SS7 location tracking, Diameter flaws, GTP tunnels, BGP route leaks.
AT&T deployed Common Channel Interoffice Signaling (CCIS) across its toll network, separating call control signaling into a dedicated data network and neutralizing acoustic blue box toll fraud.
CCITT standardized the SS7 protocol suite in 1988 across mobile and fixed networks, built on implicit operator trust with no authentication — the root cause of every later signaling attack.
On 8 July 2008, Dan Kaminsky and DNS vendors released coordinated patches for a fundamental DNS cache-poisoning flaw (CVE-2008-1447, CERT VU#800113) affecting ISP resolvers worldwide; full details followed at Black Hat USA in August 2008.
On 24 February 2008, while implementing a domestic block on YouTube ordered by Pakistani authorities, Pakistan Telecom (AS17557) announced 208.65.153.0/24; upstream PCCW Global (AS3491) propagated it and most of the internet sent YouTube traffic to Pakistan for roughly two hours.
On 10 August 2008 at DEF CON 16, Alex Pilosov and Anton "Tony" Kapela showed in "Stealing The Internet: An Internet-Scale Man In The Middle Attack" that a BGP prefix hijack could be turned into a stealthy interception: they diverted traffic bound for the conference network to a system in New York and delivered it back to Las Vegas.
At the 25th Chaos Communication Congress in Berlin on 27 December 2008, Tobias Engel showed that anyone with SS7 access, or a cheap commercial HLR-lookup service, could locate a mobile subscriber to roughly city level without the owner's knowledge.
On 8 April 2010 China Telecom's AS23724 originated about 37,000 prefixes it did not own for roughly 15–18 minutes, briefly drawing some traffic for US government, military and commercial networks through China; whether it was an accident or deliberate remains disputed.
Positive Technologies' 2014 report "Vulnerabilities of Mobile Internet (GPRS)", publicized in February 2015, showed that GPRS Tunnelling Protocol (GTP) nodes reachable from the internet and the GRX roaming network let attackers brute-force subscriber identities, hijack or block mobile data sessions and obtain subscriber data — building on P1 Security's 2011 "Attacking GRX" research. A 2020 Positive Technologies assessment found every one of 28 tested operators still exploitable via GTP.
Tobias Engel and SRLabs demonstrated at 31C3 that SS7 design flaws allow global subscriber location tracking, call interception, and SMS 2FA theft using legally obtainable access to the signaling network.
At Hackito Ergo Sum in Paris (October 2015), P1 Security researchers Laurent Ghigonis and Philippe Langlois showed a remotely exploitable flaw in an LTE Diameter Routing Agent, one of the first public demonstrations that 4G Diameter signaling inherited SS7-style interconnect trust problems; Nokia Bell Labs (2016) and Positive Technologies (2018) then published Diameter location-tracking and denial-of-service attacks over IPX interconnects.
On 17 April 2016, CBS 60 Minutes aired "Hacking Your Phone," in which Karsten Nohl's SRLabs team in Berlin, knowing only the number of an iPhone lent to Rep. Ted Lieu (with his consent), tracked the device and recorded his calls via SS7.
On 24 April 2018, attackers announced Amazon Route 53 address space from eNet (AS10297), a hosting provider in Columbus, Ohio, hijacking DNS for MyEtherWallet.com for about two hours and stealing roughly $150,000 in Ether.
On 1 April 2020 at about 19:28 UTC, Russian operator Rostelecom (AS12389) announced roughly 8,800 prefixes belonging to about 200 networks, including Akamai, Cloudflare, Amazon AWS, Hetzner and DigitalOcean, for about an hour.
On 4 October 2021, Facebook, Instagram, WhatsApp and Messenger went offline worldwide for about six hours after a maintenance command disconnected Facebook's backbone and its DNS servers withdrew their BGP routes.
On 16–17 April 2021, Vodafone Idea Ltd's AS55410 suddenly originated more than 30,000 prefixes it did not own — against roughly 824 normally — including address space of Google, Microsoft, Akamai, Cloudflare and Fastly, producing a 13x surge of inbound traffic into its Indian network.