Everything worth knowing, nothing that isn't.
What the message does
When an SMSC needs to deliver an MT (mobile-terminated) SMS to a subscriber it does not serve directly, it sends MAP-SRI-for-SM to that subscriber's HLR. The HLR resolves the MSISDN to the current IMSI and the serving MSC's address, returns these to the SMSC, and the SMSC then sends MAP-MT-FORWARD-SHORT-MESSAGE to that MSC for handset delivery. Without SRI-for-SM, there is no cross-operator SMS — every cross-network message in 2G/3G/4G-via-CSFB depends on this query.
Why it became an attack target
SRI-for-SM is a free location oracle. By querying it against any MSISDN, a sender learns the serving MSC of that subscriber — which is enough to determine which country and which operator the subscriber is currently camped on, and (combined with operator topology data) often the rough geographical region. Repeated queries over time reveal travel patterns. The legitimate SMSC use case requires it; the abuse case is sending repeated SRI-for-SM with no follow-up MT-FORWARD-SHORT-MESSAGE — pure surveillance. SS7 firewalls treat SRI-for-SM as the canonical example for FS.07/FS.11 enforcement.
What mitigations exist
Four layers. First, the firewall correlates inbound SRI-for-SM with subsequent MT-FORWARD-SHORT-MESSAGE: a peer that asks but never delivers gets reputation-degraded automatically. Second, per-peer rate limits and global thresholds catch bulk-harvesting attempts. Third, GT/PC whitelisting against IR.21-declared roaming partners blocks queries from unauthorised origins. Fourth, anomalous-query alerting (a peer suddenly running 10x its baseline against a specific MSISDN range) pages the SOC for human review. BroadNet's signalling firewall (/operators/ss7-firewall) ships all four behaviours by default and integrates with /platforms/signaling-cdr for cross-event correlation.
Privacy and compliance considerations
SRI-for-SM responses contain IMSI and serving MSC — both highly sensitive identifiers. PDPL, GDPR, and equivalent regimes all treat location-revealing telecom signalling as protected data, in scope for explicit logging, audit retention, and breach reporting. The defensive frame is universal: log every SRI-for-SM, monitor for anomalies, share reputation data across operators through GSMA-coordinated channels. This entry deliberately does not describe exploit chains — for the operator-side defensive playbook see /answers/gsma-fs07-fs11-signaling-firewall, and for SS7 architectural context see /answers/ss7-map-explained.