What is SS7? Why Does it Still Affect Modern Telecommunications Networks?
SS7 (Signaling System No. 7) is a set of protocols used to transmit telecommunications control information. It does not primarily carry call content but is responsible for informing the network how to establish calls, locate the user’s current network, transmit messages, handle roaming, and activate other telecommunication services. According to the International Telecommunication Union (ITU-T), SS7 was initially developed in the 1970s and became the widely used signaling protocol stack in public switched telephone networks. With the evolution of mobile communications, application protocols like MAP and CAP were added, enabling SS7 to support user management, roaming, and service control on 2G and 3G mobile networks. The design background of SS7 is different today. Early telecommunications networks consisted of a handful of trusted operators interconnected, with the assumption that signaling sources were trustworthy. Modern networks involve more interconnections across networks, IP transmissions, roaming partners, and third-party services, rendering past trust models inadequate. This is one of the main reasons why SS7 security issues have persisted over time.
Core Layers of SS7: MTP, SCCP, TCAP, and MAP
To understand SS7 security issues, it is essential to know what each layer is responsible for. While different telecommunication standards and network implementations may have detail variations, the following provides a basic concept:
- MTP (Message Transfer Part) is responsible for the transmission, routing, and network management of signaling messages. It can be understood as the foundational layer for message delivery within the SS7 network.
- SCCP (Signaling Connection Control Part) provides more detailed addressing and connectionless or connection-oriented signaling transmission capabilities so that upper-layer services can locate specific network nodes.
- TCAP (Transaction Capabilities Application Part) supports transaction-oriented queries and responses between different nodes, often used to carry application data needed in mobile network services.
- MAP (Mobile Application Part) is used for user location, roaming, SMS, and subscription data services in mobile networks.
- ISUP (ISDN User Part) primarily handles call control processes such as establishing, maintaining, and releasing phone calls.
These protocols do not operate independently. Generally, upper-level services like MAP or ISUP rely on TCAP, SCCP, and MTP for message transmission. When SS7 is carried over IP networks, the SIGTRAN protocol stack is commonly used to transport traditional signaling into the IP environment. SIGTRAN modifies the transmission method but does not automatically eliminate SS7’s inherent trust and verification issues.
How do SMS and Roaming Utilize SS7 Signaling?
SMS transmission is not simply the direct sending of texts from one mobile phone to another. The mobile network first needs to assess the recipient’s subscription data, current registered location, and available services before delivering the message to the appropriate network node. The MAP-related procedures within SS7 assist the network in carrying out these control functions. In a high-level process, the Short Message Service Center forwards the message to the signaling system of the mobile network, which queries the recipient’s subscription and location information before routing the message to the mobile network in service. These processes typically remain unseen by the average user, yet SMS verification codes, login notifications, and transaction confirmations may rely on the same telecommunication infrastructure. Roaming also necessitates extensive signaling exchanges. When a user leaves their original telecom network, the visiting network must confirm the user’s identity, service eligibility, location, and available features with the original network. SS7 supports these queries through protocols like MAP, meaning that signaling security can influence user management and
What are the Security Risks of SS7?
SS7 was initially designed with the assumption that interconnected nodes are trustworthy; thus, the original protocol is lacking complete end-to-end authentication and encryption according to today’s internet security standards. The GSMA and ENISA have pointed out that modern interconnected environments allow improper signaling requests to pose greater risks, affecting areas such as SMS routing, user location, call control, and service availability. Common risks can be classified into several categories. The first category involves the exposure of user location and subscription data, as improper queries may provide unauthorized parties with information related to user location or service status. The second category includes anomalies in SMS or call routing, potentially affecting SMS delivery, call forwarding, or service notifications. The third category signifies user service fraud, such as exploiting gaps in signaling and subscription data for fee fraud or unauthorized service activation. The fourth category encompasses denial of service, making certain users or services temporarily unavailable. The risks associated with SMS verification codes need special attention. SS7 risks
How Can Telecom Operators and Users Mitigate SS7 Risks?
The focus of telecom operators in protection is to establish multi-layer signaling security controls. The first layer is interconnection management, which confirms which partner networks, nodes, and services genuinely require signaling exchanges. The second layer involves signaling firewalls and rules filtering that assess whether requests are rational based on source, destination, message type, user relationship, and service context. The third layer is anomaly detection, analyzing large-volume queries in short periods, unusual location changes, abnormal routing, and messages inconsistent with user status. The fourth layer revolves around incident handling and information sharing. The GSMA’s SS7 security and information sharing guidelines emphasize that operators need to continually address the security issues arising from SS7’s legacy designs and improve protections via industry collaboration and information sharing. ENISA’s Telecommunications Interconnection Security Assessment also regards signaling interconnection as a critical infrastructure risk requiring continuous management. While regular users cannot directly modify SS7, they can reduce the single reliance on SMS.
Common Questions About SS7 Technology and Security
Does SS7 Allow Anyone to Read My SMS Directly?
It cannot be simplified in this way. SS7 is a set of signaling protocols used in telecommunications networks; the security risks relate to network interconnection, operator control, signaling filtering, and service design. While SS7 has historical trust model issues, it does not imply that anyone can read another person's SMS directly via mobile or common computers. If SMS is the only second-factor verification method for important accounts, other risks like number porting, SIM swap, social engineering, and telecom account control should still be considered. For high-value accounts, using authenticator apps or hardware security keys can typically reduce dependency on SMS.
Are SS7, SIM Swap, and SMS Hijacking the Same Thing?
No. SS7 primarily relates to backend signaling protocols and interconnection security issues in telecommunications networks; SIM swap involves transferring a phone number to another SIM or eSIM; SMS hijacking broadly refers to unauthorized reception, forwarding, or control of SMS or verification codes by regular users. While all three may result in similar outcomes, such as not receiving SMS or affecting account verification, the technical reasons differ. In handling, SS7-related issues predominantly rely on telecom operators to address; SIM swap requires checking records of number, SIM, eSIM, and telecom account changes.
Can Regular Users Patch SS7 Vulnerabilities Themselves?
It is not possible to directly patch SS7 protocols in the core network of telecom operators; however, users can reduce the chances of chain effects on accounts. Users can set up PINs and phone number porting protections for telecom accounts, reduce dependency on SMS verification, and enable stronger multi-factor authentication for email, financial, and exchange accounts. When a phone has no service or accounts exhibit anomalies, official channels should be used to contact telecom operators and related platforms, retaining notifications, times, account changes, and transaction records. Users should not seek so-called SS7 attack tools or provide verification codes or login credentials to strangers under the pretext of security checks.
One Key Takeaway: SS7 is a risk in the telecommunications backend; accounts should not rely solely on SMS verification.