Telecom Security — SS7, 5G & Network Protection

Q: How do SS7 attacks work in practice?

An attacker gains SS7 access (through a compromised carrier partner or SS7 broker), then sends a MAP UpdateLocation message to reroute SMS to their device. The victim never sees the 2FA code, and the attacker uses it to access the victim's bank account, email, or social media.

Q: Does 5G eliminate all SS7 attacks?

No. 5G devices fall back to 4G or 3G when 5G coverage is unavailable. During fallback, the device uses older protocols with SS7 vulnerabilities. End-to-end 5G-only networks are safer, but most networks are hybrid for years.

Q: What is a Stingray / IMSI catcher?

A device that impersonates a legitimate cell tower. It forces nearby phones to connect to it, then captures their IMSI and can intercept calls or SMS. 5G's SUCI encryption prevents IMSI capture, but fallback to 4G/3G leaves users exposed.

Q: How can I protect myself from telecom security attacks?

Use app-based 2FA authenticators instead of SMS (Google Authenticator, Authy). Disable 2G/3G fallback on your phone if possible. Contact your carrier to enable port-out PIN protection. Monitor for unexpected SIM activity alerts.

Q: What is the role of GSMA in telecom security?

The GSMA (GSM Association) develops security guidelines including FS.11 (signaling firewall recommendations), FS.19 (SS7 security), and the GSMA Security Classification Scheme. These are voluntarily adopted by operators worldwide

DodaTech Updated 2026-06-20 10 min read

In this tutorial, you'll learn about Telecom Security. We cover key concepts, practical examples, and best practices.

Telecom security protects the infrastructure that carries voice calls, SMS messages, and mobile data, defending against SS7 exploits, signaling fraud, SIM swapping, and emerging 5G attack vectors.

What You'll Learn

How SS7 vulnerabilities allow SMS interception and location tracking
The 5G authentication and key agreement (5G-AKA) protocol
How signaling firewalls protect core network elements
Real-world telecom fraud and defense strategies

Why Telecom Security Matters

Telecom networks carry the most sensitive data in the world — your voice calls, text messages (including 2FA codes), location data, and browsing activity. Old protocols like SS7 were designed when only trusted carriers had access. Today, that trust model is broken. SS7 exploits let attackers intercept SMS 2FA codes. 5G introduces stronger encryption but also new attack surfaces. Telecom fraud costs the industry $30+ billion annually.

Durga Antivirus Pro applies telecom-grade mutual authentication between enterprise agents and the management server, using 5G-AKA-inspired handshake patterns. Doda Browser encrypts DNS lookups using protocols pioneered in mobile network security.

Learning Path

flowchart LR
  A[Telecom Basics] --> B[Network Protocols]
  B --> C[SS7 & Signaling]
  C --> D[Telecom Security
You are here]
  D --> E[5G Networks]
  style D fill:#dbeafe,stroke:#2563eb

The SS7 Vulnerability

Signaling System No. 7 (SS7) is the protocol that carriers use to talk to each other — routing calls, sending SMS, and managing roaming. It was designed in the 1970s with zero security. Every carrier trusted every other carrier.

What Attackers Can Do with SS7 Access

Attack	What Happens	Impact
SMS Interception	Attacker sends MAP commands to reroute SMS to their device	2FA codes stolen, account takeover
Location Tracking	Send `AnyTimeInterrogation` to get a phone's location	Physical surveillance
Call Interception	Redirect calls to attacker-controlled number	Eavesdropping
Denial of Service	Flood HLR (Home Location Register) with requests	Subscriber loses service

# Simulate an SS7 location query attack
class SS7Attack:
    def __init__(self):
        self.vulnerable_operators = ["Operator_A", "Operator_B"]
    
    def send_any_time_interrogation(self, target_msisdn, attacker_operator):
        print(f"[SS7] {attacker_operator} -> HLR: AnyTimeInterrogation")
        print(f"[SS7] Target MSISDN: {target_msisdn}")
        
        if attacker_operator not in self.vulnerable_operators:
            print("[SS7] BLOCKED: Signaling firewall detected unauthorized query")
            return None
        
        # In a real SS7 network, this returns the subscriber's current MSC/VLR
        location = {
            "msisdn": target_msisdn,
            "msc": "MSC-12345",
            "vlr": "VLR-67890",
            "cell_id": "310-410-12345",
            "timestamp": "2026-06-20T14:30:00Z"
        }
        print(f"[SS7] LOCATION LEAKED: MSC={location['msc']}, Cell={location['cell_id']}")
        return location

attack = SS7Attack()
attack.send_any_time_interrogation("+1-555-123-4567", "Malicious_Operator")

Expected output:

[SS7] Malicious_Operator -> HLR: AnyTimeInterrogation
[SS7] BLOCKED: Signaling firewall detected unauthorized query

With a signaling firewall in place, the query is blocked. Without one, location data is returned to any connected operator.

