5

I need to proof that a user of my app is in possession of the correct SIM card.

On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof that a user belongs to a specific phone number is not discussed here). As an android app can receive SMSes programmatically, the transmitted challenge can then be sent back to the server using the data connection. Obviously, there is more security to be implemented (e.g. digital signature of the challenge), but this is not relevant here.

Reacting programmatically to incoming SMSes is not possible with iOS. Does anyone have an idea how to proof the possession of the correct SIM card in iOS?

Thanks in advance.

Improve this question
2
  • 2
    Are you looking for a programmatic solution? otherwise can't you just send an SMS with some random password/digits and ask the user to key it into the app as means of authentication?
    – Yoav Aner
    Feb 19, 2012 at 18:31
  • You're right, this would be a way. But I'd prefer a programmatic solution if somehow possible.
    – pfust75
    Feb 19, 2012 at 19:50

3 Answers 3

Reset to default
1

I believe Ericsson were working on something similar to this. I'm not sure how far they have progressed, nor how easy or expensive it is but maybe worth being aware of.

https://labs.ericsson.com/apis/identity-management-framework/

All I've seen is some nice video slides showing how the framework would work to allow you to authenticate people based off their SIM. It uses something called Generic Bootstrapping Architecture to check the authenticity of a SIM/IMEI combination. If the iPhone doesn't support it at the moment, it should do in the future as it is a 3GPP standard.

http://en.wikipedia.org/wiki/Generic_Bootstrapping_Architecture

Sorry if this isn't the sort of thing you're looking for.

Improve this answer
-1

if you look at the apple developer sample it has a reachability framework that will tell you if there is a connection and what type of connection it is. If there is a valid connection other than wifi it would signify a valid sim in the device. You can find the sample code here https://developer.apple.com/iphone/library/samplecode/Reachability/

Improve this answer
1
  • I think you misread the question: the problem is not detecting the presence of a SIM card, but to verify the presence of a specific SIM.
    – Gilles 'SO- stop being evil'
    Mar 2, 2012 at 15:09
-1

This is 100% impossible on a jail-broken device. Or put another way, this will never be possible if the user has a say. What is a SIM card? Its just a small memory storage device that is no different than a virtual disk image. There is no way to verify this information. An end user can spoof this information just as easily as their IMEI number.

It is trivial to spoof the origin of an SMS or an outgoing call.

I don't believe there can be any uniquely identifying information on a platform that is 100% attacker controlled. And if its not completely controlled its only a matter of time before someone writes a jailbreak for it.

Improve this answer
2
  • 1
    Well, even on a jailbroken device an SMS is only delivered to the device if it's in the possession of the correct SIM card. So receiving an SMS that contains a challenge works also on jailbroken iOS devices... As it's not possible to react automatically to an incoming SMS the user has to read the challenge and has to enter it in the corresponding app. It's definitely not user-friendly, but quite secure...
    – pfust75
    Mar 3, 2012 at 17:02
  • A SIM card is not just a dumb memory storage, it's actually a smartcard with a CPU, RAM, ROM, and tamperproof storage area, and has an embedded OS and is capable of running applications written in a subset of Java.
    – Lie Ryan
    Jul 31, 2014 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.