Diameter Signaling Attacks
Diameter is the AAA and mobility-signaling protocol that replaced SS7 MAP for LTE core interconnect. It ships with TLS/DTLS/IPsec transport security, which many operators do not enforce on roaming links, and it inherits SS7's implicit trust between roaming partners. The result is a well-documented catalog of Diameter-specific attacks that map cleanly onto GSMA FS.19 categories 1, 2, and 3.
This hub is a focused attack catalog rather than a broad protocol overview: S6a abuse (Insert-Subscriber-Data-Request forging profile updates, Purge-UE-Request forcing detach, Cancel-Location-Request stealing subscribers, Update-Location-Request revealing serving MME, Authentication-Information-Request harvesting AVs), subscriber location tracking via location-reveal AVPs, SMS interception via re-registration, denial of service via crafted CER/DER exchanges, and roaming-fraud patterns that manifest at the Diameter layer specifically. Each attack class is mapped to its FS.19 category and to the countermeasures a Diameter firewall must implement to block it.
Diameter attacks are the LTE analog of the classic SS7 attack set, but the interface primitives, AVP structures, and roaming trust boundaries differ enough that SS7 defenses do not transfer. Category-1 attacks (single-message, information disclosure) can often be blocked at the DEA with static AVP validation; category-2 and category-3 attacks require session correlation and cross-message logic that only a real Diameter firewall or monitoring platform can provide.
Frequently asked questions about diameter signaling attacks
Do I need a Diameter firewall if I already have an SS7 firewall?
Yes. SS7 firewalls filter at the SCCP/MAP/CAP layer and do not see Diameter traffic, which uses a different transport (SCTP/TCP with TLS/IPsec) and different attack semantics (S6a IDR/PUR, S9, S13). GSMA FS.19 defines category 1/2/3 screening rules that a Diameter Edge Agent (DEA) must enforce independently. Operators running 4G/LTE interconnect need both firewalls; consolidated signaling firewalls implement the FS.11/FS.19/FS.20 rule sets in a single policy engine.
What is the Diameter protocol and how is it exploited?
Diameter replaced SS7 MAP for 4G/LTE signaling, handling authentication, authorization, and accounting between network functions. Despite using SCTP/TCP transport, Diameter inherits trust-model weaknesses from the interconnect architecture. Attacks include unauthorized subscriber location queries, forced handover to rogue networks, and denial of service via crafted Diameter messages.
What is GSMA FS.19 for Diameter roaming security?
GSMA FS.19 is the Diameter Interconnect Security recommendations document, structurally analogous to FS.11 for SS7. It defines category-based filtering for Diameter roaming and interconnect messages (S6a, S9, S6d, S13, Rx) covering subscriber tracking, information disclosure, denial of service, and fraud/interception scenarios. Diameter firewalls at the DEA (Diameter Edge Agent) implement these categories at the LTE/4G roaming boundary.
What are roaming attacks and why are they difficult to prevent?
Roaming attacks exploit the interconnect signaling between operators (SS7, Diameter, GTP) to perform location tracking, call/SMS interception, and fraud while the attacker operates from a remote network. They are difficult to prevent because roaming requires operators to accept certain signaling messages from partner networks, and legitimate roaming traffic can be hard to distinguish from malicious queries.
What is a Diameter Edge Agent (DEA) and how does it enforce security?
A Diameter Edge Agent is the network element that terminates Diameter roaming and interconnect signaling at the border of an operator's network. It performs message routing, topology hiding, protocol translation, and security enforcement — validating origin realms, filtering Category 1/2/3 messages per GSMA FS.19, rate-limiting suspicious flows, and cross-checking VPLMN plausibility. In practice, most Diameter firewall functionality is deployed as a DEA feature.
How does VoLTE differ from VoNR from a security perspective?
VoLTE carries voice over the LTE packet core using IMS with Diameter Cx/Sh/Rx and SIP signaling, secured by IMS-AKA, IPsec on Gm, and SRTP on the media plane. VoNR carries voice over 5G New Radio using the same IMS core but reached via the 5G service-based architecture and N32/SEPP for roaming. VoNR inherits IMS-layer security largely unchanged while gaining 5G radio and core protections (SUCI, 256-bit keys, SBA TLS). SIP-layer risks — registration hijack, INVITE fuzzing, toll fraud — apply to both.
What is the Evolved Packet Core (EPC) in LTE?
The EPC is the core network architecture for 4G/LTE, comprising the MME (Mobility Management Entity) for signaling, the S-GW (Serving Gateway) for user-plane routing, the P-GW (PDN Gateway) for external connectivity, and the HSS (Home Subscriber Server) for authentication data. All control-plane traffic between these nodes is protected by IPsec tunnels in compliant deployments.
How does 5G-AKA differ from EPS-AKA in LTE?
5G-AKA enhances EPS-AKA with home-network verification of authentication results, SUPI concealment via SUCI, support for 256-bit key derivation, and binding of the serving network name into the authentication process. These changes prevent certain impersonation attacks and add an extra layer of home-network control over roaming authentication.
How can supply chain attacks affect mobile network equipment?
Supply chain attacks target the hardware and software components used in network infrastructure—base stations, core network elements, SIM cards, and firmware updates. Backdoors or vulnerabilities introduced during manufacturing or software development can provide persistent, covert access to network systems. The GSMA NESAS scheme and EU NIS2 Directive address supply chain security through vendor certification and risk management requirements.
What tools are used for SS7/Diameter security testing?
Specialized tools for telecom security testing include SigPloit (open-source SS7/Diameter/GTP testing framework), P1 Security's assessment platforms, Catapult/Developing Solutions test suites, and custom SCTP/TCAP stacks. These tools can craft and send specific signaling messages to test how network elements respond to malicious or malformed requests.
Is VoLTE traffic encrypted end-to-end?
No. VoLTE is encrypted hop-by-hop, not end-to-end. The Gm reference point between the UE and P-CSCF is protected by IPsec ESP (IMS-AKA), and media between the UE and access gateway is optionally SRTP; but signaling and media inside the operator core, between IMS and the interconnect, and across the peer network are handled in cleartext or under separate transport security. Lawful interception assumes exactly this model. Fully end-to-end encrypted voice requires OTT applications on top of the mobile data channel.
How is P-CSCF discovered by a VoLTE UE?
A VoLTE UE discovers its P-CSCF via one of three mechanisms (3GPP TS 23.228, TS 29.061): DHCPv4/DHCPv6 options (RFC 3319/3361/3646), Protocol Configuration Options (PCO) delivered in the EPS attach/PDN Connectivity Request, or DNS NAPTR/SRV lookup on the home domain. In practice PCO is the mainstream path in commercial VoLTE deployments; DNS is used mainly for IMS interworking and enterprise SIP trunks.
Related glossary terms
- AKA Authentication and Key Agreement
- Location Tracking Attacks
- Diameter
- FS.19 GSMA Fraud and Security Group Recommendations
- IMSI International Mobile Subscriber Identity
- Interconnect Security Model
- LTE Long Term Evolution
- Roaming
- Signaling Penetration Testing
- UEA User Equipment Algorithm
Compliance crosswalks
More on Diameter Attacks
Browse all topic hubs, the Ultimate Guide to Mobile Network Security and the TelcoSec Glossary.