Weaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?
summary
Claims that mobile roaming interconnects get weaponized: attackers run fuzzing against SS7/SIGTRAN signaling, inject malformed TCAP and SCP messages (including TCAP transaction ID manipulation) to spoof identities and force SMS two‑factor codes, conduct account takeovers and location surveillance across 60+ countries, and dramatically ramp activity (about 150× spike in 2022). One disclosed zero‑day sequence later links to a confirmed loss (~$50k in 12 days for one operator); findings are submitted to GSMA CVD and operators are advised to reproduce in labs and share threat intelligence.
AI-written summary · about
chapters (12)
- 0:00Mobile infrastructure threats
- 3:18How networks interconnect and threats emerge
- 7:29Attacker groups and motives
- 11:19Cyber warfare in conflicts
- 15:15Historical cyber attack patterns
- 17:22Afghanistan withdrawal anomalies
- 22:19Russia vs Ukraine telecom attacks
- 27:03Recon and account takeover mechanics
- 30:35Nation-state spoofing and zero-days
- 34:28Zero-day financial impact
- 37:16Operator security and threat sharing
- 40:07Conclusion and future research
related talks
55mHidden Agendas: Bypassing GSMA Recommendations On SS7 Networks
26mBack to the Future. Cross-Protocol Attacks in the Era of 5G
25mAttacking Mobile Broadband Modems Like a Criminal Would
39mSecure Your Data
48mMobile Network Hacking, IP Edition
08mHacking 4G and how to get arrested in 10 minutes
56mCybersecurity & Privacy From The Global Lens
40mThe Canary in the Coalmine of Cybersecurity: Fraud as a Warning Sign