Illegitimate Redirection of Terminating or Originating Calls

An attacker can redirect voice calls of subscribers to premium-rate numbers or to a third-party number. The call will be paid by the subscriber when establishing unconditional redirection, or by the operator when the subscriber is registered in a fake network and the subscriber's roaming number is spoofed.

Calls are redirected by using UpdateLocation, RegisterSS, InsertSubscriberData as well as by using AnyTimeModification that allows making changes to a subscriber.