global Title Translation (GTT). This addressing model supports international interoperability, but it can complicate attribution and origin validation when signaling traffic passes through multiple intermediaries. In some commercial arrangements, organizations can obtain access to Global Titles associated with other providers, a practice commonly described as Global Title leasing. A receiving operator may recognize the address or route through which a request arrives without possessing reliable information about the organization actually originating the transaction. When signaling security policies rely primarily on known addressing information instead of validating the authorization associated with individual requests, this ambiguity can create opportunities for misuse.
Subscriber Tracking, SMS Interception, and Registration Manipulation
Some of the most extensively documented SS7 weaknesses involve unauthorized access to subscriber location information. MAP operations such as SendRoutingInfoForSM (SRI-SM), ProvideSubscriberInfo (PSI), and AnyTimeInterrogation (ATI) support legitimate telecommunications services but can also expose sensitive data when improperly accessible. SRI-SM, for example, is used during SMS delivery to retrieve information required to route a message to its intended recipient. Depending on the network configuration, the response can include the subscriber’s International Mobile Subscriber Identity (IMSI) and serving MSC address. PSI and ATI can provide additional subscriber-state or location-related information when the requesting entity is permitted to use those procedures. In networks with inadequate origin screening or application-level authorization, an attacker operating through a signaling connection may be able to obtain information about a subscriber’s current serving network or approximate geographic location.
The precision of this information depends on the network architecture, requested operation, and data available to the responding system. An MSC address may identify a broad serving region, whereas information containing a Cell Global Identity (CGI) or related location identifiers may permit a more precise geographic estimate. Repeated queries can also reveal changes in serving infrastructure, allowing an attacker to infer movement patterns from successive network observations. These operations do not inherently provide continuous GPS tracking, and their effectiveness varies considerably across operators and defensive configurations. Nonetheless, the ability to retrieve location-related data through telecommunications signaling rather than the subscriber’s device presents a significant privacy concern, particularly when the targeted individual has no visibility into the requests being made.
SS7 weaknesses are not limited to information disclosure. Certain MAP operations can modify subscriber registration information, potentially affecting how calls and messages are routed. UpdateLocation is used during legitimate mobility-management procedures to register a subscriber with a serving VLR, allowing the home network to maintain information about the subscriber’s current location. If an unauthorized signaling participant can submit a location update that the HLR accepts, the network may associate the subscriber with an incorrect serving element. In susceptible environments, this manipulation can interfere with incoming communications or contribute to message redirection. The actual outcome depends on how the operator validates serving-network identities, processes conflicting location updates, and handles subsequent routing requests.
SMS interception represents a particularly significant consequence of unauthorized routing manipulation. When a network receives an SMS intended for a subscriber, it must determine where that subscriber is currently registered before forwarding the message through the appropriate delivery infrastructure. If an attacker successfully influences the subscriber’s location or routing state, incoming messages may be directed through an unintended network element. Under the appropriate conditions, this can expose SMS messages containing account recovery codes, one-time passwords, or other sensitive information. The attack does not require decrypting the radio traffic between the handset and the cellular base station, since the attacker is targeting the control-plane decisions that determine where the message is delivered. Successful interception is not guaranteed by signaling access alone, but the possibility illustrates why securing handset communications cannot compensate for weaknesses in the infrastructure responsible for routing them.
Other MAP operations can affect service availability and subscriber configuration. CancelLocation is used to remove registration information associated with a subscriber, and InsertSubscriberData allows subscriber information to be distributed to serving network elements. If these operations are accepted from unauthorized sources, they may disrupt normal registration procedures or introduce changes to subscriber-related state. Such behavior can result in denial-of-service conditions or other forms of service interference, depending on the recipient’s implementation and the information supplied. These attacks differ from conventional network flooding since they exploit legitimate management procedures to produce an unauthorized change. A relatively small number of accepted signaling messages can potentially produce meaningful consequences without requiring unusually high traffic volumes.
