Module 25 covered attacks that arrive over the interconnect. This module covers everything else: what happens at the user's phone, on the air, on the SIM, in the business process, and inside the operator's IT. As before: mechanism → why it works → how it shows → defence. Described at the level of public research and reporting; test only in your own authorised lab.
1. Messaging attacks (SMS, MMS, RCS)
| Attack | Mechanism | Why it works | Defence |
|---|---|---|---|
| Smishing (SMS phishing) | Message with link to a fake bank/parcel/tax page; often impersonates a brand with an alphanumeric sender ID | SMS is trusted; links hard to verify on phones | SMS FW content/URL filtering, sender-ID registries, takedown of domains, user education, report to 7726 where available |
| Sender-ID spoofing and thread injection | Alphanumeric sender IDs aren't unique, so a fake "MyBank" message can land inside the real MyBank thread on the phone | No cryptographic authentication in SMS | Sender-ID protection registries (UK, Singapore, etc.), allow-listing, rich messaging with verified brands (RCS) |
| SMS pumping / AIT | Bots trigger "send me a code" forms for numbers on routes the fraudster earns from (revenue share) | Operators pay termination fees per SMS | Rate limits, geo-blocks, CAPTCHA, OTP provider fraud scoring, firewall analytics |
| Flooding / SMS bombing | Mass messages to a victim (DoS) | Many free SMS APIs | Per-destination rate limits, filtering |
| Silent SMS (Type 0) tracking | Invisible SMS makes the phone answer, letting a tracker locate it via the network | Phone must acknowledge | Firewall blocks Type 0 from outside; unusual volume detection |
| Binary / OTA SMS attacks | Malicious "SIM toolkit" messages (Simjacker via S@T Browser; WIBattack via Wireless Internet Browser) trigger SIM commands such as location query or call | SIM executes commands from SMS without user interaction | Filter binary SMS from outside; SIM-level security level (MSL), replace vulnerable SIM applets |
| WAP push / MMS exploits | Parsing flaws in message handlers (e.g. Stagefright 2015 on Android) | Phones auto-process media | Device patches, disable auto-retrieval, network content filtering |
| SMS gateway account compromise | Stolen API keys/SMPP credentials from a company used to send spam/pumping | Weak credential hygiene | Key rotation, IP allow-listing, spend caps, anomaly alerts |
| Grey routes | Commercial A2P sent over cheap P2P/SIM-farm channels | Price arbitrage | Route monitoring, test-message systems, firewall rules |
| SMS interception by malware | Mobile malware reads OTP SMS (banking trojans) | Android permissions abuse | App-based 2FA/FIDO2, OS protections, Play Protect |
| RCS issues | Spam, spoofed business agents; older RCS relays unencrypted | New channel, new abuse | Verified sender programmes, E2EE (RCS Universal Profile with MLS) |
2. Radio-side attacks (the firewall cannot see these)
| Attack | Mechanism | Defence |
|---|---|---|
| IMSI catcher / "Stingray" | A fake base station with the strongest signal makes phones attach; it can request the IMSI/IMEI, push phones to 2G (no mutual auth, weak cipher), and intercept or relay | Disable 2G (operator and handset settings), 5G SUCI, rogue-cell detection (RF scanners, app/ network analytics), phone settings (2G off) |
| Downgrade attacks | Jamming 4G/5G so the phone falls back to 2G/3G | 2G switch-off, "LTE-only" modes, anomaly detection on frequent RAT changes |
| SMS blasters | Fake 2G base stations in cars/backpacks that broadcast phishing SMS directly to phones nearby; never touch the operator's network, so firewalls are blind | Disable 2G on phones, regulator enforcement with direction finding, public warnings |
| Rogue eNB/gNB relay (MITM) | Man-in-the-middle between phone and real network; reported research on user-plane manipulation | Integrity protection of user plane (5G optional), strong security configuration |
| A5/1 cracking | Rainbow tables / known-plaintext attacks make passive GSM decryption practical (public research 2009+) | Use A5/3 (KASUMI), retire 2G |
