SS7 protocol trust models assume all connected telecom carriers are benevolent, enabling sophisticated adversaries to intercept SMS verification codes remotely.
Signaling System 7 (SS7) was designed in the 1970s for routing calls between trusted state-owned monopolies. Today, thousands of private carriers, MVNOs, and aggregators have SS7 access, creating massive signaling interception risks for SMS-based authentication.
1 The SendRoutingInfoForSM Interception Attack
When an SMS is dispatched, the sending switch queries the Home Location Register (HLR) using SRI-SM (Send Routing Info for Short Message) to locate the recipient's serving MSC. Threat actors with leased SS7 signaling access forge updateLocation requests to redirect incoming SMS to their own virtual receiver.
Frequently Asked Questions • Telecom Regulations & A2P 10DLC
End users cannot block SS7 attacks directly. Protection requires switching to app-based TOTP or hardware security keys (FIDO2) for high-value accounts.