Millions of mobile phones could be at risk from hackers according to new research identifying vulnerabilities in the encryption used by Sim cards. Just by sending a specially designed text, security analysts were able to remotely download malware onto handsets.
Although often thought of as just providing a mobile phone’s number, Sim cards (it stands for subscriber identity module) often store users personal data and are the mark by which carriers authenticate individual users.
Millions of SIM cards could be putting your phone security at risk.
One security expert has revealed the SIM card in your phone could lead hackers to read your text messages or listen in on calls.
Expert Karsten Nohl from German company Security Research Labs said if you've ever shared sensitive information via text or call, such as your card details, these can be used by criminals to withdraw money from your account or make purchases using your card details.
The GSMA is looking into the findings, according to the BBC.
A spokeswoman for the GSMA said, 'Karsten's early disclosure to the GSMA has given us an opportunity for preliminary analysis.'
'We have been able to consider the implications and provide guidance to those network operators and Sim vendors that may be impacted' she said.
However, if you have a microSIM card, which most new smartphones use, you may be safer from an attack.
'It would appear that a minority of Sims produced against older standards could be vulnerable,' said the GSMA spokeswoman.
Although SIM cards can only store a small amount of data, such as your contacts and a limited number of text messages, they can also store information related to apps, such as your bank details for a banking application.
'OTA [over-the-air) commands, such as software updates, are cryptographically-secured SMS messages, which are delivered directly to the SIM,' Nohl said in his report.
Nohl said he was able to send a text message to a SIM card, just like operators can send a software update to a device, to reveal the card's authentication code that then allowed him to extract the information stored on it.
'To derive a DES OTA key, an attacker starts by sending a binary SMS to a target device. The SIM does not execute the improperly signed OTA command, but does in many cases respond to the attacker with an error code carrying a cryptographic signature, once again sent over binary SMS.
'The cracked DES key enables an attacker to send properly signed binary SMS, which download Java applets onto the SIM. Applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse.'
Nohl said the best defences against allowing hackers to extract information from your SiM card includes:
Better SIM cards with state-of-art cryptography with sufficiently long keys
Handset SMS firewall allowing the user to decide which SMS sources to trust
Mobile networks should filter the text messages allowed through to a device
“With over seven billion cards in active use, Sims may well be the most widely used security token in the world,” says German security expert Karsten Nohl, the individual responsible for uncovering the flaw.
“The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets.”
Nohl’s research covered the different systems of encryption used to secure Sim cards, with one particular standard named DES (Data Encryption Standard) identified as particularly insecure.
Dating back to the 1970s DES has long been considered insecure, with Nohl’s method allowing the encryption to be cracked “within two minutes on a standard computer”.
By sending a text containing a specially designed binary code Nohl was able to trick phones into authenticating him as their network provider.
Once this protocol had been established Nohl could then remotely download software onto the phone allowing him to send texts, access voicemail and even receive reports on the phone’s physical location.
“These capabilities alone provide plenty of potential for abuse,” said Nohl. “This allows for remote cloning of possibly millions of SIM cards including their mobile identity (IMSI, Ki) as well as payment credentials stored on the card.”
Speaking to the BBC Nohl suggested that about one in eight of all Sim cards are vulnerable to the hack, and that Africa-based users were particularly at risk. He did, however, say that network operators would be quick to secure their software.
Nohl will give full details of his method at a Black Hat security conferenceon July 31st but has already provided industry body GSMA with all of his research.
"Karsten's early disclosure to the GSMA has given us an opportunity for preliminary analysis,” said a GSMA spokeswoman. "It would appear that a minority of Sims produced against older standards could be vulnerable."
"There is no evidence to suggest that today's more secure Sims, which are used to support a range of advanced services, will be affected".
Although often thought of as just providing a mobile phone’s number, Sim cards (it stands for subscriber identity module) often store users personal data and are the mark by which carriers authenticate individual users.
Millions of SIM cards could be putting your phone security at risk.
One security expert has revealed the SIM card in your phone could lead hackers to read your text messages or listen in on calls.
Expert Karsten Nohl from German company Security Research Labs said if you've ever shared sensitive information via text or call, such as your card details, these can be used by criminals to withdraw money from your account or make purchases using your card details.
The GSMA is looking into the findings, according to the BBC.
A spokeswoman for the GSMA said, 'Karsten's early disclosure to the GSMA has given us an opportunity for preliminary analysis.'
'We have been able to consider the implications and provide guidance to those network operators and Sim vendors that may be impacted' she said.
However, if you have a microSIM card, which most new smartphones use, you may be safer from an attack.
'It would appear that a minority of Sims produced against older standards could be vulnerable,' said the GSMA spokeswoman.
Although SIM cards can only store a small amount of data, such as your contacts and a limited number of text messages, they can also store information related to apps, such as your bank details for a banking application.
'OTA [over-the-air) commands, such as software updates, are cryptographically-secured SMS messages, which are delivered directly to the SIM,' Nohl said in his report.
Nohl said he was able to send a text message to a SIM card, just like operators can send a software update to a device, to reveal the card's authentication code that then allowed him to extract the information stored on it.
'To derive a DES OTA key, an attacker starts by sending a binary SMS to a target device. The SIM does not execute the improperly signed OTA command, but does in many cases respond to the attacker with an error code carrying a cryptographic signature, once again sent over binary SMS.
'The cracked DES key enables an attacker to send properly signed binary SMS, which download Java applets onto the SIM. Applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse.'
Nohl said the best defences against allowing hackers to extract information from your SiM card includes:
Better SIM cards with state-of-art cryptography with sufficiently long keys
Handset SMS firewall allowing the user to decide which SMS sources to trust
Mobile networks should filter the text messages allowed through to a device
“With over seven billion cards in active use, Sims may well be the most widely used security token in the world,” says German security expert Karsten Nohl, the individual responsible for uncovering the flaw.
“The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets.”
Nohl’s research covered the different systems of encryption used to secure Sim cards, with one particular standard named DES (Data Encryption Standard) identified as particularly insecure.
Dating back to the 1970s DES has long been considered insecure, with Nohl’s method allowing the encryption to be cracked “within two minutes on a standard computer”.
By sending a text containing a specially designed binary code Nohl was able to trick phones into authenticating him as their network provider.
Once this protocol had been established Nohl could then remotely download software onto the phone allowing him to send texts, access voicemail and even receive reports on the phone’s physical location.
“These capabilities alone provide plenty of potential for abuse,” said Nohl. “This allows for remote cloning of possibly millions of SIM cards including their mobile identity (IMSI, Ki) as well as payment credentials stored on the card.”
Speaking to the BBC Nohl suggested that about one in eight of all Sim cards are vulnerable to the hack, and that Africa-based users were particularly at risk. He did, however, say that network operators would be quick to secure their software.
Nohl will give full details of his method at a Black Hat security conferenceon July 31st but has already provided industry body GSMA with all of his research.
"Karsten's early disclosure to the GSMA has given us an opportunity for preliminary analysis,” said a GSMA spokeswoman. "It would appear that a minority of Sims produced against older standards could be vulnerable."
"There is no evidence to suggest that today's more secure Sims, which are used to support a range of advanced services, will be affected".
