# SS7 security threats and the GSMA FS.11 categories

> SS7 was designed for a trusted operator club, so it has no message-level authentication — a foreign node can query or spoof MAP operations to track location, intercept SMS and OTPs, or redirect calls. GSMA FS.11 defines a defence: classify inbound MAP messages into categories 1, 2 and 3 and filter each at the network border.

- Canonical URL: https://www.broadnet.me/reference/ss7-security-threats-fs11
- Language: en
- Last updated: 2026-07-18
- Publisher: BroadNet (https://www.broadnet.me)

The main SS7 attack classes — location tracking, SMS/OTP interception, call redirection and fraud — and how GSMA FS.11 categorises MAP messages (categories 1/2/3) so signalling firewalls can filter them.

## Why SS7 is exploitable

SS7 assumes every signalling peer is a trusted operator, so MAP operations carry no cryptographic authentication of their origin. As interconnect opened up and access became widely available, an attacker with SS7 connectivity could send MAP queries and updates that a network would answer or act on as if they came from a legitimate partner. The result is a class of attacks that need no access to the target handset — only the ability to send SS7 messages toward the victim's network.

## The main attack classes

SS7 abuse falls into a few recognised categories. Location tracking uses interrogation operations to resolve a subscriber to a cell or area. Interception exploits the routing and mobility procedures to divert SMS or calls to the attacker. Fraud and denial-of-service manipulate subscriber state or barring. Because one-time passcodes are commonly sent by SMS, SMS interception directly undermines SMS-based two-factor authentication.

*SS7 attack classes and typical MAP operations abused*

| Attack | Operations abused | Effect |
|---|---|---|
| Location tracking | anyTimeInterrogation, provideSubscriberInfo, sendRoutingInfoForSM | Resolve subscriber to cell/area |
| SMS / OTP interception | updateLocation (spoofed), mt-ForwardSM redirection | Divert MT-SMS to attacker node |
| Call interception / redirect | updateLocation, provideRoamingNumber, insertSubscriberData | Reroute or monitor calls |
| Fraud / DoS | cancelLocation, purgeMS, updateLocation | De-register subscriber, deny service |
| Credential theft | sendAuthenticationInfo | Harvest authentication vectors |

## The GSMA FS.11 categories

GSMA FS.11 (SS7 Interconnect Security Monitoring and Firewall Guidelines) classifies inbound MAP messages by where they may legitimately originate, giving operators a filtering rulebook. Category 1 messages should never be received on an interconnect from another operator — they belong inside a single network — so they are blocked outright at the border. Category 2 messages should only ever come from the subscriber's own home network, so they are blocked when the origin is not the home network. Category 3 messages can legitimately arrive from a network where the subscriber is roaming, so they cannot be blocked by origin alone and instead require plausibility and velocity checks.

*GSMA FS.11 message categories*

| Category | Legitimate origin | Firewall action | Examples |
|---|---|---|---|
| 1 | Only within an operator's own network | Block on inbound interconnect | anyTimeInterrogation, sendIMSI, provideSubscriberInfo (inbound) |
| 2 | Only from the subscriber's home network | Block if source ≠ home network | cancelLocation, insertSubscriberData, deleteSubscriberData |
| 3 | From a visited network where the subscriber roams | Plausibility + velocity checks | updateLocation, sendRoutingInfoForSM, provideRoamingNumber |

## Firewall rules that implement FS.11

A signalling firewall enforces FS.11 in layers. At the SCCP layer it screens the Calling Party global title against allow/deny lists and checks GT-vs-point-code consistency. At the MAP layer it inspects the operation code and applies the category rule. For category 3 it adds stateful checks: a velocity check flags a subscriber who appears to move between distant countries faster than physically possible, and consistency checks compare the claimed serving network against the HLR's known location. Category 1 traffic is simply dropped and logged.

*Illustrative FS.11 firewall logic*

```text
on inbound MAP message from interconnect peer P:
  if opcode in CATEGORY_1:        drop + alert   # never valid across interconnect
  if opcode in CATEGORY_2:
        if P != subscriber.homeNetwork: drop + alert
  if opcode in CATEGORY_3:        # e.g. updateLocation, SRI-SM
        if velocityImplausible(subscriber, P): drop + alert
        if !consistentWithHLR(subscriber, P):  drop + alert
  else: allow + log
```

## Layered defence

No single control is sufficient. FS.11 filtering is complemented by FS.19 diameter-equivalent guidance for LTE and by SMS-firewall controls (GSMA IR.70/SMS interworking) against spam and grey routes. Operators pair a signalling firewall with continuous monitoring, so novel patterns that pass static rules still surface as anomalies. The strategic mitigation for SMS interception specifically is to reduce reliance on SMS OTPs, but for networks that must carry them, border filtering remains the primary defence.

## Frequently asked questions

### Why is SS7 insecure?

SS7 was built for a small, trusted set of operators and never added authentication of message origin. Once interconnect access became widely available, an attacker able to send SS7 messages could impersonate a legitimate network and have MAP queries answered or acted upon — no access to the target handset required.

### What are the GSMA FS.11 categories?

FS.11 sorts inbound MAP messages by legitimate origin. Category 1 should never cross an interconnect and is blocked. Category 2 should only come from the subscriber's home network and is blocked otherwise. Category 3 can arrive from a visited network, so it needs plausibility and velocity checks rather than an outright block.

### How does an SS7 firewall stop SMS interception?

It screens the SendRoutingInfoForSM and UpdateLocation operations attackers use to redirect MT-SMS. It checks the source against the home/visited relationship, applies velocity checks so a subscriber cannot appear in two distant countries at once, and drops implausible or category-1 traffic.

### What is a velocity check?

A velocity (or plausibility) check compares a subscriber's newly claimed location against their last known location and the time between them. If the implied travel is physically impossible — for example roaming updates from two continents seconds apart — the message is treated as spoofed and blocked.

### Does an SS7 firewall replace moving away from SMS OTPs?

No — it reduces exposure but does not eliminate it. Border filtering is the primary defence for networks that must carry SMS OTPs, but the strongest mitigation against interception is to reduce reliance on SMS-based one-time passcodes where a stronger factor is available.

## Sources

- [GSMA FS.11 — SS7 Interconnect Security Monitoring & Firewall Guidelines](https://www.gsma.com/security/resources/fs-11-ss7-interconnect-security-monitoring-and-firewall-guidelines/)
- [GSMA IR.82 — SS7 Security Network Implementation Guidelines](https://www.gsma.com/)

## Related

- [MAP operations reference](https://www.broadnet.me/reference/map-operations)
- [SS7 MT-SMS delivery flow](https://www.broadnet.me/reference/ss7-mt-sms-delivery-flow)
- [SS7 signalling security](https://www.broadnet.me/answers/ss7-signaling-security)
- [SS7 firewall (operators)](https://www.broadnet.me/operators/ss7-firewall)
- [Signalling & CDR platform](https://www.broadnet.me/platforms/signaling-cdr)