Intercepting SMS is incredibly easy. Not with this tool, but via other methods. SMS is broken and should never be used for any type of sensitive communication, be it 2fa or pics you don't want to see online.
> Hey I'm one of your roaming partners and this phone here is roaming on my network, can you send me their calls & texts?
> Sure mate, here they are, enjoy!
Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7.
The SMSC routes an SMS to the IMEI of the phone.
I was simplifying, but how roaming works is that on every call a mobile number from the visited network is assigned to the SIM, and the host network is instructed to send the call there; in the case of an attacker I expect them to be able to use this mechanism to send calls anywhere they want.
They could also most likely fake USSD which is I believe used behind the "Call forwarding" toggle in your phone's settings.
There are plenty of SS7-related demos & presentations posted here on HN, I suggest you use the search and find them, the people making those have much more experience than me in the field and you're better off with then rather than my half-assed explanations, but the point is, call and text interception is possible, among other nasty things (silently tracking a phone' approximate location, DoS, etc).
IIRC, the paging channel is a broadcast channel that was originally used to send short message to a handset to advise them of an incoming call and to request a private channel to receive it. It had lots of excess capacity so someone had the idea of pushing short text messages over it.