2

A customer has asked me to conduct a pen-test on the phones of their employees. The customer's target are the text messages within their employees phones. The text messages are stored on the SIM for security reasons. Physical access to the phones is allowed only when the phone is turned off. The customer has asked for what approach we're going to take on conducting the pen-test.

I came up with the following approach but it is not satisfactory.

Such as breaking the pin-code which is asked when the phone is turned on by cloning the card 1000 times and brute-forcing the pin-code. The idea is that if after 3 tries the first card locks. I then continue doing the same with the second card. This way I have more chances for brute-forcing the pin.

First question: Is this a good idea or are there any flaws in this approach?

Second question: Can you advise me on a better/easier/cheaper approach?

Improve this question
7
  • Since I am not a native english speaker, I have missed some things. First all of you said "phones of employees". So differents phones, with different SIMs and different PINs. Right? Are you gonna clone ALL of them and brute force them ? And I didnt get the "Physical access to the phones is allowed only when the code is turned off". You mean when the phone is turned off? What are you/your costumer wanna prove/test. That you can crack the PIN? Any small cell phone repair shop (or even you with the right service manuals) can reset the PIN if you have physical access to the SIM. I'm missing sth ?
    – labmice
    Commented Feb 27, 2011 at 0:01
  • labmice, yes different phones and different pins but the point is that almost all employees have sms-messages with confidential info. Besides, having access to the phone allows for impersonation. The customer wants to know how much effort it costs to break/bypass the pin and depending on that if it is better to switch. A proof-of-concept is required with a detailed approach such that the customer can decide for himself if it is safe and for how long. So about the repair shop, how can a PIN be resetted? Any detailed info?
    – Henri
    Commented Feb 27, 2011 at 16:09
  • Newer SIM cards should have anti-tamper protection that makes it useless if you try to clone it. Have you already succeeded in cloning one?
    – Giacomo Verticale
    Commented Feb 27, 2011 at 18:24
  • Henri.... these SIM cards, belong to the employees? What about the cell phones? As devices. I don't care who is paying the bill. The cell phones (as devices) and the SIM cards (as just SIM cards) belongs to the company or the employees. And if they belong to the company, what was the "written aggrement" about the use of those devices. Can the employees make personal calls? Take personal photos? Sent personal sms having NO company info inside the text?
    – labmice
    Commented Feb 27, 2011 at 18:57
  • 1
    I'm not so clear on what you're trying to acheive here. Can you elaborate? In fact, I would suggest you back up, and as a first step figure out your threat model. What do you expect to be protected? What attack scenarios are you expecting, and want to prevent? Etc... Then, you can work from there and figure out how to verify these things. E.g. are you looking at sensitive company info in SMS? Pics of stolen docs? Cached data from corp apps on smartphones? Worried about stolen phones? Spoofed phone #? And so forth....
    – AviD ♦
    Commented Feb 28, 2011 at 19:04

1 Answer 1

Reset to default
3

A few questions come to mind with the brute force attack:

  1. What is the length of the PIN
  2. What is the timeout length

Now for actually trying to break into the phone I would first look for wear on the screen protector, smudges, or wear on the keypad (specifically numerals). If you are allowed to match it to an employees desk I would look for written down passwords and/or calendars marked with what appear to be important dates (birthdays and anniversaries). Also, looking at the wear on the keypad of their computer keyboard could be a large indication as to what their PIN is, namely because humans don't like to have multiple passwords for multiple systems.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .