Location Tracking Attacks: How Adversaries Exploit Mobile Networks to Follow You

Your mobile phone is more than a communication device — it’s also a constant location beacon. Every time it connects to the network, it reveals information about where you are, down to the cell tower or sector.

For legitimate operators, this data enables roaming, billing, and mobility management. For attackers, it’s a surveillance goldmine. By abusing signaling protocols like SS7, SIGTRAN, and Diameter, adversaries can silently request your location, track your movements across countries, and even monitor when you enter or leave specific areas.

These location tracking attacks are not science fiction. They’ve been documented in the wild, used by fraudsters, private contractors, and even nation-states. And despite years of warnings, many operators still expose subscribers to this silent, invisible threat.

What Are Location Tracking Attacks?

Location tracking attacks are a class of telecom exploits where adversaries leverage signaling messages to obtain real-time or historical information about a subscriber’s location.

Unlike GPS tracking, which requires access to a device, location tracking via signaling requires no malware, no user interaction, and no physical proximity. Instead, attackers send crafted queries through the interconnect, exploiting the trust model of legacy telecom protocols.

How Location Tracking Works in SS7 and Diameter

1. SS7 / SIGTRAN (2G/3G)

In SS7 networks, location tracking relies on MAP (Mobile Application Part) messages. Attackers typically use:

• AnyTimeInterrogation (ATI) — returns the current location of a subscriber.
• ProvideSubscriberInfo (PSI) — reveals information such as Cell ID.
• SendRoutingInfo (SRI) — originally designed for call/SMS routing but abused to infer location indirectly.

Because SS7 was designed with implicit trust, many networks still respond to these queries without strong filtering.

2. Diameter (4G/LTE)

Diameter introduced stronger authentication and encryption features — but in practice, they are optional, not mandatory. Attackers use:

• UpdateLocationRequest (ULR) to learn where a subscriber is roaming.
• InsertSubscriberData (ISD) manipulations to trigger location responses.

And since LTE networks often interwork with SS7 for fallback, vulnerabilities persist across generations.

3. IMS & 5G SBA

In IMS (IP Multimedia Subsystem) and 5G SBA (Service-Based Architecture), location data is still exchanged between core elements for mobility and service continuity. Attackers who compromise or gain access to interconnect APIs can request location updates in similar ways — though the attack surface is still evolving.

Real-World Examples of Location Tracking Abuse

1. Surveillance Contractors: Investigations have shown private companies selling SS7-based location tracking as a service to clients, including governments and corporations.
2. Nation-State Espionage: Intelligence agencies have used location tracking to follow high-value targets across borders.
3. Fraud Enablers: Criminals use location data to bypass geo-restrictions or target subscribers when they’re roaming.
4. Stalkerware at Scale: While consumer apps may use GPS, attackers with SS7 access can track individuals silently without ever touching the device.

The Business and Privacy Impact

Location tracking attacks are devastating because they:

• Violate subscriber privacy: Users have no idea they are being tracked, yet attackers can follow them globally.
• Enable physical risks: Tracking journalists, activists, or political figures puts lives at risk.
• Erode trust in operators: Customers expect their mobile provider to safeguard privacy. Exposure to SS7/Diameter attacks undermines that trust.
• Fuel fraud schemes: Location knowledge can be used in tandem with SMS interception or call redirection attacks.

For operators, the stakes are high: regulatory fines, reputational damage, and national security concerns.

Why Location Tracking Attacks Are Still Possible in 2025

Operators often ask: “Didn’t we fix SS7 security years ago?”

The uncomfortable truth: No.

• SS7 is still in use for roaming and fallback services worldwide.
• Diameter interworking inherits legacy vulnerabilities.
• Firewalls are unevenly deployed — some networks filter aggressively, others leave dangerous gaps.
• Attackers are persistent — as long as the interconnect allows signaling queries, someone will try to abuse them.

Even with 5G rolling out, legacy protocols don’t disappear overnight. Attackers exploit the weakest link — and right now, that’s still SS7 and Diameter signaling.

Defensive Measures Against Location Tracking

1. SS7/Diameter Firewalls

Deploying advanced signaling firewalls is critical. They can block unauthorized ATI/PSI/SRI requests and enforce policy on interconnect traffic.

2. Anomaly Detection & Intrusion Monitoring

Operators should monitor for suspicious signaling patterns, such as repeated location queries for the same subscriber or unusual traffic volumes from roaming partners.

3. SMS Routers and GLRs

Complementary tools like SMS Routers and Gateway Location Registers (GLRs) help mask subscriber data and reduce direct exposure of the HLR.

4. Defense-in-Depth Strategy

No single control is enough. Operators need a layered defense including:

• Firewalls (block malicious messages).
• IDS (detect ongoing attacks).
• Security audits (find misconfigurations).
• Regular pentesting (simulate real attacker scenarios).

Conclusion

Location tracking attacks are one of the most chilling examples of how legacy telecom trust models can be abused. With a few crafted signaling requests, attackers can follow subscribers anywhere in the world — without them ever knowing.

Despite years of warnings, the threat hasn’t gone away. As long as SS7, SIGTRAN, and Diameter are in use, attackers will continue to abuse them for surveillance, fraud, and espionage.

For operators, the message is clear: ignoring signaling security is no longer an option. Deploy firewalls, monitor interconnect traffic, and take subscriber privacy seriously. Because in the signaling world, every unfiltered request is an open door — and attackers are already walking through it.

‍

🔐 Looking for the full picture? Explore the Ultimate Guide to Mobile Network Security — your complete resource on telecom security, from architecture to audits.

‍