SS7 Attack.

Abuse of Signalling System No. 7 inter-carrier messages to locate subscribers, intercept SMS or divert calls anywhere in the world. It belongs to the Attacks & Threats category of cybersecurity.

Abuse of Signalling System No. 7 inter-carrier messages to locate subscribers, intercept SMS or divert calls anywhere in the world.

Signalling System No. 7 (SS7) is the legacy out-of-band signalling protocol that international carriers use to set up calls, deliver SMS, roam, and route lawful intercepts. The trust model assumes that only licensed carriers can send MAP messages, but the GSMA noted leaks for years and Tobias Engel publicly demonstrated tracking and call-interception attacks at the Chaos Communication Congress in December 2014. With access to an SS7 endpoint (purchased, leased or pirated), an attacker can send AnyTimeInterrogation, SendRoutingInfoForSM or UpdateLocation messages to locate a subscriber, intercept SMS-based 2FA codes, redirect calls, or trigger denial of service. Real-world bank thefts using SS7 SMS interception have been reported in Germany and the UK. Mitigations include SS7 firewalls, GSMA FS.07/FS.11 monitoring, signed Diameter peering in 4G and end-to-end auth apps instead of SMS OTP.

Defences for SS7 Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: SS7 abuse, Signaling System 7 attack.