Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

A customer has asked to conduct a pen-test on the phones of employees. The target is text messages in the phones. Text messages are stored on the SIM for security reasons. Physical access to the phones is allowed only when the phone is turned off. The customer has asked for what approach we're going to take.

I came up with the following, but nothing is satisfactory.

Break the pin-code which is asked when the phone is turned on by cloning the card 1000 times and brute-forcing the pin-code. Idea is that if after 3 tries the first card locks, i can continue with the second card. This way I have more chances for brute-forcing the pin.

First question: Is this a good idea or are there any flaws in this approach?

Second question: Can you advise me a better/easier/cheaper approach?

share|improve this question
Since I am not a native english speaker, I have missed some things. First all of you said "phones of employees". So differents phones, with different SIMs and different PINs. Right? Are you gonna clone ALL of them and brute force them ? And I didnt get the "Physical access to the phones is allowed only when the code is turned off". You mean when the phone is turned off? What are you/your costumer wanna prove/test. That you can crack the PIN? Any small cell phone repair shop (or even you with the right service manuals) can reset the PIN if you have physical access to the SIM. I'm missing sth ? – labmice Feb 27 '11 at 0:01
labmice, yes different phones and different pins but the point is that almost all employees have sms-messages with confidential info. Besides, having access to the phone allows for impersonation. The customer wants to know how much effort it costs to break/bypass the pin and depending on that if it is better to switch. A proof-of-concept is required with a detailed approach such that the customer can decide for himself if it is safe and for how long. So about the repair shop, how can a PIN be resetted? Any detailed info? – Henri Feb 27 '11 at 16:09
Newer SIM cards should have anti-tamper protection that makes it useless if you try to clone it. Have you already succeeded in cloning one? – Giacomo Verticale Feb 27 '11 at 18:24
Henri.... these SIM cards, belong to the employees? What about the cell phones? As devices. I don't care who is paying the bill. The cell phones (as devices) and the SIM cards (as just SIM cards) belongs to the company or the employees. And if they belong to the company, what was the "written aggrement" about the use of those devices. Can the employees make personal calls? Take personal photos? Sent personal sms having NO company info inside the text? – labmice Feb 27 '11 at 18:57
1  
I'm not so clear on what you're trying to acheive here. Can you elaborate? In fact, I would suggest you back up, and as a first step figure out your threat model. What do you expect to be protected? What attack scenarios are you expecting, and want to prevent? Etc... Then, you can work from there and figure out how to verify these things. E.g. are you looking at sensitive company info in SMS? Pics of stolen docs? Cached data from corp apps on smartphones? Worried about stolen phones? Spoofed phone #? And so forth.... – AviD♦ Feb 28 '11 at 19:04
show 2 more comments

1 Answer

up vote 3 down vote

A few questions come to mind with the brute force attack:

  1. What is the length of the PIN
  2. What is the timeout length

Now for actually trying to break into the phone I would first look for wear on the screen protector, smudges, or wear on the keypad (specifically numerals). If you are allowed to match it to an employees desk I would look for written down passwords and/or calendars marked with what appear to be important dates (birthdays and anniversaries). Also, looking at the wear on the keypad of their computer keyboard could be a large indication as to what their PIN is, namely because humans don't like to have multiple passwords for multiple systems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.