Signaling System 7 (SS7)

What SS7 Is and Why It Exists

Signalling System 7, or SS7, is the control layer that lets public switched telephone networks establish calls, route messages and manage network services without mixing those instructions into the voice stream itself. That separation made telephony signalling scalable and interoperable, but it also created a trusted control plane that can be abused when access is too broad or signalling validation is weak.

SS7 matters because it is part of the hidden machinery of telecom. Call setup, roaming, number translation, SMS delivery and network service coordination can all depend on it, so compromise does not usually look like a classic endpoint intrusion. Instead, an attacker who can influence signalling can manipulate how the network handles a subscriber’s traffic.

For a practical overview of the protocol’s security context, the SS7 and Diameter Signalling Security Guide is the most direct starting point for understanding the attack surface and defensive controls.

How SS7 Weaknesses Are Abused

Weaknesses in SS7 are dangerous because signalling messages can be used to influence where traffic goes, what a network believes about a subscriber, and whether messages are delivered or intercepted. When carriers or interconnect partners do not strictly restrict who can send signalling requests, an adversary may be able to trigger location lookups, redirect SMS traffic, or interfere with call handling.

This is why SS7 risk is not just about “telecom insecurity” in the abstract. It is about trust in inter-network messages that were designed for a smaller, more closed ecosystem. Once that trust is overextended across modern roaming, wholesale interconnects and third-party signalling paths, the network can expose subscribers to interception and tracking even if the victim never interacts with the attacker directly.

The Telecom Network Security Guide provides broader defensive context for SS7, Diameter and adjacent telecom controls, including signalling firewalls and hardening patterns.

SS7, SMS, and Authentication Friction

SS7 is especially relevant where organisations still rely on SMS for one-time codes or account recovery. If signalling abuse can redirect or intercept messages, the weakness can become an authentication problem, not just a telecom problem. That makes SS7 relevant to fraud, account takeover and session compromise wherever SMS remains a trust anchor.

In practice, the protocol’s security issue becomes more visible when attackers use telecom weaknesses to defeat weak identity recovery flows or collect verification codes. The operational lesson is that SMS should not be treated as a strong recovery factor when the underlying delivery path can be influenced through signalling abuse.

The same class of risk shows up in real-world SMS phishing and OTP abuse campaigns, such as the Twilio 0ktapus breach 2022, which illustrates how stolen or redirected SMS-based credentials can amplify downstream compromise.

Operational Defences and Safer Design Choices

Defence against SS7 abuse starts with treating signalling as a controlled trust boundary rather than an implicitly trusted carrier function. That means limiting which partners can query or modify subscriber-related signalling data, watching for abnormal signalling patterns, and using network-layer controls such as signalling firewalls and interconnect filtering to reduce exposure.

Organisations should also reduce dependence on SMS for sensitive authentication and recovery workflows where feasible. If the business still uses SMS, the telecom path, the identity flow and the fraud-detection logic should be reviewed together, because the weakness is often the combination of signalling trust and weak downstream reliance on text-message delivery.

Because SS7 is part of a wider telecom control environment, the right response is not a single patch but a layered hardening posture: inventory interconnects, validate signalling exposure, and align telecom security with identity and fraud controls that do not assume the message path is trustworthy by default.

Risk and Threat Considerations

SS7 exposure matters because weaknesses in signalling trust can be turned into subscriber surveillance, message interception and traffic redirection. The danger is highest where carriers, roaming partners or downstream services allow more signalling access than the business actually needs.

Failure mechanism: An attacker abuses trusted signalling relationships to query location, reroute SMS, or influence call handling without needing traditional network compromise.

Impact: Organisations can face covert interception of one-time codes, privacy loss through location tracking, and account takeover when SMS-based authentication depends on a compromised delivery path.

Practitioner Guidance

What to watch for: Treat SS7 as a governance and architecture issue as much as a transport issue. The strongest operational improvement usually comes from reducing the number of places where external signalling is trusted, then validating that fraud, identity and telecom teams are looking at the same exposure.

Practitioner takeaway: If an organisation still relies on SMS for authentication or recovery, SS7 risk belongs in the same review as telecom interconnect security and account takeover controls, not in a separate silo.

Related resources from NHI Mgmt Group

• When should organisations treat an AI agent as a privileged system?
• When should organisations treat an AI system as a non-human identity?
• What is the difference between agent skills and a large system prompt?
• When should organisations restrict an AI system from taking direct action?