Try to answer before checking. Answers at the end.
Module 0–1 1. Which three channels could an SMS theoretically use, and which one does it actually use? 2. What is the difference between MSISDN, IMSI and IMEI? 3. Why does one emoji turn a 160-character message into three SMS? 4. In ISUP call setup, at which message does billing start?
Module 2 5. What does the HLR know about your location, and what does the VLR know? 6. What exactly does an SRI-SM response contain, and how do you tell the subscriber is roaming? 7. A number's prefix says A1 but the lookup IMSI is 219-02. What happened and how is the SMS routed?
Module 3–4 8. Why was out-of-band signalling introduced (three reasons)? 9. In the layer stack, what is the job of SCCP vs MTP3? 10. Which two MAP operations deliver an SMS, and in what order? 11. What stays the same and what changes when SS7 moves from TDM to IP (SIGTRAN)? 12. Why can an attacker send SS7 messages the network trusts?
Module 5–6 13. Name the three fraud patterns behind most firewall tickets. 14. How do you detect IMSI harvesting, and what does the firewall do about it? 15. Which real incident is "Case 6 at huge scale", and why can't the firewall stop an SMS blaster?
Answers
- Voice, data and signalling channels — SMS uses the signalling channels (that's why it needs no app or data).
- MSISDN = the dialled number; IMSI = the SIM identity (MCC+MNC+MSIN); IMEI = the physical device.
- One non-GSM character forces UCS-2 encoding (70 chars/SMS), so a 160-char text no longer fits in one message and splits into parts.
- At ANM (Answer Message).
- The HLR knows which MSC/VLR serves you; the VLR knows your location area and pages the phone.
- IMSI + the serving MSC address (networkNode-Number); a foreign country prefix on that MSC address means roaming.
- The number was ported to Telemach but kept its prefix; routing uses the IMSI / number-portability database (MNP-SRF) to send the SMS to the new HLR/network.
- Speed, waste (reserved voice lines) and security (anyone with the right tone controlled the switch — blue boxes).
- SCCP provides global addressing (Global Titles, translated by STPs) across networks; MTP3 routes between point codes inside one network.
- SRI-SM (ask the HLR where the phone is), then mt-ForwardSM (deliver to the serving MSC).
- MAP/TCAP/SCCP stay the same; MTP1→IP, MTP2→SCTP, MTP3→M3UA change.
- SS7 has no authentication — a message is trusted simply because it arrives; GT leasing/insiders/weak operators give access.
- Sender-ID spoofing, AIT, grey routes.
- Many "where is this number?" queries from one source with no SMS following; the firewall blocks the source and answers with a fake IMSI (home routing).
- Twitter fake 2FA. An SMS blaster is a fake tower — its messages never touch the operator's network, so no SMS firewall can see them.