At one point, one of the attack vectors was said to be by spoofing or otherwise manipulating traffic to/from a wireless femtocell. The same wireless femtocells that many operators will gladly sell or give to you for free or very little $.

I don't know how effectively that strategy still works today, but I think it speaks to the significant degree to which the phone system is completely insecure and untrustworthy by design.

Almost every telecom company in the world has access to SS7 network so the attack surface is very wide.

Small telecoms in developing nations, corruption of the LEC telecom in places vulnerable to bribery, and CLEC interconnections for SS7 traffic.

Majors:

1. Renting access by pretending to be legit telecom business

2. Internal access

3. Internet hacking into less protected telecom operators to then compromise the SS7 core network nodes and send traffic from there.

Other ways exist, but these represent the bulk.

gruez, SS7MAP - it's a CLI app written in Erlang, you can find it on Github I think. At least it is useable :)

SS7 is just another network that you can buy access to from telcos.