Slashdot Mirror
Rooting SIM Cards
SmartAboutThings writes "Smartphones are susceptible to malware and carriers have enabled NSA snooping, but the prevailing wisdom has it there's still one part of your mobile phone that remains safe and un-hackable: your SIM card. Yet after three years of research, German cryptographer Karsten Nohl claims to have finally found encryption and software flaws that could affect millions of SIM cards, and open up another route on mobile phones for surveillance and fraud."
"Rooting" has an entirely different meaning in new Zealand and Australia.
Doesn't Verizon use SIM cards for their 4G LTE service?
Yes, there actually is a JavaVM autonomously running inside the SIM card. Yes, the provider can install programs on the SIM card that interface with the phone through a standardized API. Yes, this hack enables the attacker to do the same. Yes, the JavaVMs are not secure and breaking out of the sandbox enables the attacker to read the master key which identifies the SIM. Yes, that means the attacker can run a software simulation of a SIM card with your secret SIM key and impersonate you vis-a-vis the network. Yes, all that is possible because some providers still deploy SIM cards that accept binary SMS which are signed with DES. Not 3DES, not AES, which are both in the standard as well, but 56 bit DE fucking S.
Who cares? The providers have the encryption keys anyway, wether they are single DES or AES. So the government can get access too if they want them and do all kind of nasty tricks. Who else will use it? Some hacker who wants to call expensive paylines using your simcard doesn't buy $100,000 worth of equipment to pull it off only to gain $1000.
I think we're good
AT&T doesn't appear to currently be vulnerable to this particular researcher's attack because they're using 3DES instead of DES. It's not like 3DES isn't vulnerable, and it's not like there can't be other as-yet undisclosed bugs in javacard.
This is why I will continue to use my trusted tin-cans-and-string private network.
Damn we have been busted.
Now listen there, don't befuddle this discussion with sound logic...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
how much longer until I can install Debian on my SIM card?
It would be useful for Identity theft. A lot of services use a text message or call to reset passwords.... I can think of 5 other things but I'll keep them to myself as I wouldn't want to add anything to the discussion...
...was obviously not written by an Aussie... :-)
If you've watched the gsm/gprs stuff that this guy and others have done you would know that it takes under a $1,000 dollars worth of equipment to emulate a cell tower. As soon as you do that, sending the binary SMS is easy. This enables a literal drive by attack. Furthermore, my guess is that cell providers which are using vulnerable SIM cards are also running vulnerable networks. The second link talks about some networks allowing anyone who knows how to send binary SMS.
My question is how easy is it to configure a rooted Android phone to block and warn me about these binary text messages.
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
The whole idea of having an update feature in a SIM seems foolish to me. Do they have the same thing in credit cards that have a chip?
You'd be much more credible if you didn't use the word "sheeple".
Only the State obtains its revenue by coercion. - Murray Rothbard
So a very small percentage of all SIM cards then.
Troll is not a replacement for I disagree.
I clicked the link expecting to find something interesting and novel, perhaps something on par with Kocher's Differential Power Analysis attack, or better. But this guy spent three years to discover that there are a small number of ancient SIMs, not yet removed from service, which use 1DES for securing applet loading? Actually, I'm sure he did no such thing. Typical bad reporting, exacerbated by bad slashdot editing.
It looks to me like his talk is really about countermeasures to mitigate the risk for these ancient SIMs, on the assumption that they can't be replaced immediately. That's worthy of research and a talk, though it's hardly front-page material.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Agreed: but then GP is obviously wiser than *all* the rest of us, and seems to assume that all the rest of us have an Xbox or whatever to boot.
It must be painful to be so much better then everyone else.
Rgds
Damon
http://m.earth.org.uk/
The one unhackable part of your phone is the one that, if hacked, would enable you to defraud the phone company. Shows where the security priorties are, eh?
Vulnerability or security research is done in order to ensure security. Regardless who funds the research, it is better to find out the vulnerabilities before black-hat hackers do. Nobody knows does NOT mean it is secure...
he found his arsehole with just one hand
The new right fascists are bilingual. They speak English and Bullshit.
Whoever wrote this - the summary or the original article - has a severe attack of journalistic diarrhoea. They can't distinguish between "unhacked" and "unhackable".
"Unhacked" means that no successful exploit has been reported ; "unhackable" means that an attack is impossible. I heard of an "unhackable" computing device once - it was kept switched off, sealed in a block of concrete which had been thrown over the side of a ship in the middle of the Pacific. It didn't respond to "ping" in any protocol. It's usefulness was limited.
So, now an exploit is reported against SIM cards. Not a surprise ; I'll have to go and RTFM, to determine if I need to turn my phone off (since it has never known any banking details or similar secrets, it's not a terribly useful platform to hack into).
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"