| Paging-based tracking | Observing paging messages tied to a phone's temporary identity (e.g. ToRPEDO research on 4G) to learn presence in a cell | Randomise paging occasions, shorter-lived identifiers, 5G improvements |
| aLTEr / IMP4GT (research) | LTE user-plane ciphering without integrity protection allowed bit-flipping (aLTEr: DNS redirection) or injection | Enable user-plane integrity (5G), use TLS/DNSSEC end to end |
| Jamming and spoofing | Noise on the frequency (jamming) or fake GNSS signals | Spectrum monitoring, multi-constellation + inertial backup, PTP holdover |
| Baseband vulnerabilities | Bugs in the phone modem firmware allow code execution remotely (public examples include Exynos modem bugs and 5G modem research such as "5Ghoul") | Device patching, network-side fuzz filters, vendor updates |
| DoS on radio | Excessive RACH, malformed RRC | Overload control, access barring (ACB/UAC) |
| Wi-Fi attacks | KRACK (2017), evil twin, rogue hotspots | WPA3, 802.1X, HTTPS/VPN |
| Bluetooth attacks | BlueBorne (2017), KNOB, BIAS | Patching, secure pairing |
| NFC relay / skimming | Relay a contactless payment | Limits, distance bounding, secure elements |
3. SIM, eSIM and identity attacks
| Attack | Mechanism | Defence |
|---|---|---|
| SIM swap (SIM-jacking) | Fraudster convinces operator staff (or an insider is paid) to move the victim's number to a new SIM, then receives all SMS/calls | Strong customer verification, cooling-off period, alerts to old SIM/email, port-out PIN, restricted high-risk operations, insider monitoring, bank checks via SIM-swap APIs (e.g. GSMA Open Gateway "SIM Swap" API) |
| eSIM swap / activation-code abuse | Stolen activation QR/code or account takeover used to download the victim's eSIM profile on the attacker's device | MFA, notifications, approval on existing device |
| Port-out fraud | Number ported to another operator without consent | Port-out authorisation PINs, regulator rules |
| SIM cloning (historic) | Weak COMP128v1 allowed key extraction (GSM, 1998) | Modern algorithms (MILENAGE) |
| SIM OTA key cracking | Old SIMs using 56-bit DES for OTA keys allowed remote SIM compromise (public research 2013) | Replace with 3DES/AES SIMs, enforce OTA security |
| SIM toolkit abuse | Simjacker/WIBattack | See messaging section |
| IMEI tampering / stolen phones | Changing IMEI to bypass blacklists | EIR/CEIR central registry, device integrity checks |
| Account takeover of operator portals | Credential stuffing, OTP interception | MFA, bot detection, device binding |
| Insider abuse | Staff looking up subscriber data or enabling LI wrongly | Role-based access, logging, anomaly detection, audits |
| Social engineering at retail/call centres | Impersonation, fake IDs | Scripts, verification steps, training |
| SS7-based SIM swap evidence | Many SIM swaps are followed by UL/CL pairs | Fraud analytics |
4. Fraud schemes (business-process attacks)
| Fraud | How it works | Detection / defence |
|---|---|---|
| Wangiri ("one ring") | Robot calls thousands, hangs up after one ring; victims call back a premium or international revenue-share number | Short-call pattern analytics, block known ranges, customer warnings |
| IRSF (International Revenue Share Fraud) | Fraudster rents number ranges at high-cost destinations and pumps traffic (often through hacked PBXs or stolen SIMs); shares revenue | Real-time destination limits, high-risk range lists, spend caps, quick blocking; IRSF databases (e.g. i3 Forum) |
| SIM box / bypass fraud | Calls delivered via internet to a gateway holding local SIMs and re-injected as local calls, bypassing interconnect fees | Test-call robots, CDR analytics (long calls, many outbound destinations, static location), SIM blocking |
| PBX hacking / toll fraud | Weak SIP/PBX credentials exploited to place expensive calls | Strong passwords, SBC, destination barring |
| Subscription fraud / identity theft | Fake or stolen identity used to get devices on instalment and service | KYC, device-financing risk checks, ID verification |
| Premium-rate service fraud | Subscribing users to paid SMS/WAP billing without consent | Double opt-in, billing audits |
