Israeli telecom infrastructure used to track phones in over 10 countries, investigation finds

Israeli telecommunications infrastructure has been exploited over the past three years to track mobile phone users in more than 10 countries, according to a new investigation by Canadian-based digital research group Citizen Lab, as reported by Haaretz. The infrastructure—ranging from legacy networks built in the 1970s to the most advanced 5G systems—was turned into “tracking devices” using sophisticated spyware programs. Since November 2022, more than 15,700 attempts were made to determine phone locations in countries including Thailand, South Africa, Norway, Bangladesh, and Malaysia via Israeli telecom companies’ networks.

SS7 and Diameter exploitation

Internal documents seen by Haaretz revealed that Verint, the parent company of Cognyte, sold an SS7-based tracking system called SkyLock to a government client in the Democratic Republic of Congo. The findings also showed that Fink, a Swiss telecom, enabled Israeli surveillance firms such as Rayzone to impersonate cellular carriers and connect to legacy mobile networks, exploiting the SS7 signaling protocol for surveillance. SS7 was originally designed to route calls and texts, support roaming, and enable interoperability. Next-generation Diameter systems used in 4G and 5G networks were also exploited. One notable cyberattack technique, SIMjacking, involves sending a hidden SMS that forces the SIM card to share the device’s location.

Companies implicated and responses

Phone tracking operations were carried out through the networks of Israeli telecommunications companies 019Mobile and Partner Communications. 019Mobile responded that it is a virtual operator and that its identity may have been impersonated, denying involvement in any tracking operations. There were no immediate responses from Fink, Partner Communications, Exelera Telecom, or Cognyte/Verint.