According to Weinmann, the application processor (with Android e.g.) and the baseband processor can share memory, so that an attack and takeover of the baseband stack offers the possibility to attack Android.
According to Nohl, it is possible to crack a SIM Card and install an own virus or application. This app could send premium SMS or something else.
Thus, the SIM is connected to the baseband and the baseband is connected to the application processor. So which attack surface does this connection offer?
- The A3, A8 calculation occurs in the SIM and the A5 in the baseband processor, right? So when I have a full control of the baseband, I can initiate a call or SMS and impersonate the phone?
- If I had full control of the SIM card, then I could send SMS messages with the Ki or data of banking applets on the Sim Card? Can I initiate a voice call or attack the baseband OS with the Sim Card? Which communication protocol is used between the SIM and the baseband processor? Also AT Commands?-Since these would limit the attack possibilities.
Unfortunately, I haven't found a source which focuses on the connection between the three components.