Silent SMS

A "silent SMS" — also called Type-0 SMS or stealth ping — is a short message delivered to a handset that triggers the normal mobile-terminated signalling chain (the home SMSC issues SRI-SM to the HLR to locate the subscriber, then MT-ForwardSM to the serving network) but is discarded by the UE without notifying the user. The mechanism is part of the SMS specification: TP-PID values defined in 3GPP TS 23.040 cause the message to be silently dropped at the handset.

The reason silent SMS matters for security is that the signalling generated by the delivery attempt leaks information regardless of whether the message is displayed. An attacker with appropriate SS7 access — or, in many publicly documented cases, a law-enforcement actor using lawful intercept tooling — can observe the serving-network response, infer presence on the network, and (combined with follow-on MAP queries such as AnyTimeInterrogation or abuse of ProvideSubscriberInfo) resolve down to a Cell ID or TAC. Repeated silent pings produce a movement track. The handset, by design, shows nothing.

Operator-side containment sits in two places. At the SMS perimeter, the SMS firewall can identify and rate-limit Type-0 traffic and treat anomalous silent-SMS bursts as abuse. At the SS7 perimeter, the SS7 firewall applies GSMA FS.11 controls (Category 1/2/3 screening, anti-IMSI-disclosure, plausibility checks) that close the follow-on MAP queries silent pings depend on for precise location. Both controls produce the audit trail an operator needs to demonstrate the abuse and act on it; see also SS7 Security for the underlying location-disclosure attack family.