Diameter and the Limitations of Transport Security
The introduction of Diameter in fourth-generation cellular networks changed the signaling architecture considerably, but it did not eliminate the underlying challenges associated with inter-operator trust. Diameter is an extensible authentication, authorization, and accounting (AAA) protocol defined in RFC 6733, with specialized applications used throughout the LTE Evolved Packet Core (EPC). It replaces many functions historically supported by SS7 MAP in earlier mobile architectures, providing an IP-based framework for exchanging authentication information, subscriber profiles, policy decisions, and mobility-management data. Diameter messages contain a protocol header and a collection of Attribute-Value Pairs (AVPs), which carry the information required to identify network elements, route transactions, and execute application-specific procedures. Fields such as Command Code, Application ID, Hop-by-Hop Identifier, and End-to-End Identifier help receiving systems interpret and process the messages.
Diameter incorporates stronger transport-security requirements than traditional SS7 signaling. RFC 6733 requires Diameter connections to use suitable security mechanisms, including TLS, DTLS, or IPsec, depending on the supported transport and deployment. These protections can provide peer authentication, confidentiality, and integrity for signaling exchanged across protected connections. Yet transport security does not automatically establish whether a particular request is authorized to perform an operation against the subscriber or network function it references. Diameter deployments frequently use intermediaries such as Diameter Routing Agents (DRAs), Diameter Edge Agents (DEAs), relay agents, and proxies that participate in routing messages between independent administrative domains. A protected connection between two adjacent peers establishes security properties for that connection, but it does not necessarily provide end-to-end authorization or cryptographic integrity for every application-level parameter carried through the signaling chain.
This distinction becomes significant when examining Diameter identity and routing information. AVPs such as Origin-Host, Origin-Realm, Destination-Host, and Destination-Realm identify the logical source and destination of signaling messages and support routing across Diameter domains. These fields provide valuable context for access control, but their presence does not independently establish that the stated origin is authorized to request subscriber information or modify network state. The Hop-by-Hop and End-to-End identifiers are similarly intended for transaction handling, response correlation, and duplicate detection rather than cryptographic authentication. A malicious or compromised signaling peer may attempt to exploit inadequate validation between the authenticated transport identity, the declared Diameter origin, and the operations permitted under an existing interconnection relationship.
The separation between peer authentication and command authorization creates an important security boundary within Diameter networks. An operator may permit an external Diameter peer to exchange specific mobility-management messages as part of a legitimate roaming arrangement, but that relationship should not automatically grant access to unrelated subscriber records or other sensitive application functions. Authorization decisions need to account for the Diameter application, command type, originating realm, serving network, and subscriber context. Without sufficiently restrictive policies, an authenticated signaling participant may be capable of requesting operations that exceed the privileges intended for its interconnection.
Exploiting Mobility Management and Authentication Procedures in LTE
Within the LTE EPC, one of the most security-sensitive Diameter interfaces is S6a, which connects the Mobility Management Entity (MME) to the Home Subscriber Server (HSS). The MME manages important control-plane functions, including mobility management, registration, and coordination of subscriber authentication, whereas the HSS maintains subscription information and supports the generation or retrieval of authentication data. The related S6d interface connects the Serving GPRS Support Node (SGSN) to the HSS for applicable mobility and subscriber-management procedures. 3GPP TS 29.272 defines Diameter applications and commands used across these interfaces, including Update Location, Authentication Information Retrieval, Cancel Location, and Insert Subscriber Data. These operations are necessary for normal service, but they also represent sensitive actions that require accurate validation of the requesting network element and its authorization.
An Update-Location-Request (ULR), for example, allows an MME or SGSN to register its association with a subscriber in the HSS. The receiving HSS processes the request and can return subscription information through an Update-Location-Answer (ULA). A legitimate update reflects a subscriber attaching to or moving between serving network elements, but an unauthorized update accepted by the HSS could cause the subscriber’s serving-node association to become inaccurate. The effects may include registration inconsistencies, disrupted mobility procedures, or interference with subsequent signaling directed to the serving network. The HSS must account for information such as the requesting node’s identity, the Visited-PLMN-Id, the subscriber’s registration state, and the authorized roaming relationship before accepting changes that affect subscriber mobility information.
