Exposing The Flaw In Our Phone System

A decades-old phone signaling system (SS7) can be abused to hijack calls, intercept SMS-based two-factor authentication codes, and even infer a target’s location—without touching the phone itself. The core takeaway is that the network’s “trust” model and legacy design let attackers reroute communications by manipulating how carriers exchange signaling information, creating a practical path from “dial a number” to “steal access.” That matters because SMS 2FA is widely used, and the same weaknesses that enable privacy intrusions also enable account takeovers and financial theft.

The story begins with phone “phreaking” and the evolution of signaling. Early telephone networks relied on manual operator connections and rotary-dial pulses that worked poorly over long distances because control signals distorted on the line. Touch-tone phones solved that by embedding control information as tones within the voice-frequency band. But that also meant control signals could be spoofed. In the 1970s, Steve Jobs and Steve Wozniak’s “blue box” exploited this by sending a 2600 Hz tone to trick long-distance switching equipment into thinking a call had ended, allowing free routing. The industry responded by moving control signaling off the voice channel.

That fix became SS7—Signaling System No. 7—introduced as a separate digital signaling network intended to be harder to manipulate. Yet SS7’s security assumptions didn’t hold as telecoms expanded. In the modern landscape, thousands of operators and virtual network operators need SS7 access, often through agreements and “walled garden” trust relationships that are easier to penetrate than they appear. Attackers can lease or buy Global Titles (GTs), which function like addressing identifiers for signaling requests. With the right GT access, they can attempt to obtain a subscriber’s IMSI (International Mobile Subscriber Identity), a unique 15-digit identifier tied to the SIM.

Once IMSI and signaling access are in place, the attack chain becomes operational: attackers can make the network believe a victim is “roaming,” then rewrite routing so calls and texts go to the attacker’s controlled destination. In the demonstration, a call placed to Linus didn’t ring on his phone; instead, it reached someone else, illustrating how rerouting can occur while the victim still experiences a normal phone. The same mechanism extends to SMS interception: by capturing one-time passwords during the short window before the victim’s phone reconnects to the correct network, attackers can complete logins without the victim noticing missing messages.

SS7 can also support location requests, though the transcript emphasizes that the method is subtle—often identifying the connected cell tower rather than using GPS. In dense urban areas, that can still narrow a person to within roughly a hundred meters. Researchers Karsten Nohl and Alexandre De Oliveira are credited with showing how these attacks work, and the transcript links SS7 abuse to real-world tracking and surveillance efforts, including the case of Princess Latifa of Dubai, where SS7 was reportedly used to pinpoint a yacht captain’s location.

The transcript closes with why SS7 persists: it remains the backbone for 2G and 3G, and even when 5G signaling is more secure, inter-network routing still relies on SS7. That creates long-term inertia—potentially 10 to 20 years—before full replacement. Personal defenses are limited, but the recommended shift is away from SMS-based 2FA toward authenticator apps or hardware tokens, and toward encrypted calling alternatives like Signal or WhatsApp to reduce exposure to interception and tapping.