I believe you can get access from eastern European phone companies for as little as a few thousand dollars. SS7 was designed kind of like BGP: if you're in the "in crowd" you can do whatever you want. You can start by googling "ss7 attack".

> googling "ss7 attack".

Oh indeed, I'm old enough to have played with raw SS7 back in the day. I'm just surprised that intentional access is allowed. I had assumed that this kind of access died when frame relays were phased out for fibre/"ethernet"

Obviously if you peer with a telecoms company then you'll get some level of access, but for obvious reasons I would have thought it would have some level of filtering, if only to stop them fucking with the billing.

Because of the international nature of telephone systems, you don't need to get SS7 access locally. There's plenty of telcos worldwide that sell SS7 capable lines.