BleepingComputer has an explainer on signaling attacks, and it’s a good reminder of why SMS codes aren’t real security.
What they are
Carriers use signaling protocols to find your phone and route calls, texts and data between networks. SS7 dates to the 1970s (2G/3G), and Diameter handles 4G. Both largely trust any carrier on the network. Anyone who gets access, whether a shady operator, a surveillance vendor or a criminal, can track your location, intercept SMS codes and impersonate your number. No malware needed.
It’s real
- Citizen Lab exposed two long-running surveillance campaigns abusing SS7 and Diameter, with thousands of attacks.
- Criminals have intercepted SMS one-time passcodes to drain bank accounts.
- Rep. Ted Lieu’s phone was hacked via SS7 on 60 Minutes Australia, and Veritasium hijacked an influencer’s calls and texts with just his number.
My take
This has been broken for decades and carriers still can’t reliably stop it, so protect yourself. Move off SMS two-factor wherever you can: use passkeys, an authenticator app or a hardware key. Use end-to-end encrypted messaging for anything sensitive. Heads-up: the article ends by pitching a carrier’s paid service, so read it as an explainer, not a buying guide.
God Bless, and Needs Garlic!
