Back to SS7 Attacks
High Severity Vulnerability

SS7 Service Disruption Attacks

Attacks aimed at disrupting subscriber services and network availability through malicious SS7 signaling messages. These attacks can cause immediate loss of mobile services including calls, SMS, and data.

Service Disruption Attack Flow
Visual representation of SS7 service disruption attack sequence showing CancelLocation, PurgeMS, and DeleteSubscriberData operations
SS7 service disruption attack flow diagram showing CancelLocation, PurgeMS, and DeleteSubscriberData attacks causing subscriber service disruption
CancelLocation Attack
High
Forces subscriber detachment from network causing immediate service loss

CancelLocation (CL) attacks force a subscriber to be detached from the network by sending malicious CL messages to the serving VLR. This causes the subscriber to lose all mobile services until they re-register with the network.

Impact:

  • • Immediate loss of all mobile services
  • • Cannot make or receive calls
  • • Cannot send or receive SMS
  • • Data services unavailable
  • • Requires manual re-registration

Attack Sequence:

  1. Attacker sends CancelLocation to serving VLR
  2. VLR removes subscriber registration
  3. Subscriber loses all network services
  4. Device must re-register to restore services
PurgeMS Attack
Medium
Removes subscriber data from VLR causing service unavailability

PurgeMS attacks remove subscriber data from the VLR, causing service disruption. The HLR marks the subscriber as "not reachable," preventing call and SMS delivery until the subscriber re-registers.

Impact:

  • • Subscriber marked as unreachable in HLR
  • • Incoming calls and SMS cannot be delivered
  • • Outgoing services may still function
  • • Requires re-registration to restore services
DeleteSubscriberData Attack
High
Removes specific services causing selective service disruption

DeleteSubscriberData (DSD) attacks remove specific services or profile information from the subscriber's record, causing selective service disruption. This can disable specific features like call forwarding, roaming, or data services.

Impact:

  • • Selective service disruption
  • • Can disable specific features
  • • May affect roaming capabilities
  • • Can disable data services
  • • Service restoration requires profile update

Detection and Mitigation

SS7 Firewall Protection

Deploy SS7 firewalls to filter unauthorized service disruption operations. Block CancelLocation, PurgeMS, and DeleteSubscriberData from untrusted sources.

Firewall Rules:

  • • Block CancelLocation from non-HLR sources
  • • Restrict PurgeMS operations
  • • Filter DeleteSubscriberData requests
  • • Implement source verification
Monitoring and Detection

Monitor SS7 traffic for suspicious service disruption operations. Detect anomalies in subscriber detachments and service removals.

Detection Indicators:

  • • Unusual CancelLocation patterns
  • • Mass subscriber detachments
  • • Unexpected service removals
  • • Abnormal PurgeMS operations
Related Security Resources