Skip to main content
50 votes

How to protect against SIM swap scammers?

You don't use SMS for a second factor. SMS is not secure by any means. The text is on clear, the traffic is on clear, and it's trivially easy to get a new SIM by pretending to be the victim. I once ...
ThoriumBR's user avatar
  • 54.5k
31 votes

Does the telecom provider need physical access to the SIM card to clone it?

No, telecom providers do not need physical access to the SIM. They can change the allocated number or any SIM unique ID, therefore they can: assign the number to any new SIM and unassign it from the ...
Overmind's user avatar
  • 8,899
16 votes
Accepted

Real life examples of malware propagated by SIM cards?

TL;DR: For laptops, you should be fine. Networks: no advantages that couldn't be gained more easily though the Ethernet port. Can be fixed by having BIOS password and encrypted drive (not a threat). ...
James Stone's user avatar
15 votes

How to protect against SIM swap scammers?

One of the main vulnerabilities that leads to SIM-swapping is from social engineering attacks. If you must use SMS 2FA, one approach is to use a Google Voice number. Since Google Voice has minimal ...
Ryan Amos's user avatar
  • 253
12 votes

How to protect against SIM swap scammers?

For serious 2FA authentication systems, the phone is only the second factor. That means that to impersonate its victim, the attacker should also guess the primary factor (the password). What is really ...
Serge Ballesta's user avatar
11 votes

Does the telecom provider need physical access to the SIM card to clone it?

Not only do you not need physical access to the SIM, you don't even need cooperation from the telecom provider. There have been instances where SIM card encryption keys were obtained directly from ...
bta's user avatar
  • 1,121
10 votes
Accepted

esim vs sim card, what is more secure?

I suspect the attack vectors for eSIMs will be largely the same as for physical sim cards, and here is my thinking: Current attack vectors The main attacks against sim cards aren't actually ...
ilikebeets's user avatar
  • 2,916
10 votes

How to protect against SIM swap scammers?

Buy a cheap old Nokia phone with a few different SIM cards. Only use one number for each online account. Never share these numbers with anyone. Keep the phone off in a draw. Why? If people do not know ...
questioner's user avatar
9 votes

Does the telecom provider need physical access to the SIM card to clone it?

No, the telco has unlimited control over your number. It doesn't need physical access to do whatever it wants. This is similar to most internet-based communication services. If you need protection ...
watchowl's user avatar
  • 5,458
9 votes

simjacker: which SIMs are vulnerable?

From the documentation, it's not the SIMs that are the concern, its if the carrier installs the S@T toolkit on it. To detect the vulnerability, one would have to know how to detect the toolkit. [As ...
schroeder's user avatar
  • 131k
9 votes
Accepted

Can you connect to a mobile network without a SIM?

From Wikipedia: SIM card: Authentication key (Ki) The Ki is a 128-bit value used in authenticating the SIMs .... The SIM card is designed to prevent someone from getting the Ki by using the smart-...
Steffen Ullrich's user avatar
8 votes
Accepted

How is SIM blocking enforced?

You have one wrong assumption: the phone does not perform the check. The SIM card is a tiny computer. It does the verification by itself and it is able to lock itself and prevent the phone to read its ...
A. Hersean's user avatar
  • 10.6k
7 votes

Can a SIM card propagate malware?

Theoretically: yes. Practically: The use case for this is too small to be worth the effort. Lets do a very theoretical excursus on how this could be possible: In theory, every computer ...
marstato's user avatar
  • 2,325
7 votes

Can WhatsApp, Signal or Telegram be hacked through a SIM SWAP attack?

I can only tell about WhatsApp because I do not use or specifically know about the others. Basically, with a SIM swap attack, an adversary can get future messages intended for the target, but not ...
Marcel's user avatar
  • 4,093
6 votes

Can the police track my phone even if I remove the SIM card?

It depends on the method you are being tracked. If we are talking about a "wiretap," then the tracking is being done at the telco and as long as you maintain the same phone number, regardless of SIM ...
Shackledtodesk's user avatar
6 votes

What software can be used to read data from smart cards?

In the past, i have used CardPeek for this. It is easily extensible through LUA and can therefore adapt to unknown cards. It presents the "files" on the card via a TreeView and offers annotations on "...
flakeshake's user avatar
5 votes
Accepted

I have a conceptual idea for a network that could obfuscate the geolocation of a mobile station. I would appreciate short, critical feedback

The "data footprint" of your actual session will probably be fairly easily distinguished from your decoy points from an attacker who can dedicate any amount of time to the problem. a) Let's say that ...
J Kimball's user avatar
  • 2,137
5 votes

Will Google Authenticator stop a sim-swap attack from compromising my Coinbase?

It will depend on how Coinbase protects the account from the loss of the 2FA code. If you can get past the 2FA by saying "send me an email/text instead", then 2FA does not protect you at all ...
schroeder's user avatar
  • 131k
4 votes

Is it possible to track a SIM card even if the cell phone is turned off?

No. A SIM card only provides the device with a unique identifier and related information. It does not have any in-built wireless capabilities. In order for a mobile device to be tracked, it needs to ...
forest's user avatar
  • 66.9k
4 votes

What happens if incorrect SIM card PUK entered 10 times?

On a modern phone, none of your personal data will (usually) be stored on the SIM. It's true that technically, a SIM card has the ability to store a limited address book, a small collection of text ...
Johnny's user avatar
  • 1,061
4 votes
Accepted

How do I protect myself against SIM hijacking/social engineering?

One of the main culprits for allowing this to happen is the marketing of 2FA as something more secure than just maintaining consistency with already well known security practices. The simple answer to ...
not2qubit's user avatar
  • 275
4 votes

How to protect against SIM swap scammers?

First, the symptom of a SIM swap is that you lose signal on your phone. Using a primary number rather than a secondary, i.e., one your mum will usually call you on instead of a SIM card you put in the ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
3 votes
Accepted

Can you compromise a phone with a SIM card?

As you probably know, a SIM card is a fully functional computer in itself, which communicates with the phone (or other devices) over predefined commands. The first big problem that is practically a ...
deviantfan's user avatar
  • 3,844
3 votes
Accepted

What happens if an attacker steals my sim card number?

The really secret stuff is stored inside of the SIM card in the form of an authentication key. The ICCID is not really very secret at all, it just uniquely identifies the SIM card but provides no way ...
le3th4x0rbot's user avatar
  • 3,249
3 votes

Are SIM proactive commands secure?

The OS does not communicate directly with the SIM. The SIM is connected to the baseband processor. All communication between the SIM and the OS tunnels through the baseband processor using the "...
David Burgess's user avatar
3 votes

Can the police track my phone even if I remove the SIM card?

I don't know the technical details to answer your specific question, but it might not be relevant. If your phone has been tracked in the past and you live in a place where your adversary has access ...
Out of Band's user avatar
  • 9,283
3 votes

Protection from Sim Card Cloning

The problem your friend experiences does not look like "SIM card cloning". Two signs which may indicate that someone has cloned your SIM card are the following: You see in your billing statement the ...
George Y.'s user avatar
  • 3,534
3 votes

Can a SIM card propagate malware?

I think the answer that everyone is giving so far is a "qualified yes", with the qualification being that if we're talking strictly about viruses, it's not a terribly effective attack vector. The ...
EddieOffermann's user avatar
3 votes

Massive operational security hole

Scenarios like that are possible, but not without consequences. Your list continues like this: A victim reports this to the police. The perpetrator loses license to operate as a franchise due to this ...
Esa Jokinen's user avatar
  • 19.1k

Only top scored, non community-wiki answers of a minimum length are eligible