IkerJul 19
Zack Whittaker

New, by me: A Middle East surveillance vendor has been caught exploiting a new attack in SS7, a set of protocols used by phone carriers, that can trick a phone operator into disclosing a person's phone location without their knowledge.

https://techcrunch.com/2025/07/18/a-surveillance-vendor-was-caught-exploiting-a-new-ss7-attack-to-track-peoples-phone-locations/

A surveillance vendor was caught exploiting a new SS7 attack to track people's phone locations | TechCrunch

The new SS7 bypass attack tricks phone operators into disclosing a cell subscriber's location, in some cases down to a few hundred meters.

TechCrunch
Jul 18 at 6:54pmWeb
Show threadnemo™ 🇺🇦Jul 18
@zackwhittaker Hi. Is there anything one can do to mitigate this? Kind regards.
Show threadZack WhittakerJul 18
@nemo hello, i make a note of this in the story!
Show threadnemo™ 🇺🇦Jul 18
@zackwhittaker Thank you ✅ 💡 👍
Show threadScott FrancisJul 18
@zackwhittaker it's the protocol that keeps on giving (if you're an attacker anyway). Oof.
Show threadNosirrahSec 🏴‍☠️ guillotine enthusiastJul 18
@darkuncle @zackwhittaker the limp dick Saudi animal that put the hit out on Jamal Kashoggi is already using this, most likely.
Show threadNosirrahSec 🏴‍☠️ guillotine enthusiastJul 18
@darkuncle @zackwhittaker I'm sure he's doing great business with billionaires being so readily bribed in this current government
Show threadFrobbotzimJul 18
@darkuncle @zackwhittaker I'm recalling troubleshooting slow STP links 20 or so years back, being promised that everything would be Diameter soooooon... Article does paint a picture of the cui bono situation, doesn't it? Sigh.
Show threadBrokarJul 18
@zackwhittaker So, my understanding is this: the carriers did not do anything to mitigate this since 2017 because their governments all use this also to track individuals.
I don't think that the excuse with patchwork carriers works. If this was serious, they'd have it fixed already. Globally.
Always ask: qui bono?
Show threadSpaceLifeFormJul 19

@zackwhittaker

How is this 'new'?

Btw, I tried to read the article on mobile, which failed, so I have to assume it works.

#SS7

Show threadMatt FranzJul 19
@zackwhittaker ASN.1 - Every Damn Time.
Show threadSimply SimonJul 19
@zackwhittaker Sounds like they used ATI (Any Time Inquiry) to me. Most carriers lock that down so it can only be used by own GTs.
Show threadMartinJul 19

@zackwhittaker There was a great talk by Tobias Engel at 31c3 on this.

https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel

SS7: Locate. Track. Manipulate.

media.ccc.de
Show threadgaryJul 19
@zackwhittaker they don't fix the ss7 baseband attacks for well reasons
Show threadReayJul 19
@zackwhittaker @evacide
@FirewallDragons
Show threadRichardJul 20
@zackwhittaker What's particularly interesting is that customers shouldn't ever have access to any SS7 data stream.