Hot answers tagged

44

As you found out, a SIM card is only required for initializing a connection to the mobile carrier and is not required anymore until the device loses the connection and needs to reconnect (which happens very frequently with mobile devices when you move them around). Your device might power down when the SIM card is removed, but there is no good reason why it ...


29

No, telecom providers do not need physical access to the SIM. They can change the allocated number or any SIM unique ID, therefore they can: assign the number to any new SIM and unassign it from the old one (this is actually a standard procedure for anyone losing their phone/sim) clone the number to any SIM References- cellphone operator sites: https://...


16

WLAN/WiFi can be secure when properly configured (this certainly requires a password or key). Cellphone connections are not really secure. They are encrypted based on a key from your SIM card. This key is also known to your mobile network operator. You do not need a password, but your communication can be intercepted and eavesdropped on by your mobile ...


12

The thing to bear in mind about a SIM card is that it is not just a dumb storage device (like a magnetic strip on the classical credit-card, or flash device). It is a "Smart Card" that is basically like a small computer (externally powered, with no I/O other than the copper contacts). Each SIM card is different, and as you point out it has your IMSI, and ...


11

A mobile phone, generally speaking (*), is broadcasting the message "the SIM card I have with the ID XXXX is now available on the network". This ID is called IMEI IMSI (**) and is unique to a SIM card. The IMSI is then mapped to a phone number by your provider. If you break this chain (by going to the network provider and requesting a new SIM card) the ...


10

It is possible to exploit a SIM card's SMS, OTA (over the air) update system that is built with Java Card, that is, a subset of Java that allows applets to run on small memory devices. OTA commands, such as software updates, are cryptographically secured SMS messages, which are delivered directly to the SIM. While the option exists to use state-of-the-art ...


9

Not only do you not need physical access to the SIM, you don't even need cooperation from the telecom provider. There have been instances where SIM card encryption keys were obtained directly from the company that manufactures the SIM card.


9

From the documentation, it's not the SIMs that are the concern, its if the carrier installs the S@T toolkit on it. To detect the vulnerability, one would have to know how to detect the toolkit. [As of this writing, there appears to be no methods offered to the public to detect the toolkit]


8

No, the telco has unlimited control over your number. It doesn't need physical access to do whatever it wants. This is similar to most internet-based communication services. If you need protection against the service provider (and entities coercing, bribing or deceiving the service provider) you need to use end-to-end encryption, and a open source ...


7

I don't know anything about the application processor side, but I can tell you some things about the SIM side: Subscriber Identity Modules are a type of smart card, and as such they not talk AT, but a separate protocol from ISO, commonly referred to as APDU. The rest of ISO 7816 is mostly innocuous, and doesn't even deal with broadband, which is fortunate ...


7

WiFi can be easily sniffed with cheap hardware + software and only properly encrypted WiFi helps against this. But phone calls are not much better: For the traditional old phone system (POTS) you need physical access to the line but once you have this (often available somewhere in the basement) sniffing is very easy too. Old style analog wireless phones (...


6

A SIM card is used to identify the device to the network. The SIM card contains the secret authentication credentials to identify itself to the device. If you are worried about the SIM card being misused for authenticating as yourself to the network, you'd want to disconnect the SIM card from your account and phone number before disposing/giving it away. ...


6

This begs one and only one question: Did you manually store any data on the SIM card? No? Then yes, it's perfectly fine to return. Older devices, like feature phones, that didn't have a lot of built in storage or had incredibly slow storage would store text messages or phone numbers on the sim card to save what little space they had and keep your things ...


6

Theoretically: yes. Practically: The use case for this is too small to be worth the effort. Lets do a very theoretical excursus on how this could be possible: In theory, every computer communicating with other devices is vulnerable. This is simply due to the fact that interpreting communicated signals always leaves room for error. If such an error is ...


5

Your Amazon purchased hardware provides identity information unique to the phone and unrelated to the SIM card. You have linked the phone to yourself through that Amazon purchase and also via the previous use of that device with a SIM card with your identity. The IMEI appears to be your main problem. Please see details of identifiers here - http://...


