SS7 va Diameter hujumlari: Signaling zaifliklari telefoningizni qanday fosh qiladi

SS7 va Diameter signaling hujumlari sizni kuzatishi, xabarlaringizni ushlab olishi va sizni taqlid qilishi mumkin. Ular qanday ishlaydi va ularni qanday to'xtatish mumkin.

Telefoningiz kuzatilishi, SMS orqali yuboriladigan ikki faktorli kodlaringiz ushlab olinishi va raqamingiz taqlid qilinishi mumkin — bularning barchasi zararli dastur, fishing havolasi yoki qurilmangizga kirishsiz sodir bo'lishi mumkin.

Hujumlar telekom tarmog'ida, operatorlar orasidagi boshqaruv protokollarida — ya'ni signalingda sodir bo'ladi. Bu eski telefon kommutatorining avtomatlashtirilgan avlodlari. Ko'pchilik foydalanuvchilar buni ko'rmaydi va ko'pchilik operatorlar buni ishonchli tarzda to'xtata olmaydi.

Signaling hujumlari yangi emas. Yaqinda ular sarlavhalarga chiqqan, chunki Eron bilan bog'liq shaxslar Yaqin Sharqda Eron urushi paytida AQSh xodimlarining telefonlarini topish uchun eskirgan tarmoq texnologiyasidan foydalanganligi xabar qilingan.

Ammo bu zaiflik o'nlab yillar davomida mavjud bo'lib kelgan va u ancha oddiy jinoyatlar — masalan, bankning bir martalik parollarini ushlab olish — uchun ham ishlatilgan. Bu hatto mashhur YouTuberlar tomonidan ham namoyish etilgan: Veritasium faqat telefon raqami yordamida texnologiya ta'sirchisi qo'ng'iroqlari va xabarlarini o'g'irlab olgan.

Bu davom etmoqda

• Jinoyatchilar bank hisoblari va global telekom infratuzilmasiga hujum qilishda signaling protokollaridan foydalanganligi xabar qilingan.
• Citizen Lab SS7 va Diameter'dan foydalanib, o'nlab mamlakatlardagi minglab hujumlar bilan ikki uzoq muddatli tijorat kuzatuv kampaniyasini fosh qilgan.
• Kongressmen Ted Lieu'ning telefoni 60 Minutes Australia'da SS7 orqali jonli efirda buzib kirilgan.
• Hujumchilar jabrlanuvchilarning bank hisoblarini bo'shatish uchun SMS bir martalik parollarini ushlab olgan.

Signaling hujumi nima?

Har bir qo'ng'iroq, xabar va mobil ma'lumot seansi uchun operatoringiz siz to'lovchi mijoz ekanligingizni tekshirishi va trafikni to'g'ri manzilga yo'naltirishi kerak.

Operatorlar buni signaling — sizning joylashuvingizni aniqlaydigan va trafikni mos ravishda yo'naltiradigan fon xabarlari — yordamida amalga oshiradi. Signaling o'nlab yillar davomida global provayderlar orasidagi bog'lovchi to'qima bo'lib kelgan va mobil xavfsizlikda eng e'tibordan chetda qolgan hujum yuzalaridan biri hisoblanadi.

Ko'p ishni ikki protokol bajaradi: SS7 (1970-yillardan, 2G/3G'da ishlatiladi) va Diameter (uning vorisi, 4G va ko'pchilik 5G'da ishlatiladi).

Ikkalasi ham kichik sonli yirik operatorlar tizimga ulanishi mumkin bo'lgan davrda ishlab chiqilgan, shuning uchun ular qonuniy operatordan kelgan deb da'vo qiladigan trafik haqiqatan ham shunday deb taxmin qiladi. SS7'dagi so'rovni yuboradigan mashinani autentifikatsiya qilish jarayoni deyarli yo'q.

Diameter qog'ozda kuchliroq autentifikatsiyani qo'llab-quvvatlaydi, ammo operatorlar har doim shifrlash kabi asosiy himoyalarni joriy qilmaydi va ko'pchilik bir xil tengdoshga ishonch modeliga tayanadi.

Global signaling magistraliga — tijorat ijarasi yoki buzilgan operator orqali — kirish huquqiga ega bo'lgan hujumchi butun dunyo bo'ylab operatorlar ishonchli deb qabul qiladigan xabarlarni yuborishi mumkin.

