How outdated SS7 can make SMS security worthless