5

The manufacturer of the card may be printed on the carrier card. When SIM cards are made, they're produced in a standard credit-card shaped plastic card, with a punch-out slot that contains the SIM itself. This outer plastic card may have printing on it that shows who the manufacturer is. Also, the shape of the circuit pads is proprietary to each ...


5

It's been a while since I researched this topic, however, several algorithms exist. At the time of my research (3 years ago), the A5 algorithm was the most used algorithm in Europe for phone and sms conversations (GPRS used a different algorithm). Several variations exist: A5/0 A5/1: most widely used (deemed the most secure of the three), but cracked by ...


4

Does your phone require entering a PIN code on startup? Is your SIM card less than 10 years old? If this is the case, you're almost certainly safe. In fact, if your SIM card is recent (approx. 2005 and up), it's most probably unclonable even if you don't require a PIN on startup. Cloning was really an issue for old COMP128v1 SIMs. Newer SIMs are designed to ...


4

.. can you pin-point ... This depends who 'you' are and how exact you need the location. A mobile phone needs to connect to a nearby base station in order to send the message. Each base station can serve a number of users in parallel and also has a limited reach, which is even more limited in cities because of all the buildings. If you know which base ...


4

Remember, SIM is "subscriber identity module." It identifies itself to the mobile carrier each time it talks to a cell site, and the carrier knows which cell site. The best you can hope for is that it will stop working when the original owner gets the next bill. At worst, you could be tracked down with a cell site simulator (aka "stingray") and charged ...


4

It depends on the method you are being tracked. If we are talking about a "wiretap," then the tracking is being done at the telco and as long as you maintain the same phone number, regardless of SIM or phone, it will get captured. If we are talking about false mobile towers, like Stingray devices, then you are being tracked by multiple factors; SIM, phone ...


4

The "data footprint" of your actual session will probably be fairly easily distinguished from your decoy points from an attacker who can dedicate any amount of time to the problem. a) Let's say that on Monday, your packets originate from Lesotho, Seattle, and Moscow. On Tuesday, they are from London, Mexico city, and Seattle. On Wednesday, they come from ...


4

No. A SIM card only provides the device with a unique identifier and related information. It does not have any in-built wireless capabilities. In order for a mobile device to be tracked, it needs to be connected (or trying to connect) to a cell tower. Both receiving and transmitting non-negligible amounts of RF requires power to be provided by the battery. ...


4

One of the main culprits for allowing this to happen is the marketing of 2FA as something more secure than just maintaining consistency with already well known security practices. The simple answer to your question is, don't use SMS based 2FA. The longer answer to your sub-questions are: Hedge your account credentials! Don't connect your social network ...


3

Such an attack is theoretically possible, but is it likely? As always, to estimate the risk of an attack you must look at your threat model. Yours doesn't quite make sense. You are assuming a targeted attack from a sophisticated and well resourced adversary, but that such an adversary wouldn't use a fake base station and directly target your second phone. ...


3

Keep in mind that the report only identified a single manufacturer, but that does not mean that other unidentified manufacturers were not compromised as well. While identification of the manufacturer of the SIM card may identify it as being a victim of THIS breach, it does not mean that other, non-reported breaches did not occur as well. Given the ...


3

GSM was designed at a time when consumer products, in particular the first GSM phones and the smart cards, were a lot less powerful than they are today (at that time, a desktop computer was using, at best, a 16 MHz 68020 CPU or something similar). Asymmetric crypto could not be achieved within a reasonable time frame on these cards. The shared key model is ...


3

Yes, you can clone a SIM card. All you need is a SIM writer, a blank SIM, and roughly 15-30 minutes. (guide for v2 cards) Once that happens, they've effectively become your phone, and can intercept communications and messages, and charge your phone plan. I do not know of any "rogue SIM card attacks," most attackers focus on attacking the SIM cards ...


3

The problem your friend experiences does not look like "SIM card cloning". Two signs which may indicate that someone has cloned your SIM card are the following: You see in your billing statement the calls/texts made from your phone which you did not make (however if you have a smartphone, this may also indicate that there is malware app running there, which ...


Only top voted, non community-wiki answers of a minimum length are eligible