How SS7 and Diameter Signaling Attacks Can Expose Mobile Users
Summary
This sponsored explainer describes how SS7 and Diameter flaws can enable tracking, SMS interception and impersonation, and outlines Cape’s defenses, including daily IMSI rotation, no SS7 support, Network Lock and penetration testing.
Key points
- SS7 and Diameter signaling can let attackers request subscriber identifiers and location data, redirect calls or texts, impersonate users, or disrupt service without accessing their devices.
- The article says these protocols rely on operator trust; Diameter protections may be inconsistently deployed, and some carriers retain SS7.
- Cape cites research presented in 2025 that found Diameter location updates could arrive every two to ten hours, potentially weakening velocity checks.
- The article describes Citizen Lab’s report on STA1, which allegedly rotated among eleven operator identities in nine countries and switched between SS7 and Diameter to track a target.
- Cape says it rotates subscriber IMSIs daily, does not support SS7, and uses Network Lock to check foreign network attach requests against the device’s country-level assessment.
- Cape says it uses third-party penetration testing to update its defenses; these are vendor-described capabilities in a sponsored article.
Article Details
- Topic
- SS7 and Diameter signaling attacks can enable mobile location tracking, SMS interception, and subscriber impersonation; the article also describes Cape's protections.
People
Threat Actors
Vendors
Products
Countries
GermanyFor subscribers in the US and Germany, over 250 distinct networks are reachable within a single hour of travel time.IranMost recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war.United StatesFor subscribers in the US and Germany, over 250 distinct networks are reachable within a single hour of travel time.