Bu qanday ishlaydi

Signaling hujumchiga operatoringizga savollar berish va sizning nomingizdan da'volar qilish imkonini beradi:

• IMSI'ni yig'ish. Raqamingizni bilgan hujumchi qo'ng'iroq yoki SMS yo'naltirish bahonasida sizning Xalqaro Mobil Abonent Identifikatori (IMSI)ni so'rashi mumkin. U yillar davomida keyingi hujumlar uchun qayta ishlatilishi mumkin.
• Sizni real vaqtda joylashtirish. So'rovlar siz oxirgi marta ulangan uyali minorani qaytarishi mumkin. Boshqalar, odatda favqulodda yordamchilar uchun ajratilgan, telefoningiz xabar qiladigan haqiqiy koordinatalarni qaytarishi mumkin.
• Aloqalarni ushlab olish. Hujumchi siz boshqa tarmoqqa o'tganingizni da'vo qiladi, shuning uchun qo'ng'iroqlaringiz va xabarlaringiz unga yo'naltiriladi. O'g'irlangan foydalanuvchi nomi va parol bilan birgalikda bu sizning SMS ikkinchi faktorini sizga emas, hujumchiga yetkazadi.
• Sizni taqlid qilish yoki bloklash. IMSI bilan hujumchi siz sifatida qo'ng'iroq qilishi yoki SMS yuborishi mumkin. Soxta rouming da'vosi telefoningiz xizmatini ham to'xtatishi mumkin.
• Tarmoqlarni buzish. Ataylab noto'g'ri sozlangan signaling xabarlari provayder tizimlarini ortiqcha yuklashi mumkin.

Bularning hech biri qurilmangizga tegmaydi. Bu siz ko'rmaydigan va telefoningizda hech qanday iz qoldirmaydigan avtomatlashtirilgan tranzaksiyalarda sodir bo'ladi.

Nima uchun firewalllar va tezlik tekshiruvlari yetarli emas

Operator signaling firewalllari noto'g'ri joydan yuborilgan yoki qabul qilingan xabarlarni ishonchli tarzda bloklaydi. To'g'ri yo'naltirilgan xabarlar uchun ular ko'pincha tezlik tekshiruvini o'tkazadi — siz oxirgi ma'lum joylashuvingizdan hozir da'vo qilingan joyga jismonan sayohat qila olganingizni tekshiradi. Agar siz bir soat oldin Nyu-Yorkda bo'lgan bo'lsangiz va turk operatori siz uning tarmog'ida ekanligingizni aytsa, so'rov rad etiladi.

Asosiy muammo shundaki, firewallning joylashuv ma'lumotlari ko'pincha bir necha soat eski. 2025-yilda Wireless Security konferensiyasida taqdim etilgan tadqiqotda Cape, maxfiylikka yo'naltirilgan mobil operator, tashrif buyurgan tarmoqdan Diameter yangilanishlari har ikki-o'n soatda bir marta kelishini o'lchagan.

AQSh va Germaniyadagi abonentlar uchun 250 dan ortiq turli tarmoqlar bir soatlik sayohat vaqti ichida yetib borish mumkin. Yetarlicha operator identifikatorlariga ega bo'lgan hujumchi oxir-oqibat ishonchli ko'rinadigan birini topadi.

Citizen Lab hisobotida bu amalda ko'rsatilgan: STA1 deb atalgan shaxs foydalanuvchini kuzatish uchun to'qqiz mamlakatdagi o'n bir operator identifikatorini aylantirib, qonuniy rouming trafikiga o'xshash ko'rinishga harakat qilgan. Ular shuningdek SS7 va Diameter o'rtasida almashgan, ko'pchilik operatorlar esa ularni alohida firewalllar bilan va kam koordinatsiya bilan himoya qiladi.

Nashvilldan Berlinga uchadigan va telefonini o'chiradigan maqsadni ko'rib chiqing. Xitoy Mobile sifatida o'zini ko'rsatadigan va u Nassau, Bagama orollarida roumingda ekanligini da'vo qiladigan xabar rad etiladi, chunki bu jismonan mumkin emas.

Ammo yaqin Nassau, Bagama orollaridagi operatorning xabari ishonchli ko'rinadi va uy operatori uning qo'ng'iroqlari va SMS'larini hujumchiga yo'naltirishga aldalanishi mumkin.

O'zingizni shaxsiy uyali aloqa xizmati bilan himoya qiling.

