Hackers Exploit SS7 and Diameter to Track Mobile Users

What Happened

A significant investigation by Citizen Lab has uncovered that sophisticated threat actors are exploiting vulnerabilities in global mobile networks to track users worldwide. By abusing the legacy 3G SS7 and 4G Diameter signaling protocols, these hackers are bypassing telecom firewalls, enabling them to conduct silent, cross-border espionage. The research identified two distinct surveillance threat actors, referred to as STA1 and STA2, who are executing long-running espionage campaigns.

The Threat

These global attacks exploit structural weaknesses in international mobile communications. The older SS7 protocol lacks basic authentication, while the newer Diameter protocol suffers from weak security implementations across the industry. Attackers utilize combined attach procedures, allowing roaming devices to register with both 3G and 4G networks, facilitating seamless protocol pivoting.

Who's Behind It

• STA1 focuses on aggressive network routing manipulation, spoofing legitimate operator hostnames and abusing third-party access points.
• STA2 employs a more invasive strategy, combining network protocol queries with a silent exploit targeting the device itself.

Tactics & Techniques

STA1: Network Spoofer

STA1 conducts tracking attacks primarily through signaling routing manipulation. They rapidly switch between SS7 and Diameter protocols to exploit vulnerabilities in telecom firewalls. By spoofing network data, they blend malicious requests with legitimate operator traffic, effectively evading detection.

STA2: SIM Exploiter

In contrast, STA2 uses a zero-click binary SMS payload as its primary attack vector. This actor's strategy includes SS7 network probing and malicious SIM Toolkit commands to extract location data directly from the target's device. Their evasion tactics exploit silent, low-priority push messages that do not trigger phone alerts, keeping victims unaware of the surveillance.

Defensive Measures

The ongoing surveillance crisis highlights a major blind spot in the global telecommunications industry. Mobile operators depend on third-party interconnect routing hubs with weak traffic screening. Until the industry abandons legacy peer-to-peer trust models and enforces strict cryptographic authentication, mobile users worldwide will remain vulnerable to unseen tracking. It is crucial for telecom providers to enhance their security measures and for users to be aware of potential tracking risks.