Understanding SS7: How It Works, Technical Details, and Security Risks Explained

---

Signaling System No. 7 (SS7) is a set of telephony signaling protocols developed in the 1970s by the International Telecommunication Union (ITU) to facilitate communication between telecommunication networks. It is a critical component of the global telecommunications infrastructure, enabling functionalities such as call setup, routing, billing, and mobility management. SS7 operates at the signaling layer, separate from the voice and data channels, and is used primarily in Public Switched Telephone Networks (PSTNs) and mobile networks like GSM and UMTS.

SS7 is a robust and scalable protocol suite that has been the backbone of telecommunications for decades. However, its age and inherent design assumptions—particularly the trust-based model of interconnected networks—have exposed vulnerabilities that pose significant security risks in modern contexts.

How SS7 Works?

Architecture and Components

SS7 is a layered protocol stack based on the Open Systems Interconnection (OSI) model, with its primary layers handling signaling, routing, and service-specific functions. The key components of an SS7 network include:

1. Signaling Points (SPs):

   • Service Switching Point (SSP): A switch that originates or terminates calls, such as a telephone exchange.

   • Signal Transfer Point (STP): A router that relays SS7 messages between SPs.

   • Service Control Point (SCP): A database that provides additional service logic, such as number translation or billing information.

2. Signaling Links:

   • These are dedicated channels (e.g., 56 or 64 kbps links) that carry SS7 messages between nodes. Links can be point-to-point or use redundant configurations for reliability.

3. Protocol Stack: SS7 uses a modular protocol stack with the following key layers:

   • Message Transfer Part (MTP): Provides reliable message delivery and routing (Layers 1–3).

     • MTP Level 1: Physical layer (e.g., DS0 channels).

     • MTP Level 2: Data link layer, ensuring error-free transmission.

     • MTP Level 3: Network layer, handling routing and network management.

   • Signaling Connection Control Part (SCCP): Enhances MTP with advanced addressing and routing capabilities, including Global Title Translation (GTT).

   • Transaction Capabilities Application Part (TCAP): Supports database queries and transactions, used for services like number portability.

   • ISDN User Part (ISUP): Manages call setup, maintenance, and teardown for circuit-switched calls.

   • Mobile Application Part (MAP): Specific to mobile networks, handling functions like subscriber location updates and SMS delivery.

   • Operations, Maintenance, and Administration Part (OMAP): Manages network operations and diagnostics.

Message Types and Addressing

SS7 messages are packet-based and consist of signaling units, including:

• Message Signal Unit (MSU): Carries signaling information (e.g., call setup or location updates).

• Link Status Signal Unit (LSSU): Monitors link status.

• Fill-In Signal Unit (FISU): Maintains link activity during idle periods.

Each SP is identified by a Point Code (PC), a unique address in the SS7 network. SCCP extends addressing with Global Titles (GTs), which are phone number-like identifiers (e.g., E.164 numbers) used for routing messages to specific services or subscribers.

Functionality

SS7 enables a wide range of telecommunications services by facilitating signaling between network elements. Key functions include:

1. Call Setup and Teardown:

   • ISUP messages manage the establishment and release of circuit-switched calls. For example, an Initial Address Message (IAM) initiates a call, while a Release Message (REL) terminates it.

2. Mobility Management:

   • In mobile networks, MAP handles subscriber location updates, roaming, and authentication. For instance, when a phone moves to a new location area, the Visitor Location Register (VLR) updates the Home Location Register (HLR) via SS7.

3. Short Message Service (SMS):

   • MAP messages facilitate SMS delivery by querying the HLR for the recipient’s location and routing the message to the appropriate Mobile Switching Center (MSC).

4. Number Portability:

   • TCAP queries enable Local Number Portability (LNP) by translating dialed numbers to their current network provider.

5. Billing and Charging:

   • SS7 supports real-time billing by exchanging call detail records (CDRs) between network operators.

Operational Workflow

When a call or service is initiated:

1. The originating SSP sends an SS7 message (e.g., IAM for a call) to an STP.

2. The STP routes the message to the destination SSP or SCP based on the Point Code or Global Title.

3. The receiving node processes the message and responds (e.g., with an Address Complete Message (ACM) for call setup).

4. For mobile services, MAP messages may query the HLR or VLR to locate the subscriber or authenticate the call.

This process occurs out-of-band, meaning signaling is separate from the voice path, allowing efficient and flexible network operations.

