The SMS firewall (Module 5) is one member of a family. Each generation has its own signalling protocol, its own border, and its own attacks. A firewall is placed where the operator meets the outside world.
1. Signalling per generation — and what protects it
| Gen | Interconnect protocol | Typical weakness | Border protection |
|---|---|---|---|
| 2G / 3G | SS7 (MAP, CAP, ISUP) over TDM or SIGTRAN | No authentication between operators — "if you're on the network, you're trusted" | SS7 firewall (STP / signalling firewall) |
| 4G | Diameter (S6a, S6d, Gx…) over IPX | Same trust model; origin-host/realm spoofing | Diameter firewall / DEA (Diameter Edge Agent) |
| 4G/5G NSA data roaming | GTP-C / GTP-U (S8, Gp) | Tunnels accepted from any partner; fake Create Session | GTP firewall |
| IMS / VoLTE | SIP | Spoofed caller ID, toll fraud, registration hijack | SBC, STIR/SHAKEN |
| SMS A2P | SMPP / HTTP | Fake senders, SMS pumping (AIT), phishing | SMS firewall (A2P and P2P) |
| 5G SA | HTTP/2 over N32 | Misconfigured roaming, supply-chain | SEPP with N32-c/N32-f and PRINS |
GSMA documents: FS.11 SS7 interconnect security monitoring · FS.19 Diameter interconnect security · FS.20 GTP security · FS.21 interconnect signalling security (the master doc) · FS.07 SS7 / SIGTRAN security. FS.52 GT and Diameter end-point address leasing code of conduct. Also IR.88 (LTE roaming), IR.92 (VoLTE profile).
2. Layered firewall logic (the same idea for every protocol)
The standard GSMA categorisation of signalling messages:
| Category | Test | Action |
|---|---|---|
| Category 1 | Should never arrive from outside (e.g. an external party sending a home-only operation) | Block |
| Category 2 | Should come only from a node that is really where the sender says (location sanity check) — e.g. the subscriber is not in that country | Block if the sender is not the real serving node |
| Category 3 | Valid, but dangerous if too frequent or inconsistent (e.g. velocity/location) | Cross-check: time, distance, history |
Further checks: whitelists/blacklists of GTs and operators, rate limits, format validation, counters per MSISDN, home-routing (hide the real HLR/MSC by returning the SMSC/GMSC address instead), sender-ID checks, spam content analysis, machine-learning anomaly detection.
3. The attack catalogue
| Attack | How it works | Gen | Defence |
|---|---|---|---|
| Location tracking | Send SRI / ATI / PSI / SRI-SM to learn the subscriber's cell or MSC | 2G/3G | Block ATI/PSI; SRI-SM home routing |
| SMS interception | Re-register the victim at a fake MSC (UpdateLocation) so MT-SMS (OTP, 2FA) go to the attacker | 2G/3G | Cat-2 check on UpdateLocation; SS7 FW |
| Call interception / redirection | Fake MSRN or InsertSubscriberData with a forwarding number | 2G/3G | Cat-1/2 blocking of ISD/PRN |
| Denial of service | Cancel Location, flood of MAP traffic | all | Rate limit, authenticate |
| USSD abuse | Send USSD requests (balance, forwarding) via SS7 | 2G/3G | Filter ProcessUnstructuredSS |
| Diameter location | Update-Location / ULR, IDR, AIR from a roaming partner | 4G | Diameter FW, realm/host checks |
| IMSI catcher / Stingray | Fake base station; downgrades to 2G, grabs IMSI/IMEI, can intercept | 2G–4G | Disable 2G; SUCI in 5G; detect rogue cells |
| GTP fraud | Create sessions with stolen IMSI, data theft, hijacked tunnels | 4G | GTP FW; IMSI/IP validation |
| SIM swap / port-out fraud | Social-engineering to move the number | all | Customer verification, port-out locks |
| SIM box (bypass) fraud | Gateways with SIM cards convert VoIP calls into local calls, bypassing interconnect fees | voice | Test-call detection, CDR analytics |
