March 28, 2026 MOBITELSMS Engineering 12 min read

Signaling System 7 is one of the most consequential telecommunications protocols ever designed. It has been carrying call setup messages, SMS delivery instructions, and roaming data between telephone switches since the early 1980s. Despite the rise of IP-based protocols like SIP and Diameter, SS7 remains deeply embedded in the global PSTN and continues to play a critical role in mobile networks. To understand why SS7 exists and why it persists, you need to understand the problems it was built to solve.

Before SS7: In-Band Signaling and Its Problems

In the earliest days of telephony, signaling and voice shared the same channel. When you picked up a handset, a direct current loop told the exchange you wanted to make a call. Dial pulses or dual-tone multi-frequency (DTMF) tones traveled over the same pair of wires that would carry your voice. This is called in-band signaling -- the control information travels inside the same channel as the payload.

This worked acceptably for local calls. But as the telephone network grew into a long-distance interconnected system, in-band signaling created serious problems. The most notorious was multi-frequency (MF) tone signaling, used on inter-office trunk lines. MF tones -- specific pairs of six frequencies in the 700-1700 Hz range -- were sent between switches to communicate the called number, the calling number, and call supervision signals like answer and disconnect.

The fundamental flaw was that these MF tones traveled over the same voice path that subscribers could hear and, critically, inject signals into. If you knew the frequencies, you could generate them yourself and control the network.

Blue Box Fraud

In the late 1950s and through the 1970s, this vulnerability was widely exploited. A device called a "blue box" generated the precise MF tones used by the telephone network for inter-office signaling. A blue box user would place a call to a toll-free number (which cost nothing), then send a 2600 Hz tone to seize the trunk, followed by MF tones to route the call anywhere in the world -- for free.

The 2600 Hz tone was particularly important. On older single-frequency (SF) signaling systems, a continuous 2600 Hz tone on an idle trunk indicated that the trunk was available. By injecting this tone, a blue box user could fool the far-end switch into thinking the trunk had been released, then immediately re-seize it with their own routing instructions.

Famous early adopters included John Draper (Captain Crunch), who discovered that a toy whistle from a cereal box produced a tone at exactly 2600 Hz, and Steve Wozniak and Steve Jobs, who built and sold blue boxes as Berkeley undergraduates in the early 1970s. The financial losses to AT&T and other carriers ran into hundreds of millions of dollars annually.

Beyond fraud, in-band signaling had other limitations. It was slow -- setting up a call required sending tones sequentially, one digit at a time, through every switch in the path. It tied up voice circuits during the setup phase, wasting expensive trunk capacity. And it made it nearly impossible to implement advanced features like call forwarding, caller ID, or toll-free number portability, because the signaling channel was so constrained.

Common Channel Signaling: The Conceptual Breakthrough

The solution was conceptually simple: separate the signaling from the voice. Instead of sending control tones over the same circuit as the call, use a dedicated data link between switches specifically for signaling. This is called common channel signaling (CCS) -- a single signaling channel carries control messages for thousands of voice circuits simultaneously.

AT&T and Bell Labs began developing common channel signaling in the late 1960s. The first system, called Common Channel Interoffice Signaling (CCIS), was deployed internally within the AT&T network starting in 1976. CCIS used a data link operating at 2400 bps to carry signaling messages between switching offices. It was proprietary to AT&T and was never standardized internationally, but it proved the concept worked at scale.

Meanwhile, the CCITT (Comite Consultatif International Telephonique et Telegraphique -- now the ITU-T) had been working on international signaling standards. They produced Signaling System No. 6 (SS6) in 1972, which was an international common channel signaling protocol. SS6 used 28-bit signal units on 2400 bps links and was deployed in some international gateway exchanges. But SS6 had limited message capacity and lacked the flexibility needed for the growing range of telephony services.

The Birth of SS7: CCITT Standardization

In 1980, the CCITT published the first set of recommendations for Signaling System No. 7. These were the Q.700-series recommendations, defining a new common channel signaling protocol designed for digital telephone networks. SS7 was designed from the ground up to be:

The SS7 Protocol Stack

SS7 uses a layered protocol architecture. The lowest three layers are collectively called the Message Transfer Part (MTP):

Above MTP sits the Signaling Connection Control Part (SCCP), which adds global title addressing (telephone number-based routing) and connection-oriented services. Above SCCP, the Transaction Capabilities Application Part (TCAP) provides a framework for database queries -- essential for services like toll-free number translation, mobile subscriber lookup (HLR queries), and number portability.

The actual telephony signaling is handled by upper-layer protocols: ISUP (ISDN User Part) for voice call setup and teardown, and MAP (Mobile Application Part) for GSM mobile network operations like roaming, SMS delivery, and HLR queries.

Deployment: 1980s Through 2000s

AT&T began deploying SS7 in its long-distance network in 1980, making it one of the earliest adopters. The protocol rapidly replaced both MF signaling on inter-office trunks and the earlier CCIS system. By the mid-1980s, SS7 was carrying the majority of call signaling traffic within the AT&T network.

The Regional Bell Operating Companies (RBOCs) followed throughout the 1980s, and by 1990, SS7 was the dominant signaling protocol across the entire North American PSTN. The deployment was accelerated by the introduction of new services that required SS7 capabilities:

Internationally, SS7 adoption proceeded on a similar timeline. European PTTs (Post, Telephone, and Telegraph administrations) deployed SS7 through the 1980s and 1990s, though national variants created interoperability challenges. The ITU-T worked to harmonize these variants, but differences between the ANSI (North American) and ITU (international) versions of SS7 persist to this day -- particularly in point code formats, ISUP message parameters, and SCCP addressing conventions.