Cape — Amerika maxfiylikka yo'naltirilgan mobil operatori bo'lib, cheksiz gapirish, xabar va 4G/5G ma'lumotlarini taqdim etadi. U maxfiylik va xavfsizlikni asos qilib qurilgan.

Ko'pchilik operatorlar hamma narsani kuzatadi: qayerga borasiz, kimga qo'ng'iroq qilasiz, nima qilasiz. Cape xizmat ko'rsatish uchun zarur bo'lgan minimal ma'lumotni yig'adi, qo'ng'iroq va xabar metama'lumotlarini 24 soatdan keyin o'chiradi, kuzatuvni oldini olish uchun tarmoq ID'sini aylantiradi, SIM va tarmoq asosidagi hujumlardan himoya qiladi va boshqalar.

Maxfiylik qimmatga tushmasligi kerak. Bugun o'ting va umr bo'yi $29 chegirma oling.

Ko'proq ma'lumot →

Cape signaling hujumlaridan qanday himoya qiladi

Cape — maxfiylikka yo'naltirilgan mobil operator bo'lib, uning yondashuvi global telekom tizimi buzilgan deb taxmin qilish va baribir aloqalarni maxfiy saqlaydigan himoyalarni qurishdir. To'rt qatlam mavjud:

1. Kundalik IMSI aylanishi. Deyarli har bir maqsadli signaling hujumi IMSI bilan boshlanadi va hujumchi sizning IMSI'ni olgandan keyin, u sizda bor ekan, foydali bo'lib qoladi. Citizen Lab hisobotida bu tasdiqlangan — bir xil IMSI'lar oylar va yillar bilan ajratilgan operatsiyalar davomida hujumga uchragan. Ko'pchilik operatorlarda sizning IMSI doimiy. Siz SIM'ni faollashtirganingizda birini olasiz va uni abadiy saqlaysiz. Cape'da sizning IMSI har kuni aylantiriladi. Kuzatuv sotuvchilari yillar davomida yig'gan IMSI ma'lumotlar bazalari Cape abonentlari uchun endi foydasiz.

1. SS7 yo'q. Cape SS7'ni umuman qo'llab-quvvatlamaydi va tarmoqda SS7 zaxirasi yo'q, shuning uchun SS7 asosidagi hujumlar hech narsaga tegmaydi. Ko'pchilik operatorlar hali ham eski SS7 infratuzilmasini nafaqaga chiqarishda qiynaladi, chunki ularning tarmog'ining ba'zi daromad keltiradigan qismi unga bog'liq.

1. Tarmoq qulfi. Tarmoqning siz qayerda ekanligingiz haqidagi fikriga ishonish o'rniga, Cape qurilmangizdan so'raydi. Chet el tarmog'i telefoningizga ulanishni so'raganda, Tarmoq qulfi Cape ilovasini so'raydi, u da'voni mahalliy ravishda mamlakat darajasida baholaydi va u mos keladimi-yo'qmi deb xabar beradi. Agar hujumchi sizning IMSI'ni boshqa mamlakatdan ulashga harakat qilsa, sizning telefoningiz uyda bo'lsa, so'rov rad etiladi va sizga xabar beriladi. Cape tizimlari faqat da'vo mos keladimi-yo'qmi, siz haqiqatan qayerda ekanligingiz emas, o'rganadi va Cape hech qachon sizning aniq joylashuvingizni yig'maydi yoki saqlamaydi.

1. Doimiy kirish sinovlari. Ko'pchilik signaling firewalllari GSMA asosiy tavsiyalariga moslashtirilgan muvofiqlik vositalaridir. Bu tavsiyalar 1200 dan ortiq a'zo provayderlarga tarqatiladi, shuning uchun bir xil yo'riqnoma signaling xabarlarini yubora oladigan hujumchilarga ham mavjud. Cape hozirgi signaling ekspluatatsiya texnikalariga ixtisoslashgan uchinchi tomon firmalarini o'z infratuzilmasini sinovdan o'tkazish uchun jalb qiladi, so'ngra topilgan narsalarga, ayniqsa abonent maxfiyligiga ta'sir qiladigan narsalarga qarshi tarmoqni mustahkamlaydi.