| Roaming fraud | Abuse of delay in roaming bills (high-usage, NRTRDE) | Near real-time roaming data exchange, limits |
| Voicemail fraud/hacking | Default PINs and CLI spoofing used to open voicemail (or to receive OTP voice calls) | PIN policy, disable remote access without PIN |
| False answer supervision | Interconnect carrier signals "answered" without real answer to bill early | Carrier checks, CDR reconciliation |
| Traffic pumping / access stimulation | Numbers hosted in expensive-termination ranges are filled with artificial traffic | Wholesale monitoring |
| Vishing & call-centre scams | Calls with spoofed numbers (bank, police, "tech support") | STIR/SHAKEN, call labelling, customer campaigns |
| "Hi Mum" / WhatsApp family-impersonation scams | Messages from unknown numbers pretending to be family | Awareness, platform filters |
| Device fraud | Stolen/blacklisted/refurbished devices; contract/handset financing fraud | EIR blacklists, device checks |
| Revenue leakage (non-fraud) | Misconfiguration or billing errors | Revenue assurance (RA) controls |
5. Infrastructure and IT attacks
| Attack | Mechanism | Defence |
|---|---|---|
| Exposed management interfaces | OAM/EMS web UIs, SSH, SNMP v1/v2c with default strings reachable from the internet (found by scanners) | Management in isolated OOB network, MFA, PAM, SNMPv3 |
| Unpatched edge devices | VPN gateways, routers, firewalls with known CVEs exploited at scale | Patch SLAs, virtual patching, attack-surface monitoring |
| Vendor remote access | Always-on support tunnels with weak controls | Jump hosts, time-boxed access, logging |
| Supply-chain compromise | Malicious update or library (SolarWinds-style) | SBOM, signing, vendor audits (NESAS/SCAS) |
| Ransomware and data theft | Attackers breach billing/CRM and exfiltrate customers' data | Segmentation, backups, EDR, DLP |
| API exposure | Unauthenticated customer APIs (e.g. enumeration of customer IDs) | API gateway, auth on every endpoint, rate limits |
| DDoS | Volumetric/amplification on DNS, portals, or the network | Scrubbing, anycast, BCP38, RTBH |
| BGP hijack / route leak | Wrong announcements divert or blackhole traffic (e.g. Pakistan Telecom vs YouTube 2008) | RPKI ROV, prefix filters, MANRS practices |
| DNS attacks | Cache poisoning, resolver abuse, hijacking | DNSSEC, DoT/DoH, hardening |
| IoT botnets | Mirai compromised hundreds of thousands of routers/cameras | CPE security, default-password bans, ACS hardening |
| Cloud / Kubernetes misconfiguration | Open dashboards, secrets in images | CIS benchmarks, policy engines |
| Lawful interception abuse | Unauthorised use or compromise of LI systems | LI separation, audit, hardened mediation, access logging |
| Insider sabotage/espionage | Privileged staff or contractors | Least privilege, monitoring, background checks |
| Physical attacks | Sabotage of masts, fibre, data centres | Redundancy, monitoring, security |
| Space-segment/ground-station attacks | Hacking satellite modems/gateways (KA-SAT) | Network segmentation, firmware signing |
6. Real incidents and what they teach
| Incident | What happened | Lessons |
|---|---|---|
| Pakistan Telecom / YouTube (2008) | A wrong BGP announcement blackholed YouTube globally | Prefix filtering and RPKI |
| Mirai / Deutsche Telekom (Nov 2016) | A worm exploiting a CPE management protocol took down ~900,000 customer routers | CPE hardening, TR-069/ACS security, rapid patching |
| O2 Telefónica Germany SS7 theft (2017) | Criminals used SS7 to intercept SMS codes and drained bank accounts | SS7 firewalls, move off SMS 2FA |
| SS7 location tracking demonstrations (2014–2016) | Engel/Nohl demos, TV reports showed tracking of a politician's phone | Public pressure → GSMA FS.11, regulator action |
| Twitter CEO SIM swap (2019) | Account hijacked via SIM swap | Operator verification, SIM-swap lock |
| Simjacker (2019) | SMS-based exploitation of SIM toolkit on many SIMs | Filtering binary SMS, SIM security levels |
| Facebook outage (Oct 2021) | BGP/DNS withdrawal after a configuration change took the platform and its own tools offline | Out-of-band access, change control, staged rollouts |
