Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need to proof that a user of my app is in possession of the correct SIM card.

On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof that a user belongs to a specific phone number is not discussed here). As an android app can receive SMSes programmatically, the transmitted challenge can then be sent back to the server using the data connection. Obviously, there is more security to be implemented (e.g. digital signature of the challenge), but this is not relevant here.

Reacting programmatically to incoming SMSes is not possible with iOS. Does anyone have an idea how to proof the possession of the correct SIM card in iOS?

Thanks in advance.

share|improve this question
2  
Are you looking for a programmatic solution? otherwise can't you just send an SMS with some random password/digits and ask the user to key it into the app as means of authentication? –  Yoav Aner Feb 19 '12 at 18:31
    
You're right, this would be a way. But I'd prefer a programmatic solution if somehow possible. –  pfust75 Feb 19 '12 at 19:50
add comment

3 Answers

if you look at the apple developer sample it has a reachability framework that will tell you if there is a connection and what type of connection it is. If there is a valid connection other than wifi it would signify a valid sim in the device. You can find the sample code here https://developer.apple.com/iphone/library/samplecode/Reachability/

share|improve this answer
    
I think you misread the question: the problem is not detecting the presence of a SIM card, but to verify the presence of a specific SIM. –  Gilles Mar 2 '12 at 15:09
add comment

This is 100% impossible on a jail-broken device. Or put another way, this will never be possible if the user has a say. What is a SIM card? Its just a small memory storage device that is no different than a virtual disk image. There is no way to verify this information. An end user can spoof this information just as easily as their IMEI number.

It is trivial to spoof the origin of an SMS or an outgoing call.

I don't believe there can be any uniquely identifying information on a platform that is 100% attacker controlled. And if its not completely controlled its only a matter of time before someone writes a jailbreak for it.

share|improve this answer
1  
Well, even on a jailbroken device an SMS is only delivered to the device if it's in the possession of the correct SIM card. So receiving an SMS that contains a challenge works also on jailbroken iOS devices... As it's not possible to react automatically to an incoming SMS the user has to read the challenge and has to enter it in the corresponding app. It's definitely not user-friendly, but quite secure... –  pfust75 Mar 3 '12 at 17:02
add comment

I believe Ericsson were working on something similar to this. I'm not sure how far they have progressed, nor how easy or expensive it is but maybe worth being aware of.

https://labs.ericsson.com/apis/identity-management-framework/

All I've seen is some nice video slides showing how the framework would work to allow you to authenticate people based off their SIM. It uses something called Generic Bootstrapping Architecture to check the authenticity of a SIM/IMEI combination. If the iPhone doesn't support it at the moment, it should do in the future as it is a 3GPP standard.

http://en.wikipedia.org/wiki/Generic_Bootstrapping_Architecture

Sorry if this isn't the sort of thing you're looking for.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.