Hujum | Boshqa operatorlar | Cape Real vaqtda joylashuvni kuzatish | Telefon xizmat olganida ulanishadi; tezlik tekshiruvlari ishonchli soxtalashtirish bilan aldalanishi mumkin | Tarmoq qulfi ulanish so'rovlarini qurilmangiz bilan tekshiradi IMSI yig'ish va qayta ishlatish | IMSI doimiy va abadiy foydali bo'lib qoladi | Kundalik aylanish avval yig'ilgan IMSI'larni foydasiz qiladi SS7 asosidagi hujumlar | Hujumchilar SS7 firewallarini chetlab o'tish uchun bir necha usuldan foydalanadi | SS7 qo'llab-quvvatlanmaydi Diameter asosidagi hujumlar | Firewallar keng tarqalgan GSMA asoslariga tayanadi | Firewallar hozirgi texnikalar yordamida kirish sinovlaridan yangilanadi

Siz telekom magistralini tuzata olmaysiz, ammo operatoringizni tanlashingiz mumkin

Har bir eng yaxshi amaliyotga rioya qilish — shifrlangan xabar almashishdan foydalanish, jamoat Wi-Fi'dan qochish va 2FA'ni yoqish — qurilmangizni hech qachon xavfsizlikni nazarda tutmagan tarmoqlarga bog'liq qoldiradi.

Maqsadli shaxslar — jurnalistlar, rahbarlar, xavfsizlik xodimlari va SMS tekshiruvi bilan bog'liq hisoblari bo'lgan har kim — uchun operator tahdid modelining bir qismidir.

Signaling xavfsizligi uchun qurilgan operatorga o'ting. Cape haqida ko'proq ma'lumot →

Homiylik va Cape tomonidan yozilgan.

SS7 and Diameter signaling attacks can track, intercept, and impersonate you. Here’s how they work and how to stop them.

Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malware, a phishing link, or any access to your device.

The attacks happen inside the telecom network, in the carrier-to-carrier control protocols known as signaling, the automated descendants of the old telephone switchboard. Most users never see them, and most carriers can’t reliably stop them.

Signaling attacks aren’t new. Most recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war.

But the vulnerability has been around for decades, and it’s been used for far more everyday crimes, like intercepting bank one-time passcodes. It has even been demonstrated by popular YouTubers: Veritasium hijacked a tech influencer’s calls and texts using only his phone number.

This keeps happening

• Criminals have reportedly exploited signaling protocols in attacks on bank accounts and global telecom infrastructure.

• Citizen Lab exposed two long-running commercial surveillance campaigns abusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries.

• Congressman Ted Lieu’s phone was hacked on live TV via SS7 on 60 Minutes Australia

• Attackers have intercepted SMS one-time passcodes to drain victims’ bank accounts.

What is a signaling attack?

Every call, text, and mobile data session requires your carrier to verify you’re a paying customer and route your traffic to the right destination.

Carriers do this with signaling–background messages that identify your location and forward traffic accordingly. Signaling has been the connective tissue between global providers for decades, and it is one of the most overlooked attack surfaces in mobile security.

Two protocols do most of the work: SS7 (from the 1970s, used in 2G/3G) and Diameter (its successor, used in 4G and most 5G).

Both were designed when a small number of large operators could plug into the system, so they assume that traffic claiming to come from a legitimate operator really does. SS7 has essentially no process for authenticating the machine making a request.

Diameter supports stronger authentication on paper, but operators don’t always deploy basic protections like encryption, and many fall back on the same peer-to-peer trust model.

An attacker with access to the global signaling backbone, through a commercial leasing arrangement or a compromised operator, can send messages that carriers worldwide treat as trustworthy.

How does it work

Signaling lets an attacker ask your carrier questions and make claims on your behalf:

• Harvest your IMSI. Knowing your number, an attacker can request your International Mobile Subscriber ID (IMSI) under the pretense of routing a call or SMS. It can be reused for follow-on attacks for years.

• Locate you in real time. Queries can return the cell tower you last connected to. Others, normally reserved for emergency responders, can return the actual coordinates your phone reports.

• Intercept communications. The attacker claims you’ve roamed onto another network, so your calls and texts are redirected to them. Combined with a stolen username and password, this delivers your SMS second factor to the attacker instead of you.

• Impersonate or block you. With your IMSI, an attacker can place calls or send SMS as you. A false roaming claim can also cut off service to your phone.

• Disrupt networks.Deliberately misconfigured signaling messages can overwhelm provider systems.

None of this touches your device. It happens in automated transactions you can’t see and that leave no trace on your phone.