Cancel-Location-Request (CLR) and Insert-Subscriber-Data-Request (IDR) messages raise similar authorization concerns. A CLR allows the HSS to instruct an MME or SGSN to remove a subscriber’s registration information, an operation that can occur during normal mobility management. If an unauthorized request is accepted by the serving network, it may invalidate subscriber context and cause service interruption or require the device to undergo another registration procedure. IDR messages allow the HSS to distribute changes to subscription data maintained by the serving node. An unauthorized IDR could create opportunities to manipulate subscriber-related parameters if the receiving implementation accepts the request and applies the supplied information. The impact depends on the permitted AVPs, the current subscriber state, and the authorization controls protecting the receiving network element.
Diameter also carries authentication-related information that requires particularly restrictive handling. Authentication-Information-Request (AIR) messages allow authorized serving network elements to request authentication vectors from the HSS. Under the EPS Authentication and Key Agreement (EPS-AKA) framework, these vectors contain material used to authenticate subscribers and establish subsequent security contexts. Depending on the procedure, an EPS authentication vector includes values such as RAND, AUTN, XRES, and KASME. Unauthorized access to this information is a serious security concern, although retrieving a vector does not automatically disclose the long-term secret stored on the subscriber’s SIM or guarantee successful impersonation. The risk lies in exposing sensitive authentication material to an entity that should never have been authorized to request it, potentially weakening assumptions about the confidentiality and integrity of the authentication process.
These attack scenarios demonstrate how the misuse of legitimate Diameter procedures can affect subscriber security without requiring an attacker to exploit a memory-corruption vulnerability or compromise a mobile endpoint. The protocol messages themselves may conform to expected formats, and the receiving system may process them according to its normal application logic. The security failure occurs when a requesting entity can perform an operation outside its authorized role. Preventing these conditions requires authorization policies that incorporate the subscriber’s current state and the relationship between the originating network function and the requested operation.
International Roaming and Cross-Protocol Exposure
International roaming increases the difficulty of enforcing these protections. When a subscriber connects to a visited Public Land Mobile Network (PLMN), the visited operator must communicate with the home operator to perform authentication, authorize service, and maintain mobility information. These exchanges may pass through IP Packet Exchange (IPX) networks, roaming hubs, or other interconnection providers that facilitate communications between carriers. Each additional participant introduces another administrative boundary and another potential source of unauthorized or compromised signaling traffic. Even when a roaming relationship is legitimate, the participating operator should have access only to the signaling operations and subscriber data necessary for its authorized services. A trusted connection to another carrier is not equivalent to unrestricted permission to query subscribers, retrieve authentication material, or change registration state.
The coexistence of multiple cellular generations makes these relationships more difficult to secure. Network operators frequently maintain legacy signaling infrastructure to support roaming, messaging, circuit-switched services, and interoperability with older networks. Signaling Transfer Points (STPs), Diameter routing infrastructure, and protocol interworking functions may translate or route control-plane messages across different network environments. In some deployments, an operation originating in an SS7 domain can influence subscriber information maintained by infrastructure associated with later-generation services through designated interworking procedures. This creates the possibility of cross-protocol attacks in which weaker authorization controls in one signaling domain affect functions operating in another. The security of the overall environment depends on how these transitions are authenticated, authorized, and monitored, rather than the protections available within any single protocol.
These interworking relationships also create challenges for security monitoring. An operator may have different systems responsible for inspecting SS7 MAP traffic, Diameter transactions, and IP-based control-plane communications. If these systems operate independently, an attacker may be able to exploit gaps between their respective monitoring capabilities. A suspicious sequence of events might begin with unauthorized subscriber-information retrieval in one signaling domain and continue with registration manipulation in another, without either monitoring system independently possessing enough context to identify the complete activity. Cross-protocol correlation becomes increasingly valuable as operators maintain heterogeneous telecommunications infrastructure.
