A bit of a plug. If anyone is interested in playing with (doing research on) SS7 vulnerabilities, a few years back (five) I've participated in building a pretty

A bit of a plug. If anyone is interested in playing with (doing research on) SS7 vulnerabilities, a few years back (five) I've participated in building a pretty cute test toolkit that allows one to sent/receive/parse/play scenarios using SS7/C7/3G/CDMA/.../SCTP/SS7 over IP/... packets on any level of the network. The list of supported protocols is available here: http://www.linkbit.com/platforms http://www.linkbit.com/platforms It follows standards and usually implements 100% of the protocol (including conditional constraints, etc). But also allows one to 'break' stuff and send custom/unsupported/broken fields. It is pretty cute, you can do most of the stuff just in the visual packet editors / flow editors and where necessary revert to python snippets. To get the feel of it, and see some pics: http://docs.linkbit.com/ http://docs.linkbit.com/ edit: and basically yes. as a protocol engineer and somebody very familiar with SS7/C7/GSM/.., once you have the access to the network (which can be done over IP!) I wouldn't be at all surprised, you could misuse it.