SMSC伪造攻击技术问询：能否在运营商不知情无干预下实施及原理

Is This Attack Technically Feasible? #

Absolutely. SS7 and SIGTRAN networks were originally built on a trust-first model—many legacy deployments assume all connected nodes are legitimate, with minimal built-in identity verification. This makes SMSC forgery a realistic threat when network security controls are lacking:

• Legacy SS7 setups often only validate the Signaling Point Code (SPC) of incoming nodes, not the actual hardware/software behind the claim. If an attacker can spoof a valid SPC linked to a legitimate SMSC, the network will accept their fake node as authentic.
• SIGTRAN (the IP-based successor to SS7) fixes some gaps, but if operators skip critical safeguards like SCTP layer authentication, IPsec encryption, or Global Title (GT) validation, attackers can still impersonate an SMSC over IP.

Real-world threat reports and past operator breaches have confirmed this exploit works when networks are poorly configured.

How to Execute the Attack Without Operator Knowledge/Intervention #

Pulling this off relies on exploiting gaps in access controls and weak authentication. Here’s a breakdown of the typical workflow:

• Gain edge access to the signaling network: Attackers need a way to connect to the operator’s SS7/SIGTRAN infrastructure. This could be via a compromised edge router, a misconfigured leased line (if the operator skips access audits), or pivoting from a vulnerable adjacent component (like a base station controller) into the signaling network.
• Spoof valid signaling identifiers: Configure the fake SMSC to use the exact SPC or GT of a legitimate SMSC in the network. Most legacy SS7 systems don’t verify that the node claiming a specific SPC is actually the authorized hardware—they only check if the SPC is on their allowed list.
• Tamper with routing tables: Send forged route update messages (per ITU-T Q.704 standards) to convince other network nodes to route SMS traffic intended for the real SMSC to the fake one. If the operator doesn’t use integrity checks (like digital signatures) on routing messages, these updates will be accepted as legitimate.
• Steal data while maintaining service: To avoid detection, the fake SMSC can forward all captured traffic to the real SMSC after copying it. Users still receive their SMS, the operator sees no service disruption, and the attacker siphons off sensitive data like SMS content, IMSIs, or phone numbers.
• Evade monitoring: Keep the attack footprint small (e.g., target specific user groups instead of the entire network) and mimic the real SMSC’s behavior (message response times, signal patterns) to avoid triggering anomaly detection systems.

Critical Mitigation Context #

This attack only succeeds if the operator skips basic security safeguards. Modern telecom networks that implement:

• Strong node authentication (e.g., digital signatures for SS7 messages, IPsec for SIGTRAN)
• Strict access control lists (ACLs) limiting which nodes can connect to the signaling network
• Real-time monitoring for unusual routing changes or traffic patterns
  can completely block this type of exploit.

内容的提问来源于stack exchange，提问作者Peter