Scanning SS7 point codes and closing intrusion paths
Signalling System No. 7 still supports essential voice, roaming, SMS and inter-carrier services, even as Australian networks continue moving towards LTE, 5G and IP-based cores. Its age is central to the security problem: SS7 was designed around trusted telecom operators, not hostile traffic arriving through interconnected global networks.
A useful security assessment therefore examines more than firewall rules. It maps point codes, signalling links, routing relationships, signalling transfer points and application-layer services such as MAP and CAP. The aim is to identify who can reach the network, what operations they can request and whether those requests are properly restricted.
For Australian operators, the risk includes domestic interconnects, international roaming and outsourced signalling platforms. A weakness may affect a carrier in Sydney or Melbourne while the suspicious traffic originates through a foreign roaming partner several time zones away.
| Assessment focus | What it reveals | Typical risk |
|---|---|---|
| Point-code discovery | Visible nodes, routes and network roles | Unauthorised topology mapping |
| Message testing | Permitted operations and filtering gaps | Location tracking or SMS interception |
| Traffic analysis | Abnormal volume, timing and origin | Reconnaissance or signalling abuse |
| Control validation | Whether blocks and alerts work | Delayed detection and weak response |
Why point codes matter
An SS7 point code identifies a signalling node within a national or international signalling environment. Depending on the network design, it may represent a mobile switching centre, home location register, signalling transfer point or service control platform. Point codes are not passwords, but they provide valuable clues about network structure.
Scanning can involve passive collection from signalling traces, route analysis, partner information or misconfigured equipment. More aggressive probing sends carefully formed signalling messages to test whether a node responds, forwards traffic or exposes service behaviour. Even a rejected request can disclose that a destination exists and how its controls operate.
Australian networks add operational complexity because large carriers, MVNOs and roaming exchanges may share signalling ecosystems. A visible point code can help an attacker distinguish a subscriber database from a transit node, then focus intrusion attempts on the systems most likely to return useful data.
Common intrusion paths
The best-known SS7 abuse involves MAP procedures. An attacker with signalling access may attempt to request subscriber location, obtain routing information for SMS, redirect messages or interrogate authentication-related data. Fraudsters can combine these capabilities with social engineering and compromised online banking credentials.
Other vectors include weak partner authentication, excessive trust in international signalling hubs, exposed SIGTRAN gateways and poor separation between test and production environments. SIGTRAN carries legacy signalling over IP, so SCTP, firewall and transport-layer protections matter alongside SS7 filtering.
A malicious party does not always need to compromise a major carrier directly. Access may come through a poorly governed signalling provider, a reseller, a roaming partner or an Internet-facing management interface. That supply-chain angle is especially important where Australian operators use specialist managed services for international connectivity.
How scanning becomes an incident
Reconnaissance often begins quietly. An intruder may identify active point codes, measure response patterns and send low-volume queries that resemble legitimate roaming traffic. Repeated failures, unusual source networks and requests involving subscribers who are not roaming can reveal this stage.
The next phase may involve location tracking, premium-rate fraud, SMS interception or denial of service. Congestion can also hide malicious activity by blending abnormal signalling into a busy period. Teams responsible for operations should understand SS7 congestion diagnosis so they can separate capacity problems from deliberate message flooding.
Monitoring should correlate point-code activity with subscriber events, roaming records, maintenance windows and partner declarations. A single unusual message may be legitimate; a repeated pattern across several destinations, services or countries is much more significant.
Defensive controls that work
Security begins with an accurate inventory of point codes, signalling links, partner relationships and permitted message types. Operators should document which nodes can communicate, why that access exists and when it must expire. Unknown routes and legacy test connections deserve particular scrutiny.
Practical safeguards include SS7 firewalls, MAP operation filtering, rate controls, anomaly detection and strict SIGTRAN boundary protection. Controls should be tested with authorised simulations rather than assumed to work because a vendor dashboard shows them as enabled.
- Maintain a current point-code and signalling-link inventory.
- Permit only required MAP, CAP and ISUP operations for each partner.
- Block unauthorised location, routing and subscriber-data queries.
- Apply SCTP, firewall and management-plane hardening to SIGTRAN gateways.
- Correlate signalling alerts with roaming and subscriber activity.
- Review international partner access and contractual security obligations.
- Run controlled validation tests after major network or vendor changes.
Detection for Australian networks
Security operations centres should establish a baseline for domestic and international signalling. Traffic involving Telstra, Optus, Vodafone or an MVNO partner may follow different patterns, so a universal threshold can generate excessive false positives. Rules should account for normal roaming between Australian states and popular travel destinations.
Geography can still be useful. A sudden burst of requests from an unexpected signalling hub, or activity targeting subscribers in Brisbane while the declared service is unrelated to Queensland, merits investigation. During an overnight arvo-to-morning handover, clear escalation rules prevent suspicious traffic from waiting for the next specialist shift.
Logs should retain message type, source and destination point code, partner identity, subscriber reference, timestamp and enforcement result. Privacy obligations and data minimisation must be considered when storing subscriber-related information, particularly under Australian regulatory and contractual requirements.
A disciplined response path
When scanning or intrusion is suspected, first preserve signalling traces and establish whether the source is a legitimate partner. Blocking traffic too broadly can disrupt roaming, emergency communications or SMS delivery, while waiting too long can allow further exposure. A staged response should use narrowly targeted filters, partner verification and continuous impact checks.
The investigation should then determine whether point-code discovery led to an actual unauthorised operation. Review changes to routing, MAP filtering, SIGTRAN gateways and vendor access, followed by credential rotation where management systems may have been exposed. Findings should be shared with relevant carrier contacts and reported through applicable Australian telecommunications processes.
Begin with one controlled inventory exercise: record every production point code, its owner, connected partners and permitted message classes, then compare that list with live signalling traffic.