SS7 and Mobile Networks

The GSM standard, finalized in 1991, adopted SS7 as its core signaling infrastructure. The Mobile Application Part (MAP) was built on top of SS7's TCAP and SCCP layers. Every fundamental GSM operation relies on MAP over SS7:

This deep integration with GSM is why SS7 remains relevant today. Even in 4G LTE networks, which use the Diameter protocol for most signaling, SS7 interworking is required for SMS delivery (via SGs interfaces), circuit-switched fallback for voice calls, and interoperability with 2G/3G networks. The MOBITELSMS SS7 gateway provides this interworking capability for operators transitioning between network generations.

SS7 Security Vulnerabilities

SS7 was designed in an era when the signaling network was a closed, trusted environment. Only telephone companies had access to SS7 links, and the protocol includes no authentication, encryption, or access control mechanisms. Every node on the SS7 network is implicitly trusted to send any message to any other node.

This assumption held for decades. But two developments shattered it. First, the liberalization and deregulation of telecoms markets in the 1990s and 2000s meant that hundreds of new operators gained SS7 network access. Second, the introduction of SS7-over-IP (SIGTRAN) made it possible to connect to the SS7 network from commodity hardware running standard IP stacks, rather than requiring specialized signaling equipment.

The 2014 Revelations

At the 31st Chaos Communication Congress (31C3) in December 2014, German security researcher Karsten Nohl and his colleague Tobias Engel presented detailed demonstrations of SS7 attacks. They showed that anyone with access to the SS7 network -- even through a small mobile operator or a commercially available SS7 hub -- could:

These vulnerabilities were not theoretical. Subsequent investigations revealed that SS7 attacks had been used by intelligence agencies, commercial surveillance companies, and criminal organizations for years before the public disclosure. In 2017, the German newspaper Suddeutsche Zeitung reported that criminals had used SS7 interception to bypass SMS two-factor authentication and drain German bank accounts.

Mitigation Efforts

The GSMA responded by publishing guidelines for SS7 network security, including recommendations for SS7 firewalls that filter suspicious messages based on origination, message type, and target. These firewalls -- sometimes called Signaling Transfer Point (STP) screening rules -- can block unauthorized ATI queries, reject UpdateLocation messages from unexpected sources, and alert operators to suspicious patterns.

However, adoption of SS7 security measures remains uneven. Many smaller operators, particularly in developing countries, lack SS7 firewalls entirely. And the fundamental problem -- that SS7 has no built-in authentication -- cannot be fixed without replacing the protocol.

The Transition: Diameter and SIP

The 3GPP standards body recognized that SS7 could not serve as the signaling backbone for next-generation networks. For 4G LTE, they specified two replacement protocols:

In 5G Standalone (SA) networks, the signaling architecture moves further away from SS7. The 5G core uses HTTP/2-based service-based interfaces (SBI) between network functions, with protocols like Nudm (for subscriber data, replacing HLR/MAP) and Nsmf (for session management, replacing Diameter Gx).

Despite these transitions, SS7 remains operational in the vast majority of mobile networks worldwide. Even operators with fully deployed 4G and 5G networks maintain SS7 interconnections for backward compatibility with 2G/3G, international roaming with operators that have not yet migrated, and SMS delivery through legacy infrastructure. The complete retirement of SS7 is likely still a decade or more away.

SS7's Continued Relevance for SMS

SMS is arguably the most enduring application of SS7. While voice has largely migrated to VoIP (VoLTE, VoNR, OTT apps), and data session management has moved to Diameter, the SMS delivery path through many networks still relies on MAP over SS7. The SendRoutingInfoForSM and ForwardShortMessage MAP operations remain the standard mechanism for inter-operator SMS routing in many parts of the world.

For A2P (Application-to-Person) SMS providers, this means that understanding SS7 signaling is not just historical curiosity -- it is operational knowledge. Delivery failures, routing errors, and billing discrepancies often trace back to SS7-level issues: incorrect global title translation, point code misconfiguration, SCCP routing errors, or MAP operation failures.

MOBITELSMS provides direct SS7 gateway connectivity for operators and enterprises that need native SS7 access for SMS delivery, HLR lookups, and number portability queries. This includes full MAP/TCAP/SCCP/MTP stack support, with built-in SS7 firewall capabilities to protect against the vulnerabilities described above.

Key Takeaways

SS7's history reflects the broader evolution of telecommunications from analog to digital, from circuit-switched to packet-switched, and from closed networks to interconnected global systems. The protocol was a direct response to the security and scalability failures of in-band signaling, and it succeeded beyond anyone's expectations -- carrying the signaling load for the global telephone network for over four decades.

Its vulnerabilities, discovered publicly in 2014 but exploited long before, highlight the risks of designing protocols for a trusted environment and then deploying them in an untrusted one. And its persistence, even as newer protocols surround and gradually replace it, demonstrates how deeply entrenched infrastructure standards become once they are woven into the fabric of global communications.

For anyone working in telecom today -- whether in SMS delivery, voice routing, mobile core infrastructure, or security -- SS7 is not legacy technology to be ignored. It is active infrastructure to be understood, secured, and eventually migrated away from. That migration is well underway, but it is far from complete.