T1430.002 Impersonate Ss7 NodesCAUTION

Open-source AI-powered offensive security harness for automated penetration testing.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: "T1430.002_impersonate-ss7-nodes"
description: "Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node."
category: "information-gathering"
version: "18.1"
author: "cyberstrike-official"
tags:
  - mitre-attack
  - mobile
  - t1430.002
  - collection
  - discovery
  - android
  - ios
  - sub-technique
technique_id: "T1430.002"
tactic: "collection"
all_tactics:
  - collection
  - discovery
platforms:
  - Android
  - iOS
mitre_url: "https://attack.mitre.org/techniques/T1430/002"
tech_stack:
  - android
  - ios
cwe_ids:
  - CWE-200
chains_with:
  - T1430
  - T1430.001
prerequisites:
  - T1430
severity_boost:
  T1430: "Chain with T1430 for deeper attack path"
  T1430.001: "Chain with T1430.001 for deeper attack path"
---

# T1430.002 Impersonate SS7 Nodes

> **Sub-technique of:** T1430

## High-Level Description

Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node.

By providing the victim’s MSISDN (phone number) and impersonating network internal nodes to query subscriber information from other nodes, adversaries may use data collected from each hop to eventually determine the device’s geographical cell area or nearest cell tower.

## Kill Chain Phase

- Collection (TA0035)
- Discovery (TA0032)

**Platforms:** Android, iOS

## What to Check

- [ ] Identify if Impersonate SS7 Nodes technique is applicable to target mobile environment
- [ ] Check Android devices for indicators of Impersonate SS7 Nodes
- [ ] Check iOS devices for indicators of Impersonate SS7 Nodes
- [ ] Verify mitigations are bypassed or absent (1 known mitigations)
- [ ] Assess detection coverage (1 detection strategies)

## How to Test

### Identify Attack Surface

Determine if the target mobile environment is susceptible to Impersonate SS7 Nodes by examining the target platforms (Android, iOS).

### Assess Existing Defenses

Review whether mitigations for T1430.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

## Remediation Guide

### M1014 Interconnection Filtering

Filtering requests by checking request origin information may provide some defense against spurious operators.

## Detection

### Detection of Impersonate SS7 Nodes

## Risk Assessment

| Finding                                    | Severity | Impact     |
| ------------------------------------------ | -------- | ---------- |
| Impersonate SS7 Nodes technique applicable | High     | Collection |

## CWE Categories

| CWE ID  | Title                             |
| ------- | --------------------------------- |
| CWE-200 | Exposure of Sensitive Information |

## References

- [3GPP-Security](http://www.3gpp.org/ftp/tsg_sa/wg3_security/_specs/33900-120.pdf)
- [CSRIC5-WG10-FinalReport](https://web.archive.org/web/20200330012714/https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf)
- [Positive-SS7](https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf)
- [Engel-SS7-2008](https://www.youtube.com/watch?v=q0n5ySqbfdI)
- [Engel-SS7](https://berlin.ccc.de/~tobias/31c3-ss7-locate-track-manipulate.pdf)
- [NIST Mobile Threat Catalogue](https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-38.html)
- [MITRE ATT&CK Mobile - T1430.002](https://attack.mitre.org/techniques/T1430/002)

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

packages/app/public/apple-touch-icon-v3.png

packages/app/public/apple-touch-icon.png

packages/app/public/favicon-96x96-v3.png

packages/app/public/favicon-96x96.png

packages/app/public/favicon-v3.ico

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: T1430.002 Impersonate Ss7 Nodes](https://modelsatlas.com/skills/cyberstrikeus/t1430-002-impersonate-ss7-nodes/badge.svg)](https://modelsatlas.com/skills/cyberstrikeus/t1430-002-impersonate-ss7-nodes/)

Not your listing, or something out of date? Claim or update your listing.