State Actors Exploit Telecom Protocols to Intercept Calls and SMS at Network Level
Written by AI from the linked story. Not reviewed by an editor. How this works
SilentAir and Liminal Panda demonstrate that state-level threat actors are actively compromising mobile operator infrastructure by exploiting legacy signaling protocols — SS7, Diameter, and GTP — that were designed for trust-based interconnect environments, not adversarial ones. By hijacking network nodes and leveraging the IPX interconnect network, attackers can silently intercept calls and SMS messages without touching end-user devices, making detection extremely difficult. These protocols were built decades ago with the assumption that only legitimate carriers would participate, leaving them fundamentally vulnerable to abuse by any actor who can reach the network layer. The scale of harm is significant: targeted subscribers have no visibility into the interception, and sensitive communications including authentication codes transmitted via SMS are exposed. This incident underscores why telecom infrastructure must be treated as critical national security infrastructure with rigorous access controls and monitoring.
Tactical Insight
Immediate actions
- Deploy SS7 and Diameter firewalls with anomaly detection rules to block unauthorized location tracking and call interception commands from unexpected network peers.
- Audit all IPX and roaming partner connections to verify that only trusted, authenticated network nodes can send signaling messages into the core network.
- Restrict GTP traffic at network boundaries so that only known, authorized GGSN/SGW endpoints can establish tunnels.
Long-term improvements
- Migrate SMS-based authentication (OTP) to app-based or hardware token MFA to reduce the value of intercepted SMS messages.
- Implement zero-trust principles for inter-carrier interconnects, requiring mutual authentication and strict allowlisting of signaling message types.
- Engage in threat intelligence sharing through telecom industry bodies (e.g., GSMA) to receive early warning of signaling abuse patterns.
Detection measures
- Deploy continuous signaling traffic monitoring with behavioral baselines to detect anomalous SS7/Diameter message flows indicative of subscriber tracking or interception.
- Establish a dedicated telecom security operations capability with alerting on unusual roaming queries, MAP SRI requests, and GTP tunnel creation from unexpected sources.
- Conduct regular third-party red team assessments of signaling infrastructure to identify exploitable paths before attackers do.