ignalling security has an image problem. It sounds like a specialist concern for core-network engineers, and the attacks get written up as exotic. They are not exotic. They are cheap, well documented, and they still work — and the consequences land on subscribers as location tracking, intercepted one-time passcodes and drained bank accounts.
This is a guide to what actually happens on the signalling plane, what the GSMA framework asks operators to do about it, and why the SMS firewall you already have does not cover it.
Why SS7 is exploitable at all
SS7 was built for a world of a few hundred state-owned carriers who all knew each other. There is no authentication between networks in the design, because the design did not need one: if a message arrived on the network, it came from a peer, and peers were trusted by definition.
Deregulation, roaming hubs and resale turned a few hundred trusted peers into thousands of parties with signalling access, some of which resell it. The protocol did not change. An attacker who obtains a global title — and they can be leased — can send the same queries a legitimate roaming partner sends, and the receiving network has no cryptographic way to tell the difference.
The attacks, in plain terms
Three categories account for most real-world harm, and none of them requires touching the subscriber's device.
- Location disclosure. A query intended for roaming — asking which switch is currently serving a subscriber — returns a cell identifier that resolves to a physical area. Repeat it and you have a movement history. The subscriber sees nothing.
- SMS interception. An attacker updates the network's record of where a subscriber is, so messages route to the attacker's node instead of the handset. Any one-time passcode delivered over SMS during that window goes to the attacker. This is the mechanism behind account takeovers that appear to defeat two-factor authentication.
- Subscriber-data disclosure. Queries designed for legitimate interworking return identifiers and profile data that support later fraud, including the identifiers needed to make an interception attempt look plausible.
SMS interception via signalling is why one-time passcodes over SMS are a possession check rather than a strong second factor — the possession being checked can be relocated without the subscriber's involvement.
Diameter did not solve it
Diameter replaced SS7 for LTE and later generations, and it does support transport security. In practice inter-operator Diameter is frequently deployed without it, and the analogous attacks — location, interception, data disclosure — reappear with different message names. Networks also run both stacks side by side for years during migration, and interworking functions translate between them, which means an SS7-side attack can be carried into a Diameter core through a gateway that trusts what it is translating.
A signalling firewall that only understands one of the two protocols leaves the other open, and the interworking function open along with it.
What FS.07 and FS.11 ask for
The GSMA publishes the reference framework the industry works to. FS.11 sets out SS7 interconnect security categories; FS.07 covers SMS and the messaging-specific dimension. The categorisation is what makes the problem tractable, because it separates traffic that is never legitimate from traffic that is legitimate only in context.
| Category | What it covers | Treatment |
|---|---|---|
| Category 1 | Messages that should never arrive from outside the home network | Block at the border. No legitimate interconnect case exists. |
| Category 2 | Messages legitimate only from a network where the subscriber is actually roaming | Correlate against roaming state; reject when inconsistent. |
| Category 3 | Messages legitimate from a roaming partner but abusable in sequence or volume | Rate, velocity and plausibility analysis over time. |
Category 1 is the easy win and the one most often left undone. Category 3 is where the engineering lives, because a single message can be entirely valid while the pattern it belongs to is obviously an attack — the same query for a thousand subscribers in an hour, from a partner with fifty roamers.
Why velocity checks matter more than signatures
Signature matching catches known-bad message types. It does not catch a legitimate message type used illegitimately, which is the majority of the modern problem. The useful questions are contextual: is this subscriber plausibly in that country, given where they were forty minutes ago? Does this partner's query volume match its roaming agreement? Has this global title suddenly started asking about subscribers it has never asked about before?
That analysis needs state — roaming records, historical baselines per peer, and the ability to correlate a query against what the network already knows. A stateless filter cannot do it, which is the practical reason signalling firewalls are not just access-control lists.
A signalling firewall is not an SMS firewall
These are routinely confused because both are called firewalls and both involve messaging. They operate on different planes and defend against different things.
| SMS firewall | Signalling firewall | |
|---|---|---|
| Plane | Application / messaging traffic | SS7 and Diameter signalling |
| Sees | Message content, sender ID, routing, volume | Interconnect queries and network procedures |
| Stops | Grey routes, spam, smishing, A2P leakage, revenue loss | Location tracking, SMS interception, subscriber-data theft |
| Framework | GSMA FS.07 messaging dimension | GSMA FS.11 / FS.07 categories |
An operator needs both. The SMS firewall protects messaging revenue and subscribers from abusive content; the signalling firewall protects subscribers from the network layer beneath it. Neither substitutes for the other, and an audit that finds one in place should not be read as covering the other.
What deployment involves
- Establish a traffic baseline before blocking anything. You cannot separate anomalous from normal without knowing what normal is for each interconnect partner.
- Enable Category 1 blocking first. It is the highest-confidence, lowest-risk action available and requires no correlation.
- Add Category 2 correlation against roaming state, which is where most interception attempts are caught.
- Introduce Category 3 velocity and plausibility rules in monitor mode, tune, then enforce.
- Cover Diameter and the interworking function, not just SS7 — an attack that arrives on one stack and is translated into the other bypasses a single-stack deployment.
- Feed the output somewhere a human reads. A firewall that blocks silently teaches you nothing about who is probing you.
Frequently asked questions
What is an SS7 signalling firewall?
A network element at the signalling border that inspects SS7 and Diameter interconnect traffic and applies the GSMA categories — blocking messages that should never arrive from outside the network, correlating those that are legitimate only when a subscriber is genuinely roaming, and applying velocity analysis to the rest.
How is it different from an SMS firewall?
They defend different planes. An SMS firewall inspects messaging traffic for grey routes, spam and A2P revenue leakage. A signalling firewall inspects the SS7 and Diameter procedures beneath it, defending against location tracking, SMS interception and subscriber-data disclosure. Operators need both.
What are GSMA FS.07 and FS.11?
The GSMA's reference documents for interconnect security. FS.11 covers SS7 interconnect categories and FS.07 covers the SMS and messaging dimension. Their central contribution is the category model that separates never-legitimate traffic from traffic that is legitimate only in a specific roaming context.
Can attackers still track location over SS7 in 2026?
Where networks have not deployed categorised filtering, yes. The queries involved are ordinary roaming procedures, so a network that does not correlate them against actual roaming state cannot distinguish an attacker from a partner. This is precisely what Category 1 and Category 2 handling exists to stop.
Does Diameter fix the SS7 security problem?
Not by itself. Diameter supports transport security but inter-operator deployments frequently omit it, and equivalent attacks exist with different message names. Networks also run both stacks in parallel during migration, so an interworking function can carry an SS7-side attack into a Diameter core.
Does a signalling firewall stop SIM-swap fraud?
No — SIM swap is a social-engineering attack on the operator's own provisioning process, not a signalling attack, so it has to be defended in customer care and porting controls. A signalling firewall stops the technically similar outcome achieved a different way: relocating message delivery through interconnect rather than through a new SIM.
Will blocking signalling traffic break roaming for my subscribers?
Not if it is deployed in the right order. Category 1 messages have no legitimate interconnect case, so blocking them is safe immediately. Category 2 and 3 rules should run in monitor mode against a real traffic baseline and be tuned before enforcement, which is why baselining comes first.
The takeaway
Signalling attacks persist because the protocol assumes trust that no longer exists, and because the queries involved are indistinguishable from legitimate roaming unless you correlate them against what the network already knows. The GSMA categories make that tractable. Start with Category 1, correlate Category 2 against roaming state, baseline before enforcing Category 3, and cover Diameter and the interworking function rather than SS7 alone.
Related: signalling firewall for operators, SMS firewall, and what is SIM swap fraud.