SilentAir hijacks Asian telecom links to intercept SMS login codes
The operation's high share of interception points to a rising threat to two-factor authentication on mobile networks in the region.
Stockholm-based telecom security firm Enea has named a previously unknown spying operation SilentAir, which it traced to hijacked equipment inside mobile operators across at least six Asian countries. The group abused the SS7 and Diameter signaling used between carriers, sending location-update messages that tricked home networks into rerouting a target's calls and texts, and in some cases it intercepted two-factor login codes right after a diversion took effect. Interception made up 18.3% of its observed activity, far above the 2.1% seen for typical surveillance vendors. Enea rates SilentAir as state-level with high confidence but ties it to China only with low confidence, and says the operation has been disrupted for now though it could return.
Why it matters
For users of SMS-based two-factor login, the finding means a text message code can be read by someone who has taken over equipment inside a carrier, not only by someone who has the phone. Carriers in the affected region are the parties with the most direct responsibility for closing these paths, since the attack relied on signaling messages trusted between operators. Enea's assessment that the operation is state-level but only weakly tied to China means attribution remains uncertain. The group is currently disrupted but could resume, so the exposure has not been eliminated.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.