Why firewalls and velocity checks fall short

Carrier signaling firewalls reliably block messages sent to or from the wrong place. For correctly routed messages, they often run a velocity check to test whether you could physically have traveled from your last known location to the one now claimed. If you were in New York an hour ago and a Turkish carrier says you’re on its network, the request is denied.

The structural problem is that the firewall’s location data is often hours old. In research presented at the Wireless Security conference in 2025, Cape, the privacy-first mobile carrier, measured Diameter updates from a visited network arriving as infrequently as every two to ten hours.

For subscribers in the US and Germany, over 250 distinct networks are reachable within a single hour of travel time. An attacker with enough operator identities will eventually find one that looks plausible.

Citizen Lab’s report shows this in practice: the actor it calls STA1 repeatedly tried to track a user by rotating through eleven operator identities in nine countries to look like legitimate roaming traffic. They also pivoted between SS7 and Diameter, which most carriers defend with separate firewalls and little coordination.

Consider a target who boards a flight from Nashville to Berlin and powers off her phone. A message posing as China Mobile claiming she’s roaming there gets rejected, because it’s physically impossible.

A message from a carrier in nearby Nassau, Bahamas, looks plausible, and the home carrier can be fooled into routing her calls and SMS to the attacker.

Protect yourself with private cell service.

Cape is America's privacy-first mobile carrier providing unlimited talk, text, and 4G/5G data, built from the ground up with privacy and security at it's core.

Most carriers track everything: where you go, who you call, what you do. Cape collects the minimum amount of information required to provide you with service, deletes call and text metadata after 24 hours, rotates your network ID to prevent tracking, defends against SIM- and network-based attacks, and more.

Privacy shouldn't cost more. Switch today and get $29 off for life.

Learn More →

How Cape defends against signaling attacks

Cape is a privacy-first mobile carrier, whose approach is to assume the global telecom system is compromised and build protections that keep communications private anyway. There are four layers:

1. Daily IMSI rotation. Almost every targeted signaling attack starts with an IMSI, and once an attacker has yours, it stays useful for as long as you have it. A Citizen Lab report confirms this, with the same IMSIs being attacked across operations separated by months and years. On most carriers, your IMSI is permanent. You get one when you activate your SIM and you keep it forever. On Cape, your IMSI rotates daily. The databases of harvested IMSIs that surveillance vendors build up over the years are no longer useful against Cape subscribers.

1. No SS7. Cape doesn’t support SS7 at all, and there is no SS7 fallback in the network, so SS7-based attacks have nothing to land on. Many carriers still struggle to retire legacy SS7 infrastructure because some revenue-generating part of their network depends on it.

1. Network Lock. Instead of trusting a network’s idea of where you are, Cape asks your device. When a foreign network requests to attach to your phone, Network Lock queries the Cape app, which evaluates the claim locally at the country level and reports back whether it matches. If an attacker tries to attach your IMSI from another country while your phone is at home, the request is denied and you’re notified. Cape’s systems learn only whether the claim matches, not where you actually are, and Cape never collects or stores your precise location.

1. Continuous penetration testing. Most signaling firewalls are compliance tools tuned to GSMA baseline recommendations. Those recommendations are distributed to more than 1,200 member providers, so the same guidance is available to attackers who can send signaling messages. Cape has third-party firms that specialize in current signaling exploitation techniques to test its infrastructure, then hardens the network against what they find, especially anything affecting subscriber privacy.

AttackOther CarriersCape Real-time location tracking Phone attaches whenever it gets service; velocity checks can be beaten by plausible spoofing Network Lock verifies attach requests against your device IMSI harvesting and reuse IMSI is permanent and stays useful indefinitely Daily rotation makes previously harvested IMSIs useless SS7-based attacks Attackers use several methods to evade SS7 firewalls No SS7 support Diameter-based attacks Firewalls rely on widely published GSMA baselines Firewalls updated from penetration tests using current techniques

You can’t patch the telecom backbone, but you can choose your carrier

Following every best practice, such as using encrypted messaging, avoiding public Wi-Fi, and enabling 2FA, still leaves your device dependent on networks never built with security in mind.

For people who are targeted, such as journalists, executives, security staff, and anyone whose accounts rely on SMS verification, the carrier is part of the threat model.

Switch to a carrier built for signaling security. Learn more about Cape →

Sponsored and written by Cape.