Silent risk: how telecom operators ignore known vulnerabilities in Global Title, leaving millions exposed

One of the least known yet most dangerous threats lies in the exploitation of the "Global Title" mechanism within telecommunications networks. Hidden in the complex web of the SS7 (Signaling System No. 7) protocol, Global Title abuse exposes millions of users to hacking, surveillance, and fraud. Despite its prevalence, the issue remains under-discussed, and regulatory action lags behind the mounting dangers.

"Even modern 4G and 5G networks interconnect with these older systems, meaning the vulnerabilities persist. As a result, users remain vulnerable to attacks such as SMS interception, location tracking, and call eavesdropping, all through the exploitation of Global Titles."

SS7, a decades-old telecommunications protocol still widely in use, is fraught with vulnerabilities that malicious actors can exploit with minimal resources. By manipulating Global Titles—essentially address identifiers in the network—hackers can intercept SMS messages, listen in on phone calls, and even track mobile users’ locations. Unlike advanced spyware like Pegasus, which requires considerable investment and high-end software, SS7 exploitation can be achieved with a modest server setup and some technical knowledge

"One of the most common abuses involves the interception of SMS messages, particularly those carrying sensitive information like one-time passwords (OTPs) for two-factor authentication. Fraudsters reroute these messages using SS7 and Global Titles, allowing them to gain access to bank accounts and personal information. In high-profile cases, even phone calls have been intercepted, enabling hackers to eavesdrop on conversations."

What is Global Title and SS7?

At its core, a Global Title is an addressing identifier used within the SS7 network to route communication messages across telecommunications providers. Originally designed decades ago, SS7 was never intended to be secure in today’s digital age. Its primary function was to ensure messages like call setups, SMS deliveries, and service management reached their intended destinations.

But therein lies the problem. As modern telecommunication systems evolved, SS7’s vulnerabilities, including Global Title manipulation, became glaringly exploitable. Today, hackers can abuse these network-level identifiers to intercept communications, track locations, and even alter messages—all without the user’s knowledge.

The GSMA has been advocating for stricter measures to secure the SS7 protocol, including the use of Global Titles, due to the significant vulnerabilities that have been exploited by hackers. Their recommendations include the deployment of SS7 firewalls, which monitor and block malicious traffic, and the implementation of comprehensive security measures such as real-time network monitoring and encryption to safeguard mobile communications.

However, despite these efforts, only a small percentage of mobile operators have adopted these recommendations. Recent data suggests that only about 30% of operators in the EU have implemented these protections, leaving many networks exposed to attacks that exploit SS7 vulnerabilities. Globally, it is estimated that only 17% of mobile operators have deployed signaling firewalls to protect SS7, and this figure is expected to grow to just 49% by 2025​.

​The slow adoption rate is partly due to the cost and complexity of upgrading older network systems, but also because SS7 is still widely used in 2G and 3G networks. Even modern 4G and 5G networks interconnect with these older systems, meaning the vulnerabilities persist. As a result, users remain vulnerable to attacks such as SMS interception, location tracking, and call eavesdropping, all through the exploitation of Global Titles.

 The Abuse: How Global Titles Are Exploited

One of the most common abuses involves the interception of SMS messages, particularly those carrying sensitive information like one-time passwords (OTPs) for two-factor authentication. Fraudsters reroute these messages using SS7 and Global Titles, allowing them to gain access to bank accounts and personal information. In high-profile cases, even phone calls have been intercepted, enabling hackers to eavesdrop on conversations.

In other instances, attackers use Global Titles to track mobile users' locations in real-time by exploiting the SS7 network’s vulnerability to request location updates. This has been weaponized by malicious actors, including governments, to surveil journalists, dissidents, and activists globally.

Prevalence and Lack of Regulation

Alarmingly, the abuse of Global Titles is widespread, affecting individuals and corporations alike across the globe. Countries with less stringent regulatory frameworks are particularly vulnerable, with documented cases of SS7 exploitation in places such as Cambodia and Chile, where it has been used for state-sanctioned surveillance of journalists and activists​.

One reason for the prevalence of Global Title abuse is the telecom industry's reluctance to address it. The infrastructure of SS7 is deeply embedded in networks worldwide, and upgrading or overhauling these systems is a costly and technically complex process. Additionally, there is a lack of transparency about these vulnerabilities, with telecom operators often failing to inform the public of the risks they face.

In countries like the U.S. and U.K., efforts have been made to mitigate SS7 vulnerabilities. For example, the U.S. passed the Truth in Caller ID Act, making it illegal to spoof phone numbers with malicious intent, while mobile operators in these countries have invested in spam-blocking technologies. However, in South Africa and other regions, there is little regulation or enforcement to address these abuses​.

Breaches of Privacy and Security

Several high-profile breaches illustrate the extent of Global Title exploitation. In one instance, hackers used SS7 vulnerabilities to intercept OTPs, enabling widespread bank fraud. In another, governments in authoritarian regimes have reportedly used SS7 exploits to surveil opposition figures, leading to human rights violations​.

Perhaps one of the most chilling examples is the use of spyware such as Pegasus, which leveraged SS7 vulnerabilities to infiltrate devices and collect sensitive information. By manipulating Global Titles, attackers could intercept phone calls, text messages, and location data—leaving no trace of the breach​.

Why Hasn't the Industry Taken Action?

Despite the clear dangers posed by Global Title abuse, the telecom industry has been slow to act. Upgrading SS7 to a more secure protocol, such as Diameter (used in 4G and 5G networks), is resource-intensive, and many operators are unwilling to make the necessary investments. Furthermore, there are no specific global regulations mandating telecom companies to secure SS7 protocols, leaving operators largely unaccountable for the vulnerabilities.

This lack of action leaves the public unprotected. As long as SS7 remains the backbone of global telecommunications, the risk of Global Title abuse will persist, with devastating consequences for privacy, security, and personal freedoms.

Transparency and Regulation

The abuse of Global Titles in telecommunications is a silent epidemic, affecting millions, yet understood by few. Without stronger regulations, increased transparency from telecom operators, and significant investment in security upgrades, this vulnerability will continue to compromise global communications.

Additional Published Article: Comms Risk MEF

The Abuse of Global Title: The World Is Bigger Than You Think
By Eric Priezkalns