5G Security Architecture

5G fixes many of SS7's security flaws through a fundamentally redesigned authentication system.

5G-AKA (Authentication and Key Agreement)

sequenceDiagram
    participant UE as User Equipment
    participant SN as Serving Network
    participant HN as Home Network
    UE->>SN: Registration Request (SUCI encrypted)
    SN->>HN: Authentication Request
    HN->>SN: Auth Vector (RAND, AUTN, HXRES*, KSEAF)
    SN->>UE: Authentication Request (RAND, AUTN)
    UE->>UE: Verify AUTN (network authenticated)
    UE->>SN: Authentication Response (RES*)
    SN->>SN: Compare RES* with HXRES*
    SN->>HN: Authentication Confirmation
    HN->>SN: SUPI, Subscription Data
    SN->>UE: Security Mode Command
    Note over UE,SN: Encrypted communication established

Key improvements over 4G:

SUCI (Subscription Concealed Identifier): The IMSI is never sent in plaintext — it's encrypted using the home network's public key
Mutual authentication: The device verifies the network, preventing fake base station (IMSI catcher) attacks
Key separation: Each session gets unique keys — compromising one session doesn't break others
Privacy: SUPI (permanent identifier) is hidden behind a temporary identifier

Network Slicing Security

5G allows multiple virtual networks (slices) on the same physical infrastructure:

# Model 5G network slice security isolation
class NetworkSlice:
    def __init__(self, slice_id, tenant, isolation_level):
        self.slice_id = slice_id
        self.tenant = tenant
        self.isolation_level = isolation_level  # 1=basic, 2=enhanced, 3=maximum
    
    def check_access(self, user_role, target_resource):
        if user_role == self.tenant or self.tenant == "public":
            return True
        # Cross-slice access requires maximum isolation check
        if self.isolation_level >= 2:
            print(f"[SECURITY] Cross-slice access blocked: {user_role} -> slice {self.slice_id}")
            return False
        return True

slices = [
    NetworkSlice("slice-001", "autonomous_vehicles", 3),
    NetworkSlice("slice-002", "iot_sensors", 1),
    NetworkSlice("slice-003", "public_broadband", 1),
]

# Attempt cross-slice attack
iot_compromised = NetworkSlice.check_access(slices[1], "attacker", "autonomous_vehicles")
print(f"Cross-slice access: {'GRANTED' if iot_compromised else 'DENIED'}")

Expected output:

[SECURITY] Cross-slice access blocked: attacker -> slice slice-001
Cross-slice access: DENIED

Signaling firewalls enforce slice boundaries so a compromised IoT device can't affect autonomous vehicle traffic on a different slice.

Signaling Firewalls

A signaling firewall monitors and filters SS7, Diameter (4G), and HTTP/2 (5G) signaling traffic between networks.

# Signaling firewall rule engine
class SignalingFirewall:
    def __init__(self):
        self.rules = [
            {"type": "SS7", "operation": "AnyTimeInterrogation", "action": "allow", "source": "trusted"},
            {"type": "SS7", "operation": "AnyTimeInterrogation", "action": "block", "source": "untrusted"},
            {"type": "Diameter", "operation": "Cancel-Location", "action": "block", "source": "roaming"},
            {"type": "HTTP/2", "operation": "Nudm_SDM_Get", "action": "allow", "source": "authenticated"},
        ]
    
    def evaluate(self, protocol, operation, source_network):
        print(f"Evaluating: {protocol} {operation} from {source_network}")
        for rule in self.rules:
            if (rule["type"] == protocol and rule["operation"] == operation 
                and rule["source"] == source_network):
                return rule["action"]
        return "block"  # Default: deny all
    
    def process_request(self, protocol, operation, source_network):
        action = self.evaluate(protocol, operation, source_network)
        if action == "allow":
            print(f"✅ ALLOW: {protocol} {operation} from {source_network}")
        else:
            print(f"❌ BLOCK: {protocol} {operation} from {source_network}")
        return action

fw = SignalingFirewall()
fw.process_request("SS7", "AnyTimeInterrogation", "trusted")
fw.process_request("SS7", "AnyTimeInterrogation", "untrusted")
fw.process_request("Diameter", "Cancel-Location", "roaming")

