Communication between SIM, baseband and application processor

Question

I currently examine the hidden components of a smartphone, inspired by the research of Weinmann All your baseband belong to us and Karsten Nohl Rooting Sim Cards.

According to Weinmann, the application processor (with Android e.g.) and the baseband processor can share memory, so that an attack and takeover of the baseband stack offers the possibility to attack Android.
According to Nohl, it is possible to crack a SIM Card and install an own virus or application. This app could send premium SMS or something else.

Thus, the SIM is connected to the baseband and the baseband is connected to the application processor. So which attack surface does this connection offer?

1. The A3, A8 calculation occurs in the SIM and the A5 in the baseband processor, right? So when I have a full control of the baseband, I can initiate a call or SMS and impersonate the phone?
2. If I had full control of the SIM card, then I could send SMS messages with the Ki or data of banking applets on the Sim Card? Can I initiate a voice call or attack the baseband OS with the Sim Card? Which communication protocol is used between the SIM and the baseband processor? Also AT Commands?-Since these would limit the attack possibilities.

Unfortunately, I haven't found a source which focuses on the connection between the three components.

Answer 1

I don't know anything about the application processor side, but I can tell you some things about the SIM side:

Subscriber Identity Modules are a type of smart card, and as such they not talk AT, but a separate protocol from ISO, commonly referred to as APDU. The rest of ISO 7816 is mostly innocuous, and doesn't even deal with broadband, which is fortunate because ISO doesn't provide them for free.

Enter 3GPP, which maintains the standards for smartcards connecting to the GSM network. These standards are a superset of ISO 7816 and are freely available at their website (go browse around there for a bit, it's an amazing website teeming with the most detailed information)

In the 11.11 standard, some of your assumptions are confirmed: The SIM does not do A5 encryption, you Mobile Equipment does that, the SIM does A3 and A8.

In the 11.14 standard things get interesting, these are the details of what SIM applications can do with the Mobile Equipment uplink. Turns out they can do just about anything, sometimes on the pinky promise that "It shall be possible for the user to deactivate this command". Voice calls, Data, you name it.

Whether or not the Ki is accessible to SIM applications may hopefully be found somewhere in the 31 series specifications. I haven't had the time to read through all that. 31.130 looks like a good place to start.