Why 5G Does Not Eliminate Legacy Signaling Risks
Fifth-generation mobile networks introduced significant architectural changes intended to address many of the limitations associated with earlier cellular systems. The 5G Standalone (SA) core uses a Service-Based Architecture (SBA), replacing numerous traditional point-to-point signaling relationships with service-based interfaces between network functions. Components such as the Access and Mobility Management Function (AMF), Unified Data Management (UDM), Authentication Server Function (AUSF), and Session Management Function (SMF) communicate through standardized service interfaces. These interfaces use HTTP-based service communication and support security mechanisms defined by 3GPP TS 33.501, including mutual authentication and authorization controls between participating network functions. The architecture provides more explicit security mechanisms for controlling access to services and subscriber information than those available in traditional SS7 environments.
For communications crossing operator boundaries, the Security Edge Protection Proxy (SEPP) establishes an additional security boundary. The N32 interface supports signaling between SEPPs, with mechanisms that include TLS and the Protocol for N32 Interconnect Security (PRINS). Depending on the interconnection model, these protections can provide transport security, application-layer integrity protection, and controls governing information exposed to roaming intermediaries. The SEPP architecture is intended to protect inter-PLMN signaling against unauthorized modification and disclosure, including situations in which messages traverse intermediate providers. Its effectiveness still depends on correctly configured trust relationships, certificate management, authorization policies, and the treatment of information received from external networks.
The introduction of 5G does not mean that SS7 and Diameter have disappeared from operational telecommunications infrastructure. Non-Standalone (NSA) 5G deployments can rely on the LTE EPC for core-network functionality, retaining Diameter signaling associated with mobility management and subscriber authentication. Even operators deploying standalone 5G cores may continue to operate LTE and earlier-generation systems for coverage, roaming compatibility, or other service requirements. Legacy infrastructure can remain connected through interworking functions and operator interconnection arrangements, creating security dependencies that are not addressed simply by deploying a newer radio access technology. A secure 5G service-based interface cannot independently protect an unrelated SS7 or Diameter interface that continues to accept unauthorized signaling transactions.
Detecting Unauthorized Signaling and Subscriber-State Changes
Defending these environments requires inspection and authorization at the signaling application layer rather than relying exclusively on transport security or network perimeter controls. An SS7 firewall should evaluate the originating Global Title, destination, MAP operation, subscriber identifiers, routing context, and permitted interconnection relationships before allowing sensitive transactions. Network operators can apply rules to restrict location-information requests, verify the origin of subscriber-management operations, and identify signaling messages inconsistent with expected roaming procedures. These controls must account for legitimate telecommunications behavior, since excessive filtering can interfere with registration, SMS delivery, and international roaming. Effective policies require knowledge of protocol semantics and the operational context surrounding each transaction.
Diameter security requires comparable controls at the interconnection boundary. Diameter Edge Agents and related security systems should correlate the authenticated peer identity with the Origin-Host, Origin-Realm, Application ID, Command Code, and relevant AVPs contained in each message. A location update should be evaluated against the subscriber’s current serving-node association, permitted roaming relationships, and the identity of the network claiming to serve the subscriber. Authentication-related requests should be limited to authorized network functions and assessed for inconsistencies in the subscriber’s state or the originating network. Valid protocol syntax and a successful TLS connection are insufficient grounds for accepting an otherwise unauthorized transaction.
Stateful analysis is particularly valuable for identifying attacks that cannot be reliably detected from individual messages. A sequence of unexpected location updates, registration cancellations, subscriber-information queries, or authentication requests may reveal attempts to manipulate mobility state or collect information about a particular subscriber. Correlating these events with registration history, roaming records, and other network telemetry can help distinguish legitimate mobility procedures from suspicious activity. For example, repeated changes in serving-network identity across geographically distant locations may warrant investigation, especially if they conflict with the subscriber’s known registration state. These patterns require contextual assessment, since legitimate roaming behavior and network recovery procedures can sometimes produce unusual signaling sequences.
