Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found.
If phone would be losed then it will be harder to find an owner for people that found it if SIM is protected with PIN.

So is there any reason to protect SIM card with PIN?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

When SIMs were introduced, the purpose was to contain the user's identification for the sake of the mobile network. The small, relatively cheap physical objects were a convenient way of deploying subscriber identities separately from the bulky, expensive phone that may or may not have been supplied by the network operator. (Hence the name subscriber identity module.) The primary asset on the SIM is the identity of the user (in his role as subscriber to the mobile phone service); a secondary asset is the cryptographic key that protects it. See Security Engineering by Ross Anderson, §20.3.2 (§17.3.3 in the first edition).

You'll note that this is an asset of the network operator. The user has little incentive in protecting his identity. In practice, the loss of this asset means that the phone has been stolen. The loss of the phone is usually a higher cost than the possible loss of communication credit to the thief.

Over time, phones started to have more and more features. In particular, on basic mobile phones, the SIM tends to contain private data such as an address book. This private data is an asset of the user. With the move towards feature phones and smartphones, the private data escaped the SIM, which went back to containing little more than the subscriber's identity.

When you boot a basic phone, you're typically prompted to enter a 4-digit code. That's authentication for the SIM: basic phones tend not to have any authentication. When you boot a smartphone, it prompts you for its own authentication, and most users don't bother with a SIM PIN on top. I don't have figures, but I believe that most people do have one PIN (or other authentication factor such as gestures) for their mobile device, either for the SIM or for the phone. Miraculously (well, it's partly by design), the authentication or lack thereof correlates with the value of the assets to the user.

Access to the SIM allows the thief to impersonate the user, but only for a limited time, until it is reported stolen. If the thief has an unlocked SIM, he can access the user's voicemail and SMS history. This is a reason to protect your SIM even in a smartphone, but a weak one for most people: mobile phone theft is predominantly about the value of the phone, also more and more about leveraging smartphone data, but rarely targeted at the victim's private information. If you're likely to be targeted for your private data (say, if you regularly negociate multimillion deals on your phone), you'd better protect your SIM.

An unprotected SIM allows the thief to make phone calls without paying, and most importantly, anonymously. There are two main ways to make anonymous mobile phone calls: with a stolen SIM, if the thief isn't caught; and with a prepaid SIM, if it is bought anonymously (typically for cash or with a stolen credit card). A stolen SIM is inconvenient for that purpose in that it has a limited useful life (only until the SIM is blacklisted, which the operator can do). If the stolen SIM can go undetected for long enough to be fenced, it is much more valuable, as it makes the link between the SIM and the thief hard to trace.

If the thief uses the SIM, his approximate location becomes known. This is rarely a concern. The location of the theft is broadly known anyway. The identity of the thief is not known a priori; what is valuable is “where was criminal X at time T?”, not “where was the thief of this SIM at time T?”. The thief location is only useful if you can correlate the stolen SIM with the criminal in the first place. In practice, the phone is more likely to be traced than the SIM (both are equally traceable by the operator or law enforcement).

Note: this answer assumes that the thief is unable to guess or bypass the SIM PIN. This is a realistic assumption in most situations, as the SIM will lock after 3 invalid guesses, and the cost of breaking the SIM is typically higher than the assets.

share|improve this answer
    
I would like to make a (slightly irrelevant point) that in my country, Singapore, you are required by law to prove your identity before purchasing a prepaid sim card. –  Terry Chia Aug 20 '12 at 2:10
1  
This is only valid if a phone is lost or stolen while switched off. I usually have entire months or even years when I don't have to enter the PIN because my phone is never turned off. I think most people don't carry phones around while they are switched off or have empty batteries. –  vsz Aug 20 '12 at 6:09
    
@vsz On most phones, you have an option that will prompt the PIN login everytime it's been locked. –  Kao Aug 20 '12 at 8:29

I think there is.

Stolen phones can also be found by their IMEI, the devices ID. But it's probably too much effort for law enforcement.

Same goes for SIMs... Most people will simply get a new SIM instead of waiting for somebody to find and return it to them.

On the other hand, if somebody steals your SIM, they could use it to impersonate you. They could write text messages from your number, they could receive mobile TANs (e-banking authorization codes) and much more. So there are some reasons for using a PIN.

share|improve this answer
    
How are TANs and the like a concern? If the phone is stolen with the SIM unlocked, the presence of a PIN is irrelevant. If the thief is in a situation where he may need to unlock the SIM, it's likely that the user wasn't actively using his phone at the time of the theft, so the thief would only have access to stale one-time credentials. –  Gilles Aug 20 '12 at 0:15
1  
If you're on contract, they could use your SIM to run up a massive bill with app purchases and premium rate calls. Wouldn't be much fun to get landed with that. –  Polynomial Aug 20 '12 at 5:58
    
@Gilles: but the phone could be locked. –  Tie-fighter Aug 20 '12 at 11:34

SIM can contain many things. For example your contacts, personalisation settings etc.

So the first use of the PIN is to protect your private life. Moreover, being able to use a SIM with no PIN makes a thief able to use your mobile subscription: make illicit calls, charge you with mobile services or use the phone for some other illegal activity that could incriminate you. Impersonation can also take place, leading to bigger problems: identity theft, social engineering etc.

Anyway, as you would keep your credit card PIN secret and active, or you wouldn't give anyone your address and your keys: keep your SIM protected with a good PIN. Do NOT use a too simple password!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.