Signalling System No. 7 (SS7)

SS7 (Signalling System No. 7) is the set of protocols that telephone networks use to exchange control messages with each other: setting up and ending calls, routing SMS, looking up where a mobile subscriber is registered, and supporting roaming and number portability. It carries the conversation about a call, not the call itself. It was standardised by the ITU (then CCITT) from the 1980s. ITU-T Q.700 is the introduction to the series.

#What does SS7 do in a mobile network?

In 2G and 3G mobile networks, the MAP (Mobile Application Part) protocol runs on top of SS7 and is specified by 3GPP in TS 29.002. MAP messages let networks:

• ask a subscriber's home register where to deliver an SMS or call;
• update the home network when a subscriber roams onto another network;
• check whether a subscriber is reachable.

An HLR lookup uses the same kind of routing query to find out whether a number is live, without sending anything to the phone.

4G networks use the Diameter protocol for similar functions, and 5G uses HTTP-based service interfaces with a dedicated security edge between operators. SS7 remains in service for 2G and 3G and for interconnection between many networks.

#Why is SS7 a security risk?

SS7 was designed when only a small number of trusted operators were connected. It assumes that anyone who can send signalling messages is entitled to. Today, access to the global signalling network is far wider, through many operators, resellers and service providers.

At a high level, abuse of that trust has been publicly associated with three risk classes:

• Location disclosure: learning which network area a subscriber is in.
• Interception or redirection of SMS and calls, including one-time passcodes.
• Disruption, such as making a subscriber unreachable.

The EU cybersecurity agency ENISA assessed signalling security in its report Signalling Security in Telecom SS7/Diameter/5G (March 2018) and found "a medium to high level of risk". Operators respond with signalling firewalls and monitoring, following industry guidelines such as those of the GSMA. Protection levels vary by operator and country.

#What does this mean for SMS-based authentication?

It is one reason SMS codes are considered a weaker factor. NIST's digital identity guidelines (SP 800-63B-4) classify one-time codes sent over the phone network as a restricted authenticator and require verifiers to offer alternatives. Practical steps:

1. Offer stronger factors, such as passkeys, authenticator apps or hardware keys, and encourage them for high-value accounts.
2. Step up when other signals look unusual, such as a new device, a recent SIM swap or a number port.
3. Limit what an SMS code can do, for example not allowing it alone to change payout details.

#How does MobileValidate handle signalling data?

MobileValidate's upcoming HLR lookup will ask only whether a number is reachable, ported or roaming, and on which network. It will never return or store the IMSI, switch or register addresses, or cell and location codes, and it will report roaming only as a flag or a country. MobileValidate doesn't offer location tracking or interception of any kind. See account security for how number signals fit into takeover defences.