My goal is to communicate with a sim card via binary sms and upload new firmware and/or talk to sim card api to retrieve data such as gps coordinates etc... I am not sure how to construct these binary messages. Does anyone know where I could find a program or some papers or research documents about this sort of stuff? I have watched black hat presentation on sim card vulnerability's. However this video presentation does not have provide information on were I want to succeed. I could not find much on google. I have previously been testing ISP servers for vulnerability's and now have decided to look into sim card security.
It is possible to exploit a SIM card's SMS, OTA (over the air) update system that is built with Java Card, that is, a subset of Java that allows applets to run on small memory devices.
OTA commands, such as software updates, are cryptographically secured SMS messages, which are delivered directly to the SIM. While the option exists to use state-of-the-art AES or the somewhat outdated 3DES algorithm for OTA, many (if not most) SIM cards still rely on the '70s-era DES cipher.
Send an improperly signed binary SMS to a target device using a SIM encoded with DES, which was not executed by the SIM because of a signature verification failure. However, while rejecting the code, the SIM responded with an error code that contained the device's cryptographic signature, a 56-bit private key. It was then possible to decrypt the key using common cracking techniques.
With this key in hand hackers are able to sign malicious software updates with the key and send those updates to the device. The attacker is also able to download Java Card applets, send SMS messages, change voicemail numbers, and query location data.
If you want more technical details on how to reproduce that yourself I recommend google since I never exploited a SIM myself just google for "sim javacard vulnerability", "sim exploit" and you probably will find it yourself.
The book, "Mobile Application Security" included some authors from iSECPartners, who covered analyzing SIM cards. They released pySimReader, although you need specific hardware (ACS ACR 38t SIM reader) to go along with that code. I have such a device and was able to perform forensics and testing activities against SIM cards in the past.
I don't know if this is what you looking for. We successfully did with my previous team attacks on Java Card. The set of attacks is called "EMAN attacks" and are presented in the following presentation "Smart Card Attacks: Enter the Matrix":
As far as we go, we successfully install a trojan applet on several instances of Java Card and have access to memory parts (EEPROM, RAM);
Basically, if the card has no Bytecode Verifier (BCV) AND you have the administration keys for loading Java Card applet AND the card is not protected against EMAN (don't ask me to name them), you can forge an applet which contains static instructions which are able to load or write part of the memory card, including access to other applets for instance.
About OTA exploitation mentioned by @Freedom, some smartcards have flaws and can be tricked to install attacker applications. The attack works by exploiting weak crypto for SMS OTA channels and then exploiting the weak Java Card Virtual machine. More information can be found at the Blackhat presentation by hacker/cryptographer Karsten Nohl:
But so far no PoC has been publicly released.
I know this question is a bit old but this answers (and other answers) may help others so :
For the SIM communication you can refer to - TS 11.11, TS 11.14 and GlobalPlatform Card Specifications.
In addition, you can look at Karsten Nohl's presentation about rooting the SIM cards.
Unfortunately, you won't find a lot of research about the SIM cards - if every exploit in the SIM card is a huge thing, and people would keep it in secret (I have no idea why SRlab published their famous SIM exploit).
However, you have one of the 2 most common phone OS (Android) which is open source. You will be able to find most if not all what you're seeking by reversing the system code.
If you can't find something you can pm me :)