Risks and Vulnerabilities of SS7

SS7 was designed in an era when telecommunications networks were closed and operated by trusted entities. Its trust-based model assumes that all network nodes are legitimate, which is no longer valid in today’s interconnected and privatized telecom landscape. The protocol’s vulnerabilities have been exploited for surveillance, fraud, and privacy breaches. Key risks include:

1. Lack of Authentication and Encryption

• Issue: SS7 messages are sent in plaintext and lack robust authentication mechanisms. Any entity with access to the SS7 network can send messages impersonating a legitimate node.

• Impact: Attackers can intercept calls, SMS messages, or location data without detection.

• Example: In 2014, researchers demonstrated how SS7 vulnerabilities allowed tracking a user’s location by sending fraudulent MAP queries to the HLR.

2. Unauthorized Network Access

• Issue: The proliferation of private telecom operators and interconnect agreements has increased the number of entities with SS7 access. Malicious actors can gain access through compromised or rogue operators.

• Impact: Attackers can exploit SS7 to perform actions like rerouting calls, intercepting two-factor authentication (2FA) codes, or launching denial-of-service (DoS) attacks.

• Example: In 2017, German banks reported SS7-based attacks where attackers intercepted SMS-based 2FA codes to drain bank accounts.

3. Subscriber Tracking and Surveillance

• Issue: MAP messages, such as ProvideSubscriberLocation or AnyTimeInterrogation, can be abused to track a subscriber’s location or retrieve call metadata.

• Impact: Governments, hackers, or rogue operators can conduct mass surveillance or target individuals without their knowledge.

• Example: Reports have indicated that state-sponsored actors use SS7 to monitor dissidents or journalists by querying their location data.

4. Call and SMS Interception

• Issue: Attackers can manipulate call routing (e.g., using UpdateLocation messages) to redirect calls or SMS to malicious destinations.

• Impact: This enables eavesdropping, phishing, or bypassing security measures like 2FA.

• Example: A 2016 demonstration showed how attackers could intercept WhatsApp verification codes by exploiting SS7.

5. Denial-of-Service (DoS) Attacks

• Issue: Attackers can flood SS7 nodes with invalid messages, disrupting signaling and causing service outages.

• Impact: This can disable critical services like emergency calls or mobile connectivity for entire regions.

6. Financial Fraud

• Issue: SS7 vulnerabilities allow attackers to manipulate billing systems or reroute premium-rate calls to generate revenue.

• Impact: Telecom operators and subscribers face financial losses due to fraudulent activities.

Why SS7 cannot be done away with?

SS7 (Signaling System No. 7) cannot be easily eliminated due to its entrenched role in global telecommunications infrastructure and the complexities of transitioning to alternatives. Below are the key reasons why SS7 remains indispensable, despite its vulnerabilities:

1. Widespread Legacy Infrastructure:
   SS7 is deeply embedded in the Public Switched Telephone Network (PSTN) and 2G/3G mobile networks, which are still operational in many parts of the world. Billions of devices and network elements, including switches, base stations, and billing systems, rely on SS7 for core functions like call setup, SMS delivery, and roaming. Replacing this infrastructure globally would require massive investment and coordination among thousands of telecom operators.

2. Interoperability with Modern Networks:
   Even in 4G and 5G networks, SS7 is used for interoperability with legacy systems. For example, circuit-switched fallback (CSFB) in 4G relies on SS7 to handle voice calls, and SMS delivery often uses SS7-based Mobile Application Part (MAP) messaging. This ensures seamless communication between older and newer networks, especially in regions with mixed network generations.

3. Global Standardization and Ubiquity:
   SS7 is a globally standardized protocol, enabling interconnection between diverse telecom operators across countries. Its universal adoption makes it critical for international roaming, number portability, and cross-network services. Alternative protocols like Diameter (used in 4G/5G) are not yet universally implemented, and they lack the same level of global compatibility with legacy systems.

4. Cost and Complexity of Transition:
   Transitioning to modern protocols like Diameter or SIP (Session Initiation Protocol) requires significant upgrades to hardware, software, and network configurations. Many operators, especially in developing regions, lack the resources to replace SS7 infrastructure. Additionally, a phased transition would create compatibility challenges, as networks must continue supporting SS7 to avoid service disruptions.

5. Critical Service Dependency:
   SS7 supports essential services like emergency call routing, billing, and fraud detection, which are tightly integrated into operator systems. Replacing SS7 would require redesigning these services, testing new protocols, and ensuring reliability at scale — tasks that are both time-consuming and risky.

