As reported by BleepingComputer, the decades-old trust model underlying global mobile signaling protocols—SS7 (2G/3G) and Diameter (4G/5G)—continues to enable tracking, interception, and impersonation attacks without ever touching the victim's device. This is not a patchable vulnerability. It is a foundational architectural weakness, and that distinction matters enormously for how defenders prioritize their response.

Key Takeaway: As reported by BleepingComputer, the decades-old trust model underlying global mobile signaling protocols—SS7 (2G/3G) and Diameter (4G/5G)—continues to enable tracking, interception, and impersonation attacks without ever touching the victim's device.

Why Signaling Attacks Defy Traditional Security Controls

Most enterprise security programs are built around protecting endpoints, identities, and network perimeters. SS7 and Diameter attacks bypass all of them. The attacker operates from within the inter-carrier signaling backbone—sending messages that recipient networks treat as inherently trustworthy because the protocols were designed when only a handful of large operators could connect. There is no endpoint malware, no phishing link, no compromised credential. The victim's phone never knows anything happened.

This makes signaling attacks uniquely dangerous for organizations that rely on SMS-based one-time passcodes for second-factor authentication. If an attacker can intercept SMS delivery—and they demonstrably can—they can defeat MFA for banking, email, enterprise VPN, and cloud admin accounts. The attack surface is effectively any service that still trusts SMS as a bearer token.

Who Is Most Exposed

  • Financial institutions — OTP interception remains one of the most common signaling-based criminal use cases, enabling account takeover and fraud.
  • Government and defense personnel — Nation-state actors have used SS7 to geographically track individuals in conflict zones, as reportedly occurred with Iranian-linked surveillance of U.S. personnel.
  • High-net-worth individuals and executives — Commercial surveillance vendors have abused signaling access to target thousands of individuals across dozens of countries.
  • Any organization still using SMS as a primary second factor — This includes legacy VPN portals, cloud admin consoles, and SaaS applications with SMS-only MFA options.
SS7 has essentially no authentication for the machine making a request. Diameter supports stronger authentication on paper, but operators frequently don't deploy it. The trust model is the vulnerability.

The Hard Truth: You Cannot Patch This

Unlike a typical CVE, there is no vendor advisory, no patch Tuesday, and no version upgrade that fixes the core problem. Mitigation requires action at multiple layers: carriers deploying signaling firewalls and implementing the GSMA's SS7 and Diameter security guidelines, and organizations de-risking their own reliance on vulnerable channels.

Some carriers have begun deploying SS7 firewalls that filter anomalous signaling messages, but coverage is inconsistent globally and the protections vary by operator. Enterprise security teams cannot assume their carrier has this covered.

What You Should Do

Immediate Actions

  • Eliminate SMS-based MFA for all privileged and financial accounts. Move to TOTP authenticator apps (e.g., Microsoft Authenticator, Google Authenticator) or FIDO2 hardware keys. NIST has deprecated SMS for new authentication flows since SP 800-63B.
  • Conduct an inventory of all services that still allow or default to SMS OTP—especially VPN portals, admin consoles, banking interfaces, and password reset flows. Prioritize migration for anything with data or system access.
  • For government and defense organizations — Assume location privacy is compromised for personnel operating abroad. Implement operational security measures that account for potential location tracking, and restrict sensitive communications to end-to-end encrypted non-cellular channels.

Strategic Actions

  • Deploy mobile threat defense at the enterprise level that can detect anomalous SMS routing or unexpected location queries.
  • Engage your carrier on whether they implement SS7/Diameter signaling firewalls and the GSMA FS.07 and IR.70/IR.88 security guidelines. If they cannot answer, escalate.
  • Adopt phishing-resistant MFA as a formal standard across the organization. This addresses not only signaling interception but also the broader shift away from bearer-token authentication.

Broader Implications

SS7 and Diameter flaws represent a class of infrastructure-level trust failures that cannot be solved by end users. As long as global telecommunications relies on protocols that assume participant trust, attackers with network access—whether nation-states, commercial surveillance firms, or financially motivated criminals—will exploit that trust. The realistic mitigation for enterprises is not to fix the network but to stop depending on it for security-critical functions. SMS has been a broken second factor for years. Every day it remains in your authentication stack is a day you are accepting an unnecessary and well-understood risk.