Surveillance Firm Exploits Mobile Network Flaw To Track Phones

A recently published investigation by cybersecurity company Enea has discovered a surveillance vendor exploiting a vulnerability in SS7 protocols to trick phone service providers into revealing accurate location data from private devices. According to the researchers, the attacks go back as far as late 2024.

SS7, or Signaling System 7, is a set of protocols used by cellphone carriers to transmit calls and text messages across the world. It also allows companies to know which cell tower their users are connected to, but its decades-old design makes it vulnerable to abuse.

“It is perfectly legitimate for mobile operators to use it for their subscribers who may be roaming abroad, for billing and mobility control, but they are the only ones who should be using it,” writes Cathal McDaid, Enea’s VP of technology, in the company’s blog post.

According to Enea researchers, the attack exploits vulnerabilities in the protocol to permit third parties to access SS7. The attack permits the surveillance vendor to locate the nearest cell tower to an individual, which can provide extremely accurate location information in certain conditions.

“The source of the attacks matched a surveillance company that we have tracked for many years, and we believe that this was identified and used by them. Subsequent retrospective analysis confirmed that this technique was being used at least as far back as Q4 2024,” added McDaid.

The term “surveillance vendor” refers to private companies that usually work exclusively with government clients to conduct intelligence operations. Providers of surveillance software known as “spyware” fit into the category. Governments worldwide claim to use spyware to monitor criminal activity, but it has also been used against journalists, activists, and political dissidents.

In June, the research group Citizen Lab confirmed the use of Paragon spyware by the Italian government to monitor at least 7 prominent local journalists.

“We don’t have any information on how successful this attack method has been worldwide, as its success is vendor/software specific, rather than being a general protocol vulnerability, but its use as part of a suite indicates that it has had some value,” the report continues.

According to tech news site TechCrunch, the company informed the phone operator of the attack being employed, but did not name the specific surveillance vendor, only noting that it’s “based in the Middle East.”