Telecom Honeypot

In telecom networks, a Telecom Honeypot is a decoy resource (such as an exposed SS7 point code, a fake Diameter peer, an emulated 5G NF, or a tarpit on signaling perimeters) deployed to attract and study attacker activity. Honeypots provide early warning of new techniques and feed indicators back into detection systems.

Categories: SignalingThreats and Attacks

Telecom Honeypot in context

Signaling protocols carry the control-plane instructions that set up calls, register subscribers, hand over sessions and route SMS. SS7, Diameter, GTP-C and SIP are the four dominant families, and interconnect exposure of any of them is treated by GSMA FS.11 / FS.19 / FS.20 as a top-tier telecom risk.

Telecom threats range from opportunistic SMS phishing and SIM swap to nation-state grade location tracking and lawful-interception abuse. The common thread is that most attacks exploit the inherited trust model of legacy signaling. SS7 and Diameter were designed for a closed operator community that no longer exists.

To place Telecom Honeypot in the wider telecom-security picture, review Telecom Forensics, Threat Hunting (Telecom), Indicators of Compromise (Telecom IoCs), IPS, Telecom Penetration Testing and Telecom Reconnaissance.

Related terms

Related topic hubs

  • Signaling Firewall Unified SS7/Diameter/GTP/SMS signaling firewall framework.
  • Diameter Attacks S6a IDR/PUR/CLR abuse, subscriber tracking, LTE signaling attacks.
  • SS7 Security SS7/MAP/CAP/SCCP attacks and defenses across 2G/3G interconnect.
  • SS7 Firewall GSMA FS.11 category 1/2/3 SS7 message screening at the STP edge.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.