Rooting SIM cards

https://srlabs.de/rooting-sim-cards/

by blumentopf • 13 years ago

64 14 13 years ago

srlabs.de

ChuckMcM• 13 years ago

Per the earlier discussion, that sounds waaaay to straight forward. Now I need to figure out if my phone is vulnerable.

X-Istence• 13 years ago

As someone working in security ... this does not surprise me at all.

e12e• 13 years ago

So, even if the vulnerability (with insecure keys) is fixed, unless the architecture is changed, I suppose all sim-cards will remain wide-open to intelligence services -- as one would have to assume that they'd put quite an effort into getting their hands on a copy of these keys.

mje__• 13 years ago

SIM's use a derived key - which means that getting your hands on that key would only affect that specific SIM, and generally the Km (master key) exists only on an HSM.

There's not much point in the intelligence services going after these keys, if they can just put a box in the operator's data center and capture unencrypted traffic

yaantc• 13 years ago

The architecture is fine. A better explanation would be: if an incompetent operator use obsolete technology then its SIM card can be hacked. But any half-decent should be immune to this (there are billions of SIMs, and here it's "millions" only vulnerable).

First, in a proper network the mobile device and the network mutually authenticate themselves. So the cell can't be faked. Then it's very easy for the network to filter such management SMS and only allow them from their trusted server. It's a very basic security precaution. If done, you don't depend on the SIM crypto scheme for secure SMS, but here too using DES is a joke and 3DES / AES have been available for ages.

So I guess it's another sensationalistic report made to draw readers for most.

As for intelligence services, they already have access for domestic operators. This could only be for foreign and loosy operators maybe.

chime• 13 years ago

Since iOS doesn't run Java applets, would all iPhones be safe from this? Or does this mean SIM cards run some form of JVM and can be infected regardless of the phone OS?

nobodyshere• 13 years ago

It isn't about iOS at all. Your iPhone might be vulnerable, mine as well.

ars• 13 years ago

It runs on the SIM card, not the phone.

jdbernard• 13 years ago

The latter. A SIM chip is a microprocessor with it's own OS. Many SIMs today run a version of the JVM that has been stripped down and retooled for the more constrained environment on the smart card (see http://en.wikipedia.org/wiki/Java_Card).

However, I would be very surprised if a phone bought in the last 5 years was susceptible to this attack. I used to work for one of the leading providers of SIM chips and almost all of our product was using 3DES or AES, and that was several years ago.

lukego2• 13 years ago

I've seen freshly built networks about 5 years ago that had no encryption or authentication what-so-ever on their SIM cards. Anybody could "brick" any SIM with an OTA command to overwrite the IMSI file, or intercept SMSes by overwriting the SMS service center address, etc.

SIM vendor didn't want to install crypto keys for free, network operator didn't understand the importance...

conroy• 13 years ago

I had no idea that SIM cards executed code. I naively assumed they just contained hard-coded information, similar to a credit card. The fast that they execute Java applets blows my mind.

pygy_• 13 years ago

AFAIK, all smart cards (including credit cards) contain a microcontroller.

[0] https://en.wikipedia.org/wiki/Smart_card

Rooting SIM cards

Related Stories