How SS7 and Diameter Attacks Can Expose Your Phone

Weaknesses in SS7 and Diameter, the signaling protocols mobile carriers use to route calls, texts and data, can let attackers track phones, intercept communications or impersonate subscribers without accessing their devices.

SS7 dates to the 1970s and is used in 2G and 3G networks. Diameter is its successor, used in 4G and most 5G networks. Both protocols rely on trust between operators. SS7 has essentially no way to authenticate the machine making a request, while Diameter’s stronger authentication is not always deployed. Attackers with access to the signaling backbone, through a commercial arrangement or a compromised operator, can send messages that other carriers may treat as legitimate.

Those messages can request a subscriber’s International Mobile Subscriber Identity (IMSI), claim the subscriber is roaming to redirect calls and texts, or block service. Intercepted SMS codes can then be used alongside stolen login credentials. Signaling attacks happen in the carrier network and do not require malware or access to the target phone.

Carrier firewalls check routing and may reject implausible location changes, but their location data can be hours old. At a Wireless Security conference in 2025, Cape reported that Diameter updates from a visited network could arrive as infrequently as every two to ten hours. It also said subscribers in the US and Germany could reach more than 250 distinct networks within an hour of travel. Citizen Lab described an actor it calls STA1 rotating among eleven operator identities in nine countries to make tracking requests look like legitimate roaming traffic.

Cape, a privacy-focused mobile carrier, says its service is designed to defend against signaling attacks. The source describes the company’s claims; it does not independently evaluate the service.