| Wangiri | "One-ring" scam calls luring people to call back premium numbers | voice | Pattern detection, blocking |
| IRSF | International Revenue Share Fraud — pumping traffic to premium numbers | voice/SMS | Real-time limits, blocklists |
| Toll fraud / PBX hacking | Hacked PBX calls expensive numbers | voice | Limits |
| CLI spoofing, robocalls | Fake caller ID | voice | STIR/SHAKEN, CLI validation |
| SMS spoofing (fake sender ID) | Alphanumeric sender faked ("YourBank") | SMS | Sender-ID registries, firewall |
| Smishing | SMS phishing | SMS | Content/URL filtering |
| SMS pumping / AIT | Bots trigger OTP SMS to numbers owned by the fraudster who shares the revenue | A2P | Rate limits, firewall, CAPTCHAs |
| Grey routes | Messages sent through unauthorised/cheap paths, losing quality & security | A2P | Firewall, blocking unknown SMSC |
| Flooding / spam | Mass SMS | SMS | Throttle, reputation |
| Silent SMS (Type 0) | Invisible SMS used for tracking / paging | SMS | Detect and filter |
| Simjacker / WIBattack | Malicious SMS to exploit the SIM Toolkit | SMS/SIM | Filter binary SMS, SIM hardening |
| SIP registration hijack / flooding | Take over IMS registration; INVITE floods | IMS | SBC, rate limit |
| Lateral attack from compromised partner | Compromised roaming partner is trusted | all | Firewalls on all interconnect protocols |
| Supply-chain / vendor backdoors | Hidden access in equipment | 5G | Vendor policy, audits (EU 5G toolbox) |
| API abuse (NEF) | Misuse of exposure APIs | 5G | OAuth2, authorization |
| Slice isolation breach | Cross-slice access | 5G | Segmentation |
4. The firewall family at a glance
| Firewall | Protects | Typical position | Decides on |
|---|---|---|---|
| SS7 / SIGTRAN firewall | MAP/CAP/ISUP | At the STP, on every international link | Operation code, GT, IMSI, location logic |
| Diameter firewall (DEA/DRA) | Diameter | On IPX/roaming link | Command code, Origin-Host/Realm |
| GTP firewall | GTP-C/GTP-U | On GRX/IPX | Session validity, IMSI/TEID, source |
| SMS firewall (P2P) | Person-to-person SMS | At the SMSC / SS7 | MT-/MO-forwardSM, sender, spoof checks |
| SMS firewall (A2P) | Business traffic | At the SMPP / HTTP gateway | Sender ID, content, route, rate |
| SBC | SIP/RTP | Network edge | Topology hiding, malformed SIP, DoS |
| SEPP | 5G N32 | Border of 5GC | Mutual TLS, PRINS integrity |
| Fraud Management System (FMS) | Revenue | Offline on CDRs | Patterns: Wangiri, IRSF |
| Next-gen / combined firewall | All of the above | Unified | One policy engine |
| NGFW / WAF / DDoS scrubbing | IT side: portals, APIs | Internet edge | Web and IP threats |
5. A2P vs P2P — the economics
| P2P | A2P | |
|---|---|---|
| Who sends | Person | Application: banks, shops, 2FA services |
| Route | Home SMSC | SMPP via aggregators / hubs |
| Revenue | Bundled | Per-message termination fee — attractive to bypass |
| Threat | Spoofing, phishing | Grey routes, pumping, fake senders |
Remember this: every generation moved the trust boundary but not the principle. Put a gatekeeper at every operator border, check every message against the subscriber's real state (where is the phone? does it exist? is this node allowed to ask?), then rate-limit what's left. SS7, Diameter, GTP, SIP, SMPP and SEPP are six doors of the same house.
Go deeper: attacks are explained step by step (mechanism → why it works → how it looks → defence) in Module 25 (signalling), Module 27 (messaging, radio, SIM, fraud, infrastructure, real incidents); every firewall type and its rules are in Module 26.