6. Lack of a Comprehensive Alternative:
   While Diameter and SIP address some of SS7’s security flaws, they are not drop-in replacements. Diameter, for instance, is designed for IP-based networks and does not fully support legacy PSTN functions. Moreover, Diameter has its own vulnerabilities, and its deployment is not yet universal. A complete replacement would require a new protocol that matches SS7’s versatility and global reach, which does not currently exist.

7. Regulatory and Operational Inertia:
   Telecom regulations and interconnect agreements often assume SS7 as the standard for signaling. Changing these frameworks requires international coordination through bodies like the ITU and GSMA. Additionally, many operators prioritize short-term cost savings over long-term security upgrades, slowing the adoption of alternatives.

Mitigation over Replacement

Given these challenges, the industry focuses on mitigating SS7 vulnerabilities rather than phasing it out entirely. Strategies include deploying SS7 firewalls, using SIGTRAN with encryption (e.g., TLS), and implementing stricter access controls. These measures aim to secure SS7 while maintaining its critical role in global telecommunications.

Mitigation Strategies

Addressing SS7 vulnerabilities requires a combination of technical, regulatory, and operational measures:

1. Firewalls and Intrusion Detection:

   • Deploy SS7 firewalls to filter unauthorized messages and detect anomalies. For example, firewalls can block messages from unrecognized Point Codes or invalid Global Titles.

   • Implement intrusion detection systems (IDS) to monitor SS7 traffic for suspicious patterns.

2. Encryption and Authentication:

   • While SS7 itself lacks encryption, operators can use IP-based signaling (e.g., SIGTRAN) with Transport Layer Security (TLS) to secure message transport.

   • Introduce mutual authentication for SS7 nodes to prevent impersonation.

3. Access Control:

   • Limit SS7 network access to trusted operators and enforce strict interconnect agreements.

   • Regularly audit SS7 access points to identify compromised or rogue nodes.

4. Protocol Upgrades:

   • Transition to modern protocols like Diameter (used in 4G/5G networks), which includes improved security features like encryption and authentication.

   • However, Diameter also has vulnerabilities, so it must be implemented with robust security measures.

5. Regulatory Oversight:

   • Governments and telecom regulators should enforce security standards for SS7 networks and penalize operators that fail to comply.

   • International cooperation is essential to address cross-border SS7 attacks.

6. End-User Protections:

   • Encourage the use of end-to-end encrypted apps (e.g., Signal, WhatsApp) for communication to reduce reliance on SMS-based 2FA.

   • Educate users about the risks of SMS-based authentication and promote alternatives like app-based authenticators (e.g., Google Authenticator).

Evolution to IP-Based Signaling

As telecom networks transition to IP-based infrastructure (e.g., VoLTE, 5G), SS7 is being replaced or supplemented by protocols like SIP (Session Initiation Protocol) and Diameter. SIGTRAN, an adaptation of SS7 for IP networks, allows SS7 messages to be carried over IP using the Stream Control Transmission Protocol (SCTP). However, these newer protocols inherit some of SS7’s vulnerabilities and introduce new ones, such as IP-based attacks.

Role in Modern Telecom

Despite its age, SS7 remains critical for interoperability between legacy and modern networks. For example, 2G and 3G networks still rely heavily on SS7, and even 4G/5G networks use SS7 for fallback services (e.g., circuit-switched fallback for voice calls). This ensures SS7’s relevance but also perpetuates its security challenges.

Ethical and Privacy Concerns

The ability to exploit SS7 for surveillance raises ethical questions about privacy and state power. Telecom operators and governments must balance national security needs with individual privacy rights. Transparent policies and independent oversight are essential to prevent abuse.

Industry Response

The telecom industry has acknowledged SS7 vulnerabilities, with organizations like the GSMA and ITU developing guidelines for securing SS7 networks. However, the global and decentralized nature of telecom infrastructure makes it challenging to implement consistent security measures.

Conclusion

SS7 is a foundational protocol that has enabled global telecommunications for decades, offering robust and scalable signaling capabilities. Its technical architecture, based on a layered protocol stack and out-of-band signaling, supports critical services like call setup, SMS delivery, and mobility management. However, its trust-based design and lack of modern security features have made it a target for exploitation, with risks ranging from surveillance and interception to financial fraud and service disruptions.

SS7’s deep integration, global standardization, and lack of a viable, universally adopted alternative make it impossible to eliminate in the near term. Addressing SS7 vulnerabilities requires a multi-faceted approach, including firewalls, encryption, access controls, and a gradual transition to more secure protocols. As the telecom industry evolves, balancing legacy compatibility with modern security demands will be crucial to protecting users and networks. Awareness of SS7’s risks and proactive mitigation efforts are essential to safeguarding the global telecommunications ecosystem.

---