Back to SS7 Attacks
Critical Security Vulnerability

SS7 Location Tracking Attacks

Techniques to track subscriber location without their knowledge or consent using SS7 MAP protocol operations. These attacks enable real-time location monitoring, surveillance, and tracking of mobile subscribers.

Location Tracking Attack Flow
Visual representation of SS7 location tracking attack sequence showing how attackers exploit MAP protocol operations to determine subscriber location
SS7 location tracking attack flow diagram showing the sequence from attacker to HLR to MSC/VLR returning location information
SendRoutingInfoForSM Attack
Critical
Exploits SMS routing mechanism to determine subscriber location

The SendRoutingInfoForSM (SRI-SM) attack exploits the SMS routing mechanism to determine a subscriber's current location. Attackers send SRI-SM messages to the target's Home Location Register (HLR), pretending to deliver an SMS message. The HLR responds with the subscriber's IMSI and current serving MSC address, revealing their approximate location.

Technical Details:

  • • Exploits MAP protocol's SMS routing functionality
  • • Requires only the target's phone number (MSISDN)
  • • Returns IMSI and serving MSC/VLR address
  • • Can be performed remotely with SS7 network access
  • • Location accuracy: Network-level (city/region)
  • • Minimal detection footprint on target device

Attack Sequence:

  1. Attacker sends SendRoutingInfoForSM request to target's HLR
  2. HLR queries serving MSC/VLR for subscriber location
  3. HLR returns IMSI and MSC/VLR address to attacker
  4. Attacker can map MSC/VLR to geographic location

Real-World Impact:

Used by NSO Group's Pegasus spyware for initial target location before deploying mobile malware. Also exploited in the 2016 60 Minutes CBS investigation that tracked German politicians. This attack is particularly dangerous because it requires only a phone number and SS7 network access.

CVE-2014-0016Discovered by Tobias Engel (SRLabs)Category: Cat-1 Attack
AnyTimeInterrogation Attack
Critical
Provides precise cell-level location information for continuous tracking

AnyTimeInterrogation (ATI) is a more sophisticated location tracking method that provides precise cell-level location information. After obtaining the IMSI through SRI-SM, attackers send ATI requests to the HLR, which forwards the request to the serving MSC/VLR. The response includes Cell Global Identity (CGI), providing location accuracy of 50m-2km depending on cell density.

Technical Details:

  • • Provides Cell Global Identity (CGI) information
  • • Includes timing advance for distance calculation
  • • Can reveal subscriber state (active, idle, roaming)
  • • Minimal detection footprint on target device
  • • Location accuracy: Cell-level (50m-2km)
  • • Requires IMSI obtained from SRI-SM attack

Attack Sequence:

  1. Obtain target's IMSI via SendRoutingInfoForSM
  2. Send AnyTimeInterrogation request to HLR with IMSI
  3. HLR forwards request to serving MSC/VLR
  4. MSC/VLR returns Cell Global Identity (CGI)
  5. Attacker maps CGI to precise geographic location

Real-World Impact:

Used by intelligence agencies for surveillance operations. Enables continuous tracking as subscribers move between different network areas. The high location accuracy makes this attack particularly dangerous for high-value targets.

CVE-2014-0017Discovered by P1 SecurityCategory: Cat-1 Attack
ProvideSubscriberInfo Attack
High
Requests detailed subscriber location and status information directly from serving MSC/VLR

ProvideSubscriberInfo (PSI) requests detailed subscriber location and status information directly from the serving MSC/VLR. This attack provides comprehensive data including cell location, subscriber state, and service information.

Information Obtained:

  • • Current cell location (CGI)
  • • Subscriber state (active call, idle, etc.)
  • • IMEI (device identifier)
  • • Service information and capabilities
  • • Location age (time since last update)
  • • Roaming status and network information

Technical Details:

  • • Direct query to serving MSC/VLR
  • • Provides comprehensive subscriber data
  • • Higher accuracy than SRI-SM
  • • Can reveal active call information
  • • Requires positioning in signaling path or HLR access
Combined Attack Scenarios
Advanced attack techniques combining multiple location tracking methods

Attackers often combine multiple SS7 location tracking techniques to achieve continuous, precise surveillance. These combined attacks provide real-time location monitoring with high accuracy.

Multi-Stage Location Tracking:

  1. Initial location via SendRoutingInfoForSM (network-level accuracy)
  2. Precise location via AnyTimeInterrogation (cell-level accuracy)
  3. Continuous monitoring via repeated ATI requests
  4. Subscriber state monitoring via ProvideSubscriberInfo

Real-World Application:

Used in sophisticated surveillance operations where continuous tracking is required. The combination of SRI-SM for initial location and ATI for precise tracking enables real-time monitoring without device compromise.

Real-World Case Studies

German Politicians Surveillance (2016)
60 Minutes CBS Investigation
High Profile

In a groundbreaking 60 Minutes CBS investigation, security researchers demonstrated live SS7 exploitation by tracking German politicians' locations and intercepting their communications. The demonstration used only the targets' phone numbers and SS7 network access, revealing the ease with which these attacks can be performed.

Attack Methods Used:

  • • SendRoutingInfoForSM for location tracking
  • • Real-time location monitoring
  • • Call and SMS interception capabilities demonstrated
Location TrackingCall InterceptionPublic Demonstration
NSO Group Pegasus SS7 Integration (2017-2021)
Citizen Lab Research
State-Sponsored

Research by Citizen Lab revealed that NSO Group's Pegasus spyware used SS7 vulnerabilities as part of its attack chain. SS7 was used for initial target location before deploying mobile malware, enabling sophisticated surveillance operations against journalists, activists, and political figures worldwide.

Attack Chain:

  1. SS7 location tracking to identify target's current network
  2. Network-specific exploit delivery
  3. Spyware installation on target device
  4. Ongoing surveillance and data exfiltration
Location TrackingTargeted SurveillanceMalware Deployment

Detection and Mitigation

SS7 Firewall Protection

Deploy SS7 firewalls to filter unauthorized location query operations. Block SendRoutingInfoForSM, AnyTimeInterrogation, and ProvideSubscriberInfo requests from untrusted sources.

Firewall Rules:

  • • Block SRI-SM from non-SMSC sources
  • • Restrict ATI to authorized services only
  • • Filter PSI requests by source Global Title
  • • Implement rate limiting on location queries
Monitoring and Detection

Monitor SS7 traffic for suspicious location query patterns. Detect anomalies such as repeated queries for the same subscriber or queries from unusual sources.

Detection Indicators:

  • • High frequency of location queries
  • • Queries from non-SMSC sources
  • • Unusual query patterns
  • • Repeated queries for same subscriber
Related Security Resources