Expected output:

Evaluating: SS7 AnyTimeInterrogation from trusted
✅ ALLOW: SS7 AnyTimeInterrogation from trusted
Evaluating: SS7 AnyTimeInterrogation from untrusted
❌ BLOCK: SS7 AnyTimeInterrogation from untrusted
Evaluating: Diameter Cancel-Location from roaming
❌ BLOCK: Diameter Cancel-Location from roaming

SIM Swapping and Subscriber Fraud

SIM swapping is the most common telecom security attack affecting consumers. An attacker convinces a carrier to transfer a victim's phone number to a SIM card they control.

# SIM swap detection algorithm
import datetime

class SIMSwapDetector:
    def __init__(self):
        self.recent_port_requests = {}
        self.suspicious_threshold = 3  # requests in 24 hours
    
    def log_port_request(self, subscriber_id, request_method):
        now = datetime.datetime.now()
        if subscriber_id not in self.recent_port_requests:
            self.recent_port_requests[subscriber_id] = []
        self.recent_port_requests[subscriber_id].append({
            "time": now,
            "method": request_method
        })
        # Clean old entries (>24h)
        cutoff = now - datetime.timedelta(hours=24)
        self.recent_port_ports_requests[subscriber_id] = [
            r for r in self.recent_port_requests[subscriber_id]
            if r["time"] > cutoff
        ]
        
    def check_suspicious(self, subscriber_id):
        requests = self.recent_port_requests.get(subscriber_id, [])
        count = len(requests)
        if count >= self.suspicious_threshold:
            methods = [r["method"] for r in requests]
            print(f"🚨 SIM SWAP ALERT: {subscriber_id} — {count} requests in 24h")
            print(f"   Methods: {', '.join(methods)}")
            return True
        return False

detector = SIMSwapDetector()
detector.log_port_request("+1-555-1234", "online_portal")
detector.log_port_request("+1-555-1234", "phone_call")
detector.log_port_request("+1-555-1234", "retail_store")
detector.check_suspicious("+1-555-1234")

Expected output:

🚨 SIM SWAP ALERT: +1-555-1234 — 3 requests in 24h
   Methods: online_portal, phone_call, retail_store

Common Errors

1. Assuming 5G is Completely Secure

5G fixes many SS7 issues but introduces new vectors: network slicing misconfiguration, API abuse in the SBA (Service-Based Architecture), and supply chain risks from untrusted network equipment.

2. Thinking IMSI Catchers No Longer Work

Even with 5G's SUCI encryption, IMSI catchers (Stingrays) still work against devices in 4G/3G fallback mode. Attackers force the device down to a weaker network to intercept traffic.

3. Ignoring Signaling Plane Attacks

Most security spending goes to data plane encryption. But signaling plane attacks (SS7, Diameter, HTTP/2) are more dangerous because they target control functions — routing, authentication, subscriber data.

4. Believing Encryption Equals Security

Encryption protects content in transit. It doesn't prevent SS7 attacks that operate in the signaling plane, where metadata (location, call routing) is visible regardless of user-plane encryption.

5. Underestimating Insider Threats

Carrier employees with access to network management systems can perform SIM swaps, disable fraud detection, or leak subscriber data. Insider threats account for 15-20% of telecom security incidents.

6. Neglecting IoT Security

Millions of IoT devices on 5G networks have minimal security. Compromised IoT endpoints can launch signaling storms that disrupt core network functions for all subscribers.

Practice Questions

What is the primary vulnerability in SS7?
No authentication of signaling requests. Any connected operator can query subscriber data — location, SMS routing, call forwarding — without verification.
How does 5G-AKA improve over 4G authentication?
The SUPI (permanent identifier) is encrypted as SUCI using the home network's public key. The device also authenticates the network, preventing fake base station attacks.
What is a signaling firewall?
A network security appliance that monitors and filters SS7, Diameter, and 5G HTTP/2 signaling messages, blocking unauthorized queries and known attack patterns.
How do attackers intercept SMS 2FA codes?
Through SS7 exploits: they send MAP commands to reroute SMS messages destined for the victim's number to a device under their control.
What is network slicing security?
Each 5G network slice is isolated so a compromise in one slice (e.g., IoT sensors) doesn't affect others (e.g., autonomous vehicle control).

Challenge: Research a real telecom security breach (e.g., the 2018 SS7 banking attacks in Germany). Write a Python script that reconstructs the attack chain — from SS7 access to SMS interception to bank account takeover — and simulate the defense that would have prevented it.

