Location Tracking: Impersonate SS7 Nodes

ID Name
T1430.001 Remote Device Management Services
T1430.002 Impersonate SS7 Nodes

Adversaries may exploit the lack of authentication in signaling system network nodes to track the to track the location of mobile devices by impersonating a node.[1][2][3][4][5]

By providing the victim’s MSISDN (phone number) and impersonating network internal nodes to query subscriber information from other nodes, adversaries may use data collected from each hop to eventually determine the device’s geographical cell area or nearest cell tower.[1]

ID: T1430.002
Sub-technique of:  T1430
Tactics: Collection, Discovery
Platforms: Android, iOS
Version: 1.0
Created: 05 April 2022
Last Modified: 21 October 2022

Procedure Examples

ID Name Description
S0602 Circles

Circles can track the location of mobile devices.[6]


ID Mitigation Description
M1014 Interconnection Filtering

Filtering requests by checking request origin information may provide some defense against spurious operators.[7]


Network carriers may be able to use firewalls, Intrusion Detection Systems (IDS), or Intrusion Prevention Systems (IPS) to detect and/or block SS7 exploitation.[7] The CSRIC also suggests threat information sharing between telecommunications industry members.