| T-Mobile US breach (2021) | Customer data stolen from servers via an exposed gateway | Perimeter/API security, data minimisation |
| KA-SAT / Viasat (Feb 2022) | Attack on management system bricked tens of thousands of modems | Segmentation, firmware protection, incident drills |
| Optus Australia breach (2022) | An unauthenticated API exposed customer identity data (millions of records) | API authentication, monitoring |
| Twilio / 0ktapus phishing (Aug 2022) | SMS phishing of employees led to internal access | Phishing-resistant MFA (FIDO2), brand-spoofing detection |
| Rogers outage (Canada, Jul 2022) | Core routing change cascaded; emergency services affected | Change management, resilience, 911 continuity |
| Kyivstar (Ukraine, Dec 2023) | Destructive cyber attack took down the largest mobile operator's services for days | Backups, segmentation, wartime resilience |
| Optus outage (Nov 2023) | Routing update after maintenance caused nationwide outage including 000 | Testing, fail-safes, emergency call continuity |
| "Salt Typhoon" (2024) | State-linked group reported to have compromised multiple US/other telecom operators, including lawful interception systems and call metadata | Harden LI, network device patching, encrypted communications for users, public-private cooperation |
| SMS blaster arrests (2023–2025) | Fake base stations in vehicles used for mass smishing in several countries | Disable 2G, enforcement, detection |
(Details of incidents are summarised from public reporting; consult the original reports for full accuracy and updates.)
7. Threat modelling and frameworks
| Framework | Use |
|---|---|
| MITRE ATT&CK | Enterprise tactics/techniques; map IT intrusions |
| MITRE FiGHT | 5G-specific adversary behaviours |
| GSMA FASG / FS.xx | Telecom-specific threats and controls |
| 3GPP SA3 (TS 33.xxx) | Security architecture and features |
| ENISA 5G threat landscape | EU risk assessment |
| NESAS / SCAS | Vendor and product security assurance |
| ISO/IEC 27001, 27011 | Management systems (27011 = telecom) |
| NIST CSF | Identify-Protect-Detect-Respond-Recover |
| STRIDE | Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege |
| Kill chain | Reconnaissance → access → persistence → action → cover tracks; break the chain at the earliest link |
Applying STRIDE to an example (HLR lookup service)
| Threat | Example | Control |
|---|---|---|
| Spoofing | Fake GT sends SRI-SM | Source validation, firewall |
| Tampering | Altering ISD data | Authenticated sources |
| Repudiation | No logs who queried | Logging/audit |
| Information disclosure | IMSI/location leakage | Home routing, minimum disclosure |
| DoS | Signalling storm | Rate limiting |
| Elevation | Service account misuse | Least privilege |
8. A personal and corporate defence checklist
Individuals 1. Use app/FIDO2 2FA, not SMS only, for banking/email. 2. Set a port-out/SIM-swap PIN with your operator. 3. Disable 2G in phone settings if available; keep the OS and baseband updated. 4. Treat links in SMS as hostile; open apps/sites manually. 5. Don't call back unknown international numbers (Wangiri). 6. Protect your email and cloud accounts (they reset everything else).
Operators 1. Firewall all interconnect protocols with consistent policy (FS.21). 2. Home-route SMS; block ATI/PSI/ISD/CAMEL externally. 3. Correlate location, attach and session data (impossible-travel, S6a↔GTP). 4. Segregate OAM/control/user planes; secure management. 5. Secure APIs; patch edge devices quickly. 6. Fraud management with real-time limits. 7. Prepare for incidents: NIS2 reporting, tabletop exercises, tested backups. 8. Vendor assurance, SBOM, supply-chain controls. 9. Train staff against social engineering; monitor insiders. 10. Plan for 2G/3G sunset and 5G SA security features (SUCI, SEPP).
Remember this: attacks follow the cheapest path to value — an OTP, a location, a free call, a stolen identity. If one path is closed (SS7), they use another (SIM swap, SMS blaster, phishing, API). Good security is layered, consistent across protocols, and aware of the human and business processes, not only of the packets.