A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). Using these commands, SIM card applet can request the OS for current system time or sending SMS to a specified number and much more.


Is there any OS protection in Android or iOS of these proactive commands? Is it possible for an attacker to create an application, which hijacks the SIM-Phone communication and provides the SIM card with incorrect data? Is there any "firewall" that ensures that the OS is the only entity allowed to communicate with SIM over proactive commands?

EDIT : I have found a patent for secure proactive commands (http://www.google.com/patents/US8744406), but I do not have a clue if some UICC vendor uses it in the real world.

UPDATE: Could I use Android Access Control Enforcer as such a firewall for Android (https://code.google.com/p/seek-for-android/wiki/AccessControlIntroduction)?

  • Dear Vojta, does this question have any answer? – Abraham Feb 18 '16 at 20:43
  • 1
    @Abraham No, it doesn't. I gave up my research. I didn't make any experiments, but I am afraid proactive commands are pretty vulnerable, so I avoid using them in security applications. – vojta Feb 18 '16 at 20:50

Broadly, the design of Unix-like operating systems (in particular Linux, on which Android is based, and Mac OS X) means the OS is by design the only software entity that's allowed to communicate with the SIM. (I say 'software' because other hardware isn't quite so limited.) So I don't think this is something you need to worry about.

Or, phrased another way: yes, the 'firewall' you describe already exists. It's one of the most fundamental features of an operating system kernel.

  • 3
    Thank you for your reply, but I am not so sure. Yes, the OS is the only entity allowed to communicate with the SIM. However, any Android application can communicate with the SIM card through the SEEK api (through the OS). So the OS does not CONTROL the communication with the SIM, it just stands in the middle between applications and the SIM and it allows any application send any APDU to any applet, right? So an evil application can send a fake answer to a proactive command, I think... – vojta Apr 13 '15 at 11:37

There have been some reports of hacked SIM communications before, like the one explained in this DefCon presentation from 2012, but this is all very much on a basic level and so far there have not been any known exploits for as far as I can tell. That said, in this presentation they did show how you can load custom code on the SIM so it is not hard to imagine that it is entirely possible that it has been done already.

  • 3
    They actually did not hack the SIM card, they knew the keys and they said these keys could have been easily guessed using brute force. However this is true for DES keys only and only for basic SIM cards that do not count authentication attempts. Moreover, just a few SIM cards use classic DES nowadays. My question is not about hacking the security domain of the SIM card. I need to know, if the communication between SIM card and phone using proactive commands is secure or if it can be interrupted by an evil phone application pretending to be the SIM Toolkit. – vojta May 18 '15 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.