Iran suspected in SS7 tracking of US troops
A Citizen Lab researcher says mobile network and ad-tech vulnerabilities were likely used to track US military personnel's location during the Iran conflict, with some activity traced to an Iranian carrier.
Sourcecitizenlab.ca — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Citizen Lab senior research fellow Gary Miller told the Financial Times that threat actors exploited SS7 signaling protocol weaknesses and commercial ad-tech data streams to obtain real-time location information on US military personnel during the recent conflict with Iran. Miller stated it would be surprising if Iran were not leveraging SS7 access or other mobile network footholds in the region to track US personnel, and noted that at least some tracking attempts could be linked to an Iranian mobile phone operator.
The reporting highlights the persistent risk that legacy telecom signaling infrastructure (SS7) and the advertising technology ecosystem pose for high-value individuals, including military personnel operating abroad. Unlike typical malware-based espionage, this activity relies on abusing roaming and interconnect trust relationships between carriers, plus location data harvested through mobile advertising exchanges, to achieve continuous, real-time geolocation of specific targets without needing to compromise the target's device directly.
Attribution to Iran is presented as a strong suspicion based on capability and observed carrier linkage rather than definitive technical proof, and details on scope, victim count, and specific techniques remain limited in this brief commentary. The disclosure nonetheless underscores an active operational security concern for US and allied personnel in the region.
Source reporting: https://citizenlab.ca/us-military-smartphones-targeted-through-roaming-and-ad-tech
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs