Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IMHO there was a Blackhat video about it, but cannot find it:

Is it an existing problem that a mobile phone number could be faked? I mean when using internet banking:

The attacker gained the password for the internet banking, but an SMS token is needed to log-in.

Q: Can someone create a "fake mobile number" - for my phone numer - and get the SMS from me?

UPDATE: I'm not asking how to do it, I just want to know that it could be done or not.

share|improve this question
up vote 4 down vote accepted

First of all, what do we need to clone a GSM SIM card? We need to extract the private key, Ki, from the SIM card and then use it to fake/forge a new one with the same number and subscriber ID.

Here's why it's difficult to satisfyingly answer your question: GSM uses a cryptographic suite called COMP128. The biggest problem with COMP128 is that it's a collection of proprietary algorithms; they all are kept a secret. In other words, we cannot really know for sure if they have known vulnerabilities or not as it's difficult to study them. But here's something we know for sure: Because they're kept a secret, it's more likely for them to have vulnerabilities.

The first generation of COMP128 is called COMP128-1, and we know for a fact that it's completely broken. With the technology of 1998 COMP128-1 took little more than 8 hours. Fortunately, pretty much after 2000-2001, many GSM providers started switching from the first generation to the second generation; COMP128-2, which is far better than the old one.

Although a lot better, COMP128-2 inherits some of the old generation's problems, namely a vulnerability that significantly shrinks the key search space making it a bit easier to extract. The 3rd generation of the algorithm is called COMP128-3, which supposed to be highly secure. But, of course, we cannot know for sure how secure it is or which service providers use it.

Bottom line is: Currently, it's safe to say that all GSM providers use at least COMP128-2. There are currently no known feasible attacks to extract the COMP128-2 key and clone the SIM card.

share|improve this answer
Cloning a SIM card would not create a fake GSM number, though -- it would just hijack an existing one, the one to which the original SIM card is linked to. – Tom Leek Aug 26 '13 at 13:20
@TomLeek Which is what the OP is asking for. – Adi Aug 26 '13 at 15:49

There are other (easier to exploit) interception points where a third party could pick up a SMS message.

The easiest is probably through a smartphone app; many apps ask for (and get) access to contact lists, SMSes, call logs etc. All it takes is that one game, chat app, social media client installed on your smartphone has a vulnerability that can be misused...

Another option is if your mobile phone operator has an insecure password policy and allow access to traffic logs through the web. One scary example that I came across recently is a large (15M++ subscribers) telco whose web password policy is 4 digits. Nothing more, nothing less, and that gives access to parts of a subscriber number's traffic logs. (Not 100% sure if that includes SMSes, but is plausible).

The same company also gave me a new SIM for my own number in one of their retail outlets without verifying my identity.Telling them that I needed a new microsim for my number was enough...

Finally, employees at your mobile operator of course also have access to traffic logs and can be socially engineered.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.