Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found.
If phone would be losed then it will be harder to find an owner for people that found it if SIM is protected with PIN.

So is there any reason to protect SIM card with PIN?

share|improve this question

5 Answers 5

up vote 6 down vote accepted

When SIMs were introduced, the purpose was to contain the user's identification for the sake of the mobile network. The small, relatively cheap physical objects were a convenient way of deploying subscriber identities separately from the bulky, expensive phone that may or may not have been supplied by the network operator. (Hence the name subscriber identity module.) The primary asset on the SIM is the identity of the user (in his role as subscriber to the mobile phone service); a secondary asset is the cryptographic key that protects it. See Security Engineering by Ross Anderson, §20.3.2 (§17.3.3 in the first edition).

You'll note that this is an asset of the network operator. The user has little incentive in protecting his identity. In practice, the loss of this asset means that the phone has been stolen. The loss of the phone is usually a higher cost than the possible loss of communication credit to the thief.

Over time, phones started to have more and more features. In particular, on basic mobile phones, the SIM tends to contain private data such as an address book. This private data is an asset of the user. With the move towards feature phones and smartphones, the private data escaped the SIM, which went back to containing little more than the subscriber's identity.

When you boot a basic phone, you're typically prompted to enter a 4-digit code. That's authentication for the SIM: basic phones tend not to have any authentication. When you boot a smartphone, it prompts you for its own authentication, and most users don't bother with a SIM PIN on top. I don't have figures, but I believe that most people do have one PIN (or other authentication factor such as gestures) for their mobile device, either for the SIM or for the phone. Miraculously (well, it's partly by design), the authentication or lack thereof correlates with the value of the assets to the user.

Access to the SIM allows the thief to impersonate the user, but only for a limited time, until it is reported stolen. If the thief has an unlocked SIM, he can access the user's voicemail and SMS history. This is a reason to protect your SIM even in a smartphone, but a weak one for most people: mobile phone theft is predominantly about the value of the phone, also more and more about leveraging smartphone data, but rarely targeted at the victim's private information. If you're likely to be targeted for your private data (say, if you regularly negociate multimillion deals on your phone), you'd better protect your SIM.

An unprotected SIM allows the thief to make phone calls without paying, and most importantly, anonymously. There are two main ways to make anonymous mobile phone calls: with a stolen SIM, if the thief isn't caught; and with a prepaid SIM, if it is bought anonymously (typically for cash or with a stolen credit card). A stolen SIM is inconvenient for that purpose in that it has a limited useful life (only until the SIM is blacklisted, which the operator can do). If the stolen SIM can go undetected for long enough to be fenced, it is much more valuable, as it makes the link between the SIM and the thief hard to trace.

If the thief uses the SIM, his approximate location becomes known. This is rarely a concern. The location of the theft is broadly known anyway. The identity of the thief is not known a priori; what is valuable is “where was criminal X at time T?”, not “where was the thief of this SIM at time T?”. The thief location is only useful if you can correlate the stolen SIM with the criminal in the first place. In practice, the phone is more likely to be traced than the SIM (both are equally traceable by the operator or law enforcement).

Note: this answer assumes that the thief is unable to guess or bypass the SIM PIN. This is a realistic assumption in most situations, as the SIM will lock after 3 invalid guesses, and the cost of breaking the SIM is typically higher than the assets.

share|improve this answer
    
I would like to make a (slightly irrelevant point) that in my country, Singapore, you are required by law to prove your identity before purchasing a prepaid sim card. –  Terry Chia Aug 20 '12 at 2:10
1  
This is only valid if a phone is lost or stolen while switched off. I usually have entire months or even years when I don't have to enter the PIN because my phone is never turned off. I think most people don't carry phones around while they are switched off or have empty batteries. –  vsz Aug 20 '12 at 6:09
    
@vsz On most phones, you have an option that will prompt the PIN login everytime it's been locked. –  Kao Aug 20 '12 at 8:29

Nowadays the SIM cards hold less personal info than they used to hold; smartphones don't store contacts in the SIM anymore, SMS messages are immediately copied to the smartphone's memory and erased from the SIM, so in the end the only personal thing that's left is the phone number itself, it can still be used for social engineering, calling premium rate numbers or receiving 2-factor authentication tokens.

However, the big downside of a SIM PIN is that smartphones can't remember it and prompt you each time they reboot (there's no technical reason preventing this, the phone can remember the SIM's ICCID + PIN and automatically "enter" it each time it boots if the ICCID matches the registered card's one), so now think about what happens if your phone is stolen, has a passcode and you use Find My (i)Phone to track it... great, you can get it back ! Now what if the thief reboots the phone or it runs out of battery... the phone's passcode prevents the thief from even attempting to enter a PIN once the phone is powered back on, without that there's no more data connection and you can no longer track the phone.

share|improve this answer

Thieves are stealing phones now, not for the value of the phone, but because before it's reported lost or stolen they're dialling premium rate numbers which they control. They get a share of the revenue from dialling the numbers so they steal the phone, transfer the SIM to another phone and then call the premium rate number. The original owner of the phone is then landed with a bill for the calls made until the SIM is blocked.

A recent story in the UK media was about a person who's phone was stolen and the thief ran up a £15,000 bill by transferring the SIM into another phone.

That's why it's a good idea to SIM lock.

share|improve this answer

SIM can contain many things. For example your contacts, personalisation settings etc.

So the first use of the PIN is to protect your private life. Moreover, being able to use a SIM with no PIN makes a thief able to use your mobile subscription: make illicit calls, charge you with mobile services or use the phone for some other illegal activity that could incriminate you. Impersonation can also take place, leading to bigger problems: identity theft, social engineering etc.

Anyway, as you would keep your credit card PIN secret and active, or you wouldn't give anyone your address and your keys: keep your SIM protected with a good PIN. Do NOT use a too simple password!

share|improve this answer

I think there is.

Stolen phones can also be found by their IMEI, the devices ID. But it's probably too much effort for law enforcement.

Same goes for SIMs... Most people will simply get a new SIM instead of waiting for somebody to find and return it to them.

On the other hand, if somebody steals your SIM, they could use it to impersonate you. They could write text messages from your number, they could receive mobile TANs (e-banking authorization codes) and much more. So there are some reasons for using a PIN.

share|improve this answer
    
How are TANs and the like a concern? If the phone is stolen with the SIM unlocked, the presence of a PIN is irrelevant. If the thief is in a situation where he may need to unlock the SIM, it's likely that the user wasn't actively using his phone at the time of the theft, so the thief would only have access to stale one-time credentials. –  Gilles Aug 20 '12 at 0:15
1  
If you're on contract, they could use your SIM to run up a massive bill with app purchases and premium rate calls. Wouldn't be much fun to get landed with that. –  Polynomial Aug 20 '12 at 5:58
    
@Gilles: but the phone could be locked. –  Tie-fighter Aug 20 '12 at 11:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.