Affected Systems

Global mobile infrastructure using SS7 (2G/3G) and Diameter (4G/5G) signaling protocols. Affects all mobile subscribers whose carriers rely on trust-based inter-carrier signaling without robust authentication. No specific vendor or version—architectural flaw in decades-old telecom protocols.

Exploitation Status

Actively exploited in the wild. Documented use by Iranian-linked actors to track US personnel, criminals intercepting SMS one-time passcodes for bank fraud, and commercial surveillance campaigns (Citizen Lab identified thousands of attacks across dozens of countries). Public demonstrations available (Veritasium, 60 Minutes).

Business Impact

Attackers with signaling network access can track subscriber locations in real time, intercept SMS-based two-factor authentication codes, redirect calls and texts, impersonate subscribers, and disrupt service—all without device compromise or user interaction. Traditional carrier signaling firewalls and velocity checks are insufficient; attackers rotate through plausible operator identities to bypass location-based defenses. High risk for organizations relying on SMS-based MFA, executive protection programs, and mobile workforce security. No CVE assigned; this is a protocol design issue, not a patchable software vulnerability.

Urgency

🟡 Within a week

Recommended Actions

  • Migrate from SMS-based two-factor authentication to app-based TOTP (Google Authenticator, Authy) or hardware tokens (YubiKey, FIDO2) for all critical accounts and enterprise authentication.
  • Evaluate mobile carriers for signaling attack defenses: confirm deployment of SS7 and Diameter firewalls with coordinated monitoring, IMSI rotation, and encryption for Diameter traffic.
  • For high-risk personnel (executives, government, field staff in sensitive regions), consider privacy-focused carriers that implement IMSI rotation and enhanced signaling protections.
  • Monitor for anomalous account activity indicative of SMS interception: unexpected password resets, failed MFA attempts, or account access from new locations without user travel.
  • Educate users that signaling attacks leave no device-side indicators; security awareness should emphasize non-SMS authentication methods and reporting of suspicious account behavior.