esim vs sim card, what is more secure?

Question

I can read many different attack vectors like swapping and porting but not sure if all those attacks are relevant about eSIM, can you please explain what are a security risk and attack vectors that will target eSIM?

Answer 1

I suspect the attack vectors for eSIMs will be largely the same as for physical sim cards, and here is my thinking:

Current attack vectors

• The main attacks against sim cards aren't actually targeting the sim cards or the sim card media, they are targeting the processes underlying sim card registration and provisioning. Hence the popularity of sim swap attacks.
• The processes and people that are the weak point in these attacks aren't changing. I recall when I got my eSIM (this may obviously be different for you), the process to enable it was essentially just a sim swap meaning if a support agent or a person with access can be tricked into swapping my sim card, the nature of the sim card really makes no difference.

According to the Communications Fraud Control Association (CFCA), identity fraud in telecommunication during the subscription process remains one of the most common methods of telecommunication fraud.

• The authentication and "crypto magic" that underlies your phones connection to the network (dependent on the sim card) also does not change. The eSIM is essentially a virtual copy the physical card that contains the same information but stores it in a different format. This implies that the attack vectors for things like MiTM also do not change.

Like the insertable cards that precede them, eSIMs (or eUICCs, if you like) hold all the credentials needed to connect to a mobile network.

Since you are looking for a reputable source, have a look at this presentation to the European Union Agency for Cyber Security where the presenter is noting the gaps in assurance when it comes to provisioning of eSIMs as a critical issue.

eSIM security improvements

However, having said that, I do believe that the physical aspect of security does improve as alluded to by some commentators, but that the security value is negligible considering the popular attack vectors.

• Since the eSIM is now stored digitally in a secure manner (Secure Enclave on iOS devices for example) on the device, removing it to read its contents should be more difficult compared to physically taking it out of a sim card slot and popping it into a sim card reader.

New potential eSIM security issues

There are also some theoretical new issues introduces by eSIMs, but since there is little public evidence of their exploitation they remain exactly that - theoretical.

• Have a look at this article that alleges that, due to the over-the-air provisioning of operator profiles, swapping fraud may become even easier (Technically not a new attack vector - just an easier way of exploiting a known attack vector)

While over-the-air provisioning of operator profiles and allowing all ecosystem participants to connect to an online service might improve usability and convenience, it also opens a door to hacking opportunities...

• There is also this article that correctly notes that the inability to just pop out the sim to prevent tracking, may result in privacy issues.

So far, it was possible to remove the SIM card from a phone and so prevent it from gaining any access to a network—making it more difficult to track. A hardwired IC effectively removes this option, making it that much more difficult to prevent a device from being trackable.

So, in summary, it is unlikely that the main attack vectors will change since the vulnerabilities that inspired them did not. Furthermore, the physical security benefits of eSIMs are not applicable to these attack vectors and therefore largely useless in protecting against them. Lastly, new issues relating to end user privacy may crop up but are mostly theoretical at this point.