イランが携帯ネットワークの脆弱性を悪用し中東の米軍の位置を特定していたと報告Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says

A newly published report indicates that Iran has been exploiting long-standing weaknesses in the protocols that underpin global mobile networks to track the physical locations of US military personnel stationed across the Middle East. The finding, if accurate, underscores a persistent and largely unaddressed vulnerability in telecommunications infrastructure that security researchers have warned about for more than a decade.

According to the report, Iranian operators appear to have leveraged flaws in Signaling System 7, commonly known as SS7, a family of signaling protocols that carriers use to route calls and text messages, manage roaming, and exchange subscriber information between networks. Because SS7 was designed in the 1970s and 1980s for a small, closed group of trusted state-run telephone operators, it contains few mechanisms to authenticate the source of a request. Any party with access to the signaling network, whether a licensed carrier, a leased connection, or a compromised operator, can potentially query the system as though it were a legitimate participant.

That trust-by-default design is what makes location tracking possible. By sending specially crafted signaling messages, an attacker can ask a network which cell tower a given phone is connected to, effectively narrowing a target's position to a specific area without ever touching the device itself. More sophisticated queries can, in some cases, intercept calls and text messages, including one-time passcodes used for two-factor authentication. The victim receives no notification and has no practical way to detect that they are being monitored.

The implications for military personnel are significant. Even when service members avoid discussing operational details, the pattern of their movements can reveal the locations of bases, patrols, and staging areas. Aggregated over time, location data drawn from personal or work phones could expose sensitive routines and force postures. The report frames Iran's activity as part of a broader intelligence-gathering effort, though the specific techniques, the carriers involved, and the scale of the tracking remain difficult to verify independently.

SS7 abuse is not a new phenomenon. Researchers demonstrated practical location-tracking and interception attacks publicly as early as 2014 and 2016, and criminal groups, surveillance vendors, and state intelligence services have all been documented using similar methods. In one widely reported case, attackers drained bank accounts in Germany by intercepting SMS-based authentication codes. Commercial surveillance firms have marketed SS7 access as a service, and leaked materials over the years have pointed to a market for location-tracking capabilities sold to governments.

The industry has responded with partial measures. Carriers can deploy signaling firewalls and monitoring systems designed to filter suspicious SS7 queries, and regulators in some countries have pressed operators to harden their networks. The newer Diameter protocol used in 4G LTE networks, and the signaling framework in 5G, were intended to improve on SS7's shortcomings, but researchers have found that many of the same categories of weakness persist, and legacy SS7 connectivity often remains in place for backward compatibility and international roaming. As long as any link in the global chain of interconnected carriers remains exposed, the wider system inherits that risk.

For individuals, the practical defenses are limited but real. Using end-to-end encrypted messaging and calling applications such as Signal reduces the value of intercepted communications, and moving away from SMS-based two-factor authentication toward app-based codes or hardware security keys mitigates one common attack vector. Location tracking through the network layer, however, is harder to prevent from the user side because it targets carrier infrastructure rather than the phone.

The report is likely to renew pressure on telecom operators and defense agencies to accelerate the retirement of insecure signaling and to tighten controls over who can access interconnection networks. Militaries have separately invested in dedicated communications systems and operational security guidance precisely to limit reliance on commercial cellular networks, but personnel routinely carry consumer devices that remain reachable through the public system. The episode serves as a reminder that the systems enabling everyday mobile connectivity were not built with modern adversaries in mind, and that closing those gaps requires coordinated action across an industry spanning hundreds of operators and national borders.