Tobias Engel & SRLabs Disclose SS7 Location Tracking at 31C3
SRLabs demonstrated at 31C3 that SS7 flaws allow global subscriber location tracking and SMS 2FA interception.
Target TechnologySS7 MAP Any Time Interrogation (ATI), MAP-SRI-for-SM
OSI Network LayerLayer 7 / SS7 MAP Protocol
Threat Actor / AttributionCommercial Surveillance Vendors & APTs
Protocol Standard3GPP TS 29.002 (MAP Specification)
⚙️ Deep-Dive Technical Analysis
By sending SS7 MAP-ATI requests to home location registers (HLR), attackers can retrieve target cell ID coordinates globally. MAP-SRI-for-SM requests allow diverting incoming SMS 2FA authorization codes.
⚡ Vulnerability & Exploit Flow
Exploit Vector:
Unverified MAP-ATI cell location query & MAP-MT-ForwardSM interception.
🛡️ Recommended Defense & Mitigation Protocol
Operator Hardening Strategy:
Deploy GSMA Category 1, 2, and 3 SS7 Firewalls with velocity checking.
🚨 Security Impact & Geopolitical Consequence
Triggered GSMA FS.11 Signaling Firewall guidelines.
📚 Authoritative Standards & External References
TelcoSec Academy Ecosystem · app.telcosec.net
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy (https://app.telcosec.net/) to access interactive lab challenges, earn verified skill badges, and level up your cybersecurity career.
✓Hands-on SS7 & Diameter Signaling Firewalls
✓5G SA Zero Trust Security Architecture
✓Sync Read-to-Earn XP directly to your profile
🎁 Claim +100 Welcome Bonus XP
🎓 Create Free Account on app.telcosec.net→Instant access to free labs · No credit card required