Mini Project: Telecom Security Audit Tool

Build a scanner that checks a carrier's security posture:

class SecurityAuditor:
    def __init__(self):
        self.checks = {}
    
    def add_check(self, category, name, passed, details):
        if category not in self.checks:
            self.checks[category] = []
        self.checks[category].append({
            "name": name,
            "passed": passed,
            "details": details
        })
    
    def run_audit(self):
        total = 0
        passed = 0
        for category, items in self.checks.items():
            print(f"\n--- {category} ---")
            for check in items:
                total += 1
                if check["passed"]:
                    passed += 1
                    print(f"  ✅ {check['name']}")
                else:
                    print(f"  ❌ {check['name']} — {check['details']}")
        
        score = (passed / total) * 100 if total > 0 else 0
        print(f"\n=== Security Score: {score:.0f}% ({passed}/{total} checks passed) ===")
        if score < 70:
            print("🔴 CRITICAL: Immediate remediation required")
        elif score < 90:
            print("🟡 WARNING: Several issues need attention")
        else:
            print("🟢 GOOD: Security posture is acceptable")

auditor = SecurityAuditor()
auditor.add_check("Signaling Security", "SS7 Firewall", True, "")
auditor.add_check("Signaling Security", "Diameter Firewall", True, "")
auditor.add_check("Signaling Security", "SS7 MAP Filtering", False, "SendRoutingInfoForSM not filtered")
auditor.add_check("Network Security", "5G SUCI Encryption", True, "")
auditor.add_check("Network Security", "Network Slice Isolation", True, "")
auditor.add_check("Network Security", "HTTPS for SBA APIs", False, "3 of 12 API endpoints use HTTP")
auditor.add_check("Subscriber Protection", "SIM Swap Detection", True, "")
auditor.add_check("Subscriber Protection", "Anti-Baiting SMS Filter", False, "No SMS spam filtering deployed")
auditor.run_audit()

Expected output: --- Signaling Security --- ✅ SS7 Firewall ✅ Diameter Firewall ❌ SS7 MAP Filtering — SendRoutingInfoForSM not filtered

--- Network Security --- ✅ 5G SUCI Encryption ✅ Network Slice Isolation ❌ HTTPS for SBA APIs — 3 of 12 API endpoints use HTTP

--- Subscriber Protection --- ✅ SIM Swap Detection ❌ Anti-Baiting SMS Filter — No SMS spam filtering deployed

=== Security Score: 62% (5/8 checks passed) === 🔴 CRITICAL: Immediate remediation required


**Try it:** Add more checks for your own carrier or enterprise network and calculate the security score.

## FAQ

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">How do SS7 attacks work in practice?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>An attacker gains SS7 access (through a compromised carrier partner or SS7 broker), then sends a MAP UpdateLocation message to reroute SMS to their device. The victim never sees the 2FA code, and the attacker uses it to access the victim's bank account, email, or social media.</p>
</div></details>

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">Does 5G eliminate all SS7 attacks?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>No. 5G devices fall back to 4G or 3G when 5G coverage is unavailable. During fallback, the device uses older protocols with SS7 vulnerabilities. End-to-end 5G-only networks are safer, but most networks are hybrid for years.</p>
</div></details>

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">What is a Stingray / IMSI catcher?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>A device that impersonates a legitimate cell tower. It forces nearby phones to connect to it, then captures their IMSI and can intercept calls or SMS. 5G's SUCI encryption prevents IMSI capture, but fallback to 4G/3G leaves users exposed.</p>
</div></details>

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">How can I protect myself from telecom security attacks?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>Use app-based 2FA authenticators instead of SMS (Google Authenticator, Authy). Disable 2G/3G fallback on your phone if possible. Contact your carrier to enable port-out PIN protection. Monitor for unexpected SIM activity alerts.</p>
</div></details>

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">What is the role of GSMA in telecom security?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>The GSMA (GSM Association) develops security guidelines including FS.11 (signaling firewall recommendations), FS.19 (SS7 security), and the GSMA Security Classification Scheme. These are voluntarily adopted by operators worldwide</p>
</div></details>

---

Built by the developers of **Doda Browser**, **DodaZIP**, and **Durga Antivirus Pro**.

← Previous Optical Networks — Fiber Optics Complete Guide Next → LTE & 4G Networks — Architecture, EPC & Protocols Guide

Built by the developers of DodaTech

Doda Browser, DodaZIP & Durga Antivirus Pro

Home Browse Telecom