2

My goal is to communicate with a sim card via binary sms and upload new firmware and/or talk to sim card api to retrieve data such as gps coordinates etc... I am not sure how to construct these binary messages. Does anyone know where I could find a program or some papers or research documents about this sort of stuff? I have watched black hat presentation on sim card vulnerability's. However this video presentation does not have provide information on were I want to succeed. I could not find much on google. I have previously been testing ISP servers for vulnerability's and now have decided to look into sim card security.

  • Because you just want to talk to the SIM card, you will need to ask a phone forum, who would have better knowledge about the technical aspects. – schroeder Jan 6 '15 at 4:49
  • I will try on a phone forum I asked here hoping there were some telecommunications security researchers. – Tim Jonas Jan 6 '15 at 5:25
10
+50

It is possible to exploit a SIM card's SMS, OTA (over the air) update system that is built with Java Card, that is, a subset of Java that allows applets to run on small memory devices.

OTA commands, such as software updates, are cryptographically secured SMS messages, which are delivered directly to the SIM. While the option exists to use state-of-the-art AES or the somewhat outdated 3DES algorithm for OTA, many (if not most) SIM cards still rely on the '70s-era DES cipher.

Send an improperly signed binary SMS to a target device using a SIM encoded with DES, which was not executed by the SIM because of a signature verification failure. However, while rejecting the code, the SIM responded with an error code that contained the device's cryptographic signature, a 56-bit private key. It was then possible to decrypt the key using common cracking techniques.

With this key in hand hackers are able to sign malicious software updates with the key and send those updates to the device. The attacker is also able to download Java Card applets, send SMS messages, change voicemail numbers, and query location data.

If you want more technical details on how to reproduce that yourself I recommend google since I never exploited a SIM myself just google for "sim javacard vulnerability", "sim exploit" and you probably will find it yourself.

  • I can see you know what your talking about and put a good amount of effort into writing the answer +1. I am failure with encryption and watched a video from black hat conference however What I got stuck on was the tools needed to send these messages and the structure of these messages. I will google some of the queries you suggested in the mean time hopefully I can find something. Thank You for your answer. – Tim Jonas Jan 6 '15 at 5:06
  • @Tim Williams if i understand right and your problem is about how to sending binary sms to an sim then maybe you should google for something like "how to send binary sms" or "how to send silent sms" – Freedo Jan 6 '15 at 5:12
  • 1
    @Tim Willians try mobiforge.mobi/design-development/… i've read the page and seems to give all the info you need...thanks you too i learn new things with every question i see just as your question made me look up in to binary sms and learn it – Freedo Jan 6 '15 at 5:28
  • Spelling error in first comment should be familiar not failure lol. – Tim Jonas Jan 13 '15 at 7:17
1

The book, "Mobile Application Security" included some authors from iSECPartners, who covered analyzing SIM cards. They released pySimReader, although you need specific hardware (ACS ACR 38t SIM reader) to go along with that code. I have such a device and was able to perform forensics and testing activities against SIM cards in the past.

1

I don't know if this is what you looking for. We successfully did with my previous team attacks on Java Card. The set of attacks is called "EMAN attacks" and are presented in the following presentation "Smart Card Attacks: Enter the Matrix":

http://www2.lirmm.fr/journees_securite/material/j6/Razafindralambo.pdf

As far as we go, we successfully install a trojan applet on several instances of Java Card and have access to memory parts (EEPROM, RAM);

https://www.academia.edu/3241147/Developing_a_Trojan_applets_in_a_smart_card

Basically, if the card has no Bytecode Verifier (BCV) AND you have the administration keys for loading Java Card applet AND the card is not protected against EMAN (don't ask me to name them), you can forge an applet which contains static instructions which are able to load or write part of the memory card, including access to other applets for instance.

About OTA exploitation mentioned by @Freedom, some smartcards have flaws and can be tricked to install attacker applications. The attack works by exploiting weak crypto for SMS OTA channels and then exploiting the weak Java Card Virtual machine. More information can be found at the Blackhat presentation by hacker/cryptographer Karsten Nohl:

http://0-gate.com/sim-cards-hacked/

But so far no PoC has been publicly released.

0

I know this question is a bit old but this answers (and other answers) may help others so :

For the SIM communication you can refer to - TS 11.11, TS 11.14 and GlobalPlatform Card Specifications.

In addition, you can look at Karsten Nohl's presentation about rooting the SIM cards.

Unfortunately, you won't find a lot of research about the SIM cards - if every exploit in the SIM card is a huge thing, and people would keep it in secret (I have no idea why SRlab published their famous SIM exploit).

However, you have one of the 2 most common phone OS (Android) which is open source. You will be able to find most if not all what you're seeking by reversing the system code.

If you can't find something you can pm me :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.