Uncovering Global Telecom Exploitation by Covert Surveillanc...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/
• Blog Title: Uncovering Global Telecom Exploitation by Covert Surveillance Actors
• Suggested Section: Pentesting Network -> Telecom Network Exploitation (add subsections for SS7/Diameter roaming abuse, Diameter header spoofing/route steering, combined-attach SS7↔Diameter pivoting, and SIM/UICC hidden-SMS command tracking)

🎯 Content Summary

Title / scope
Citizen Lab investigates two distinct covert surveillance actors ("telecom surveillance actors"), STA1 and STA2, abusing systemic weaknesses in international mobile signalling—SS7 (3G/legacy but still used for roaming/SMS/emergency) and Diameter (4G and most 5G roaming)—plus (in STA2) direct device/SIM interaction via a specially formatted SMS. This is not a single CVE; the “vulnerability” is the trust-based roaming ecosystem + incomple...

🔧 Technical Details

Cross-protocol signalling pivoting (SS7 ↔ Diameter) enabled by “combined attach”: When roaming devices can register concurrently on 3G and 4G (combined attach), an attacker with signalling access can alternate SS7 and Diameter operations to bypass partial firewall coverage. Practically, this means trying SS7 queries (e.g., sendRoutingInfoForSM for IMSI discovery, provideSubscriberInfo bursts for location state, then escalating to anyTimeInterrogation) and, if blocked, switching to Diameter messages (e.g., Insert-Subscriber-Data-Request) that request location-related attributes (TAI/ECGI, RAT type, local time zone). The pivot increases success probability because operators often deploy uneven protections across SS7 vs Diameter.

SS7 surveillance injection using operator Global Titles + entry-point discovery via OPC/IR.21 mismatch: SS7 messages route by GT and traverse STPs. Because SS7 lacks strong source authenti...

🤖 Agent Actions

I’m mapping the repo first and then I’ll read the most relevant telecom, mobile, and network pages before deciding whether this belongs in an existing file or needs a new one.
There is already a dedicated telecom-network-exploitation.md, so I’m checking that first and comparing it with neighboring network and mobile pages to avoid duplicating techniques already documented elsewhere.
The existing telecom page is already the right scope. I’m now checking whether SS7, Diameter, and SIM/SMS tracking techniques are missing there versus being covered elsewhere, so the update stays in one file and avoids overlap.
I’ve confirmed the destination file and the main gap: the page covers GTP and some 5G control-plane issues, but it does not yet cover SS7/Diameter roaming abuse, cross-protocol attach pivots, or hidden SIM-command SMS tracking.
I have enough source detail now. One last pass is checking whether HackTricks already documents OTA/SIM-command SMS mechanics elsewhere, because that determines how specific I can be without creating overlap.
I’m patching the existing telecom page now. The change will stay in that single file, broaden the page scope from GTP-only roaming abuse to include SS7/Diameter signalling tradecraft, and append a compact detection-focused section plus the new reference.
Updated telecom-network-exploitation.md in place. I kept everything in that single file and added a new section covering SS7/Diameter roaming surveillance tradecraft: combined-attach SS7↔Diameter pivoting, SS7 GT abuse with OPC vs IR.21 mismatch analysis, Diameter Origin-Host/Origin-Realm/Route-Record route steering, signalling artefact fingerprinting (TID/Session-Id reuse), and hidden SIM/UICC SMS-based tracking. I also broadened the page title so the scope matches the content and appended the Citizen Lab article to ## References.

Verified with git diff, sed, and rg that the content landed once, the references section is still at the end, and no extra files or links were needed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Network -> Telecom Network Exploitation (add subsections for SS7/Diameter roaming abuse, Diameter header spoofing/route steering, combined-attach SS7↔Diameter pivoting, and SIM/UICC hidden-SMS command tracking)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0