Phone Signaling Flaws in SS7 and Diameter Expose Subscribers to Tracking and Code Theft
Because carriers trust each other by default, attackers can read location and intercept one-time codes without ever touching the handset.
A BleepingComputer explainer describes how attacks on the SS7 and Diameter telecom signaling protocols can locate phones, intercept SMS two-factor codes, and impersonate subscribers without touching the device. The protocols were built on implicit trust between operators, and the article says carrier firewalls often rely on location data that can be hours old, letting attackers rotate through many operator identities to pass as legitimate roaming traffic. Citizen Lab documented one actor cycling through eleven operator identities across nine countries, and the piece cites Cape's research finding that some Diameter updates arrived only every two to ten hours. The overall message is that these weaknesses are long-standing, have been exploited in both criminal and surveillance campaigns, and are difficult for most carriers to fully prevent.
Why it matters
For people who rely on SMS codes, the weakness means a second factor sent by text can be intercepted, and the attack needs nothing from the phone itself. For carriers, the problem is structural: the protocols assume trust that no longer holds, and fixing one operator's firewall does not close the gap across the roaming network. The episodes described, including one actor moving through eleven operator identities in nine countries, show that the exposure is already being used in both criminal and surveillance activity. Subscribers and the people who protect them should treat SMS as a weaker factor than it appears.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.