Traditional volumetric detection is also insufficient for many signaling threats. An attacker seeking to locate a particular subscriber may issue relatively few requests, avoiding the traffic anomalies commonly associated with denial-of-service attacks. A malicious location update or registration cancellation can have an operational impact even when it represents a small fraction of normal signaling volume. Operators need detection systems capable of identifying unauthorized operations based on the identity of the requesting entity, the target subscriber, the message’s purpose, and its consistency with legitimate network behavior. ITU-T Recommendation Q.3066, approved in January 2026, addresses approaches for detecting and mitigating signaling attacks, including attacks involving multiple requests, multiple protocols, and interactions between cellular generations.
Effective monitoring also requires access to telecommunications-specific telemetry. Conventional enterprise security monitoring platforms may collect operating-system, endpoint, application, and network firewall logs without possessing visibility into MAP transactions, Diameter AVPs, or subscriber mobility events. Security information and event management (SIEM) platforms can support correlation and investigation, but only if appropriate signaling gateways, network elements, or specialized monitoring systems export the necessary information. Relevant telemetry can include request origin, signaling destination, protocol operation, subscriber identifiers, transaction timestamps, validation outcomes, and changes to registration state. Access to these records must itself be carefully restricted, given the sensitivity of subscriber identity and location information.
Mitigating Signaling Risks Across Mobile Infrastructure
Reducing the attack surface requires telecommunications operators to apply restrictive authorization policies throughout their interconnection infrastructure. SS7 signaling gateways should validate originating addresses, enforce operation-specific access controls, and reject requests that are inconsistent with established roaming relationships. Diameter infrastructure should use mutually authenticated transport connections alongside policies governing permitted applications, commands, subscriber populations, and network functions. Both environments benefit from stateful inspection that identifies unauthorized sequences of otherwise valid signaling transactions. Monitoring and auditing changes to routing configurations, interconnection agreements, and signaling security policies can also help detect conditions that might expose subscriber information or permit unauthorized operations.
The security of the underlying network elements deserves equal attention. HLRs, HSSs, MMEs, STPs, Diameter routing systems, and protocol interworking functions maintain or process highly sensitive information about subscriber identity, authentication, and mobility state. Compromise of these systems can provide an attacker with legitimate signaling access that circumvents protections focused solely on external interconnection traffic. Restricting administrative privileges, securing management interfaces, monitoring configuration changes, and protecting authentication credentials are necessary measures for limiting unauthorized access to these systems.
For organizations that do not operate telecommunications infrastructure, direct mitigation options are more limited. Enterprises cannot independently correct authorization weaknesses within a carrier’s SS7 or Diameter interconnection environment, but they can reduce the consequences of certain attacks. SMS-based multifactor authentication presents a particular concern, since intercepted text messages can expose one-time passwords and account recovery codes. Phishing-resistant methods such as FIDO2 security keys and passkeys reduce reliance on telephone-number-based authentication, removing an important opportunity for attackers who obtain access to SMS messages. End-to-end encrypted communication services can also reduce exposure of message contents to network-level interception, although they do not prevent signaling-based subscriber tracking, registration manipulation, or cellular service disruption.
The Continuing Security Problem Behind Mobile Connectivity
SS7 and Diameter illustrate a longstanding security problem within telecommunications infrastructure: the difference between trusting a connected network and authorizing the individual operations that network performs. SS7 inherited a security model developed for a relatively restricted signaling environment, and Diameter introduced stronger transport protections without eliminating the need for detailed application-layer authorization. The 5G core provides substantially improved security mechanisms, but its deployment exists alongside older systems and interconnection arrangements that continue to process sensitive subscriber information. The result is a collection of control-plane trust relationships that must be secured across multiple protocols, operators, and network generations.
The persistence of these vulnerabilities demonstrates why protecting mobile communications requires more than encrypted radio connections and secure subscriber devices. The signaling infrastructure determines where subscribers are registered, which networks receive authentication information, and how incoming communications are routed. A failure to validate those operations can expose sensitive information or disrupt service without any direct compromise of the handset. As telecommunications networks continue to support legacy signaling alongside newer 5G infrastructure, consistent authorization, stateful inspection, and cross-protocol monitoring remain central to protecting the systems responsible for connecting mobile subscribers.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Leave a Reply