3

I know during emergency calls we can connect to our mobile networks without using a SIM and make calls. So it's technically possible to connect.

The SIM card holds encrypted info on how to authenticate to the mobile network.

So my question is: if we have access to the encrypted data of the SIM, would it be possible to connect to the mobile network without using the SIM, by manually entering the information on the device? Can this be done without an internet connection? Can this be done on an average phone?

1
  • You need to extract MAC key from the SIM card.
    – defalt
    May 1, 2021 at 4:31

2 Answers 2

9

From Wikipedia: SIM card:

Authentication key (Ki)
The Ki is a 128-bit value used in authenticating the SIMs ....
The SIM card is designed to prevent someone from getting the Ki by using the smart-card interface. Instead, the SIM card provides a function, Run GSM Algorithm, that the phone uses to pass data to the SIM card to be signed with the Ki. This, by design, makes using the SIM card mandatory unless the Ki can be extracted from the SIM card, or the carrier is willing to reveal the Ki ...

Thus, by design a SIM card (or something similar, like eSIM) is designed to be mandatory for authenticating against the network. There are some weaknesses (also described in Wikipedia) which might allow to extract Ki, but even then a SIM card with Ki inside would have been needed in the first place.

Emergency calls don't require authentication though. They only require identification of the device, which can be provided without SIM. But for anything which should be payed for the billing contact need to be known - which requires authentication. And since authentication is provided by the SIM it means that there need to be an associated SIM card or eSIM.

... would it be possible to connect to the mobile network without using the SIM, by manually entering the information on the device?

There are cryptographic operations done on the SIM based on the authentication key. It is not possible to just do these simply manually, but it can be done by software: a SIM card is basically software too, only on a protected hardware.

Can this be done on an average phone?

One would need to have deep access to the software stack of the phone for this. There is no interface for this on average phone.

4
  • "So my question is: if we have access to the encrypted data of the SIM".. So, does the telco provider have any way to check if you somehow found the Ki and aren't using the SIM anymore?
    – john doe
    May 4, 2021 at 1:48
  • 1
    @johndoe: The original question is about having no SIM in the first place, which means also no way to extract any information on it. Your question is basically about rebuilding a SIM in software if you have the necessary secrets extracted from it. This is a different question and should be asked as a new one and not in a comment. But in short: a SIM is software too, only running on restricted and protected hardware. All what the provider sees are the interactions with these software, no matter on what hardware it runs on. May 4, 2021 at 6:17
  • The question does state "So my question is: if we have access to the encrypted data of the SIM", which in my mind means they have access to a SIM in the first place, but maybe I need to re learn english.
    – john doe
    May 5, 2021 at 6:18
  • 1
    @johndoe: You are right in that the question is about having a SIM from start to extract the keys. I've extended the answer. Still the question about the telco provider being able to detect such thing is IMHO out of the scope of the original question and might be better asked as a new question. May 5, 2021 at 7:56
-1

If you could find a way to store the IMSI and other SIM data on a phone's storage and send the required information to the cell tower properly, there is no way for the cellular network to know whether or not it came from an actual SIM card inserted in a phone. All they know is that they received valid identifiers, which is sufficient for them.

2
  • 3
    The international mobile subscriber identity (IMSI) only provides identification, but not authentication. For that, the SIM card holds an Authentication key (Ki) which can't be (unless there's a vulnerability) simply extracted from the card, but instead the SIM provides a Run GSM Algorithm function that internally signs a random number generated by the network, returning Signed Response 2 (SRES_2) and Kc that is used for encrypting the further communications. May 1, 2021 at 7:43
  • Key words "If you could find a way to store the IMSI and other SIM data on a phone's storage", which indicates something like the needed vulnerability you mentioned. If you had access to all the needed information (say internal testing at one of the telcos), how does the network know whether or not its stored on a SIM or stored on the phone? The question indicates if you had access to the SIM data as a pretext
    – john doe
    May 4, 2021 at 1:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.