SS7 Security and Signalling Firewalls

Introduction¶

SS7 has essentially no authentication between networks — any party with signalling connectivity (a licensed operator, a leased point code, a compromised femtocell, an illicit reseller) can send messages that other networks act on. This has been exploited for years for location tracking, call and SMS interception, and fraud. Signalling firewalls are the mitigation.

This is defensive material for operators securing their own networks. It describes attack categories and controls, not how to carry out attacks.

The core problem¶

A network receiving a MAP operation over SS7 generally trusts:

• that the originating global title / point code is who it claims to be (spoofable / leasable);
• that the operation is legitimate for that sender (a foreign network has no business querying your subscribers' locations directly, but nothing stops the message).

There's no equivalent of TLS or a shared secret at the inter-network boundary.

Attack categories (what defenders must stop)¶

• Location disclosure — querying HLR/MSC for a subscriber's serving cell (anyTimeInterrogation, provideSubscriberInfo, sendRoutingInfo(ForSM) misused). Reveals a target's location to city/cell granularity.
• Interception / redirection — manipulating the subscriber's registered location or supplementary services so calls/SMS route through an attacker-controlled node (updateLocation, registerSS, insertSubscriberData misuse), or retrieving authentication material.
• Fraud — inflating traffic, bypassing charging, or manipulating CAMEL/USSD flows.
• Denial of service — cancelLocation, purgeMS, or malformed messages to detach subscribers or crash nodes.
• SMS spam / faking — injecting MT-ForwardSM directly.

Diameter (LTE) inherited analogous risks on S6a/S6d and the roaming interfaces.

GSMA categories (FS.11 / IR.82)¶

Operators classify inbound SS7 MAP messages at the network border:

• Category 1 — messages that should never arrive from another network (they're only used inside a network). E.g. provideRoamingNumber from an unexpected source, cancelLocation inbound. Block outright.
• Category 2 — messages that should only come from a network where the subscriber is actually roaming. Validate against your own records of where the subscriber is (are they really roaming on that partner?). E.g. updateLocation, sendAuthenticationInfo.
• Category 3 — messages that are legitimate inter-network but must pass plausibility / rate checks. E.g. sendRoutingInfoForSM — allowed, but velocity-limit it and cross-check against SMS actually being delivered.

What a signalling firewall does¶

An SS7/Diameter firewall (a.k.a. signalling protection, STP with firewall function) sits at the international/interconnect border and:

• Whitelists/blacklists by originating GT/PC and expected operation set per peer.
• Category filtering — drops Cat-1, validates Cat-2 against a roaming state DB (VLR/subscriber location), rate-limits and correlates Cat-3.
• Velocity / plausibility checks — "this subscriber can't have moved from country A to country B in 3 minutes" (super-charged location validation).
• Message integrity — rejects malformed / out-of-spec TCAP/MAP.
• Rate limiting per peer, per operation, per subscriber.
• Correlation — an SRI-SM should be followed by an MT-ForwardSM; a flood of SRI-SM with no delivery is reconnaissance.
• Anti-spoofing — checks that the SCCP calling party GT matches the MAP-layer originating references and the SCTP/M3UA origin.

Diameter Edge Agents (DEA) do the equivalent for LTE roaming — AVP validation, origin-realm checks, topology hiding.

Verification and troubleshooting (operator side)¶

# On an STP / signalling gateway with capture
tshark -i any -O sccp,tcap,gsm_map -d sctp.port==2905,m3ua \
  -Y 'gsm_map.opcode in {70 71 67 3 4 46}'    # ATI, PSI, ISD, UL, SAI, MT-FSM etc.

• Legitimate roaming partner traffic being blocked — the peer's GT range or operation whitelist is too tight, or a subscriber genuinely roamed and the roaming-state DB is stale. Tune per-peer policy, keep the location DB fresh.
• Attacks still getting through — the firewall is only inspecting one plane (SS7 but not Diameter, or international but not a leased-PC partner), Cat-2 validation isn't wired to a real roaming DB, or messages arrive via a transit provider whose GT is whitelisted broadly.
• False "impossible travel" flags — dual-SIM devices, satellite, or MVNO arrangements. Tune thresholds; maintain exceptions.
• Performance impact — deep MAP inspection + correlation is CPU-heavy at carrier CPS; size the platform, and put cheap Cat-1 drops first.
• Diameter roaming abuse — S6a Update-Location / Authentication-Information from unexpected realms; the DEA must validate Origin-Realm against the roaming agreement list and apply the same category model.

For coordinated disclosure of a specific vulnerability, contact the operator's security team or the GSMA CVD process — don't publish exploit detail.

Related tools and reading¶

• On-site: Port Checker.
• Related posts: SS7 vs SIGTRAN, SS7 vs Diameter.