Iran tracked U.S. troops via SS7 flaws before strikes, report says

Key Takeaways

• Iran exploited SS7 protocol flaws to track U.S. military locations in the Middle East before and during the Iran War
• The attacks enabled by this surveillance resulted in several injuries at bases and hotels in Iraq and Bahrain
• Iran also used advertising technology as a secondary surveillance method to locate personnel

Iran exploited decades-old vulnerabilities in global mobile networks to pinpoint the locations of U.S. military personnel stationed across the Middle East, then used that intelligence to strike bases and hotels in Iraq, Bahrain, and neighboring countries. The surveillance campaign, reported by the Financial Times, relied on SS7, a signaling protocol from 1975 that still underpins how 2G and 3G networks route calls and texts worldwide.

The Iranian government conducted this tracking operation in the lead-up to the Iran War and during its early stages, according to research from the Mobile Surveillance Monitor and anonymous government officials cited by the Financial Times. Several U.S. service members were injured in the resulting attacks.

How SS7 surveillance works

Signaling System 7 was designed in an era when only a handful of trusted telephone companies had network access. The protocol handles critical functions: routing calls between carriers, enabling roaming, and delivering SMS messages across borders. It has no authentication or encryption. Any entity with access to an SS7 node can query the system to determine which cell tower a phone is connected to, revealing the user's approximate location.

Security researchers have warned about SS7 flaws for over a decade. German researchers publicly demonstrated the vulnerabilities at the 2014 Chaos Communication Congress, showing they could track phones, intercept calls, and read text messages. Intelligence agencies around the world have exploited these weaknesses ever since.

The problem persists because fixing SS7 would require coordinated action from hundreds of telecom operators globally. Over 800 companies have SS7 access points, creating an enormous attack surface. Any one of them, or anyone who compromises one of them, can abuse the system.

Advertising tech as a surveillance tool

Beyond SS7, Iran also weaponized commercial advertising technology to track military targets. Ad-tech platforms collect precise location data from mobile apps to serve geo-targeted advertisements. That same data can be purchased or intercepted for surveillance purposes.

This technique has become increasingly common among state actors. Unlike SS7 exploitation, which requires access to telecom infrastructure, ad-tech surveillance can sometimes be conducted through commercial data brokers who sell location information with few restrictions on buyers.

Why militaries remain vulnerable

U.S. military personnel often carry personal cellphones alongside or instead of secure government devices. Even when troops use encrypted communications apps, their phones still register with local cell towers, exposing location data through SS7 queries. The only complete defense is leaving commercial devices behind, which creates morale and practical communication problems.

The Department of Defense has issued guidance restricting personal device use in sensitive locations, but enforcement varies. Commercial 5G networks offer better security than legacy 2G and 3G, but older protocols remain active worldwide for backward compatibility. Most phones will fall back to 3G or 2G when 5G or LTE coverage is unavailable, reexposing users to SS7 attacks.

What carriers and governments can do

Telecom operators can deploy SS7 firewalls that filter suspicious queries, but adoption remains incomplete. The GSMA, which represents mobile operators globally, has published guidelines for SS7 security. Some carriers ignore them.

Governments could mandate SS7 security standards, but international coordination has stalled. The U.S. FCC has studied the issue for years without imposing binding requirements. Meanwhile, the commercial incentive for carriers is weak: SS7 attacks affect individuals and governments, not carrier revenue.

Frequently Asked Questions

What is SS7 and why is it vulnerable?

SS7 is a set of telephony protocols from 1975 that routes calls and texts between mobile networks globally. It was built without authentication or encryption because only trusted telecom companies originally had access. Today, over 800 companies can connect to SS7, making it easy for attackers to query phone locations.

Can 5G networks be exploited the same way as SS7?

5G includes stronger security than legacy protocols, but most phones still support 2G and 3G as fallbacks. Attackers can force phones to downgrade to older networks using cell-site simulators, reexposing them to SS7 vulnerabilities.

How can individuals protect themselves from SS7 surveillance?

Complete protection is difficult. Using airplane mode prevents tracking but disables the phone. Some security-focused devices allow disabling 2G and 3G connectivity. For sensitive situations, leaving phones behind entirely is the only guaranteed solution.

Did Iran purchase SS7 access or hack into the network?

The Financial Times report does not specify how Iran gained SS7 access. Options include purchasing access from a compliant telecom operator, compromising an operator's systems, or working through a commercial surveillance vendor.

Source: TechCrunch / Lorenzo Franceschi-Bicchierai