I don't understand the article's description of the sandbox vulnerability. On the iPhone app sandboxing is done by iOS, not in the SIM. Does the reporter just not understand, or is there another layer I'm not aware of?
SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
11–20 of 97 posts
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#12Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…
At one point he says that he thinks it will take the black hats six months or so to figure out the exploit, but then, in the passage you have quoted, he gives what sound (to my non expert ear) like fairly massive clues. Is it possible he has revealed too much?
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#13Article mentions "credit card java applets on SIM cards". I've never used one of those, and I know nobody in the western world who does.
I always presumed that these sim java applets are crapware that is mercifully hidden on todays smartphones.
It's also my impression that Mastercard and Visa paid a hefty stupidity tax by thinking in the 2000s that it would be important to have their software on SIM cards, not foreseeing that smartphone apps would just bypass that whole layer.
Anybody know of an application in the western world, on smart phones, where these java applets are really used?
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#14It's a "known plaintext" attack on DES. Via google translate, here is an article from Heise with more details: http://translate.google.com/translate?sl=auto&tl=en&js=n&pre...
Unfortunately, "known plaintext" is just about the most general term you can use to describe a crypto attack; it covers a huge number of different attack scenarios.
This isn't new, but I wonder if it's related:
"All SIMs could reject OTA message without Digitial Signature (DS), but this is rarely done as it brings additional pain to gsm providers. Most of the SIMs are correctly secured. Most of the SIMs accept OTA messages that are not encrypted. Some SIMs accept OTA messages that only have a correct Cryptographic Checksum (CC) and some SIMs only require a correct Redundancy Check (RC) and also require counter increase N+1. Most of the SIMs dont require any security feature and accept OTA messages without no RC, CC or DS, for example - Globul. (by marek, TODO: name the networks!)."
http://wiki.thc.org/gsm/simtoolkit#head-1c0ca2c9ebd6ac101c90...
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#15I don't understand the article's description of the sandbox vulnerability. On the iPhone app sandboxing is done by iOS, not in the SIM. Does the reporter just not understand, or is there another layer I'm not aware of?
That's a separate sandboxing system. The SIM has its own sandboxes.
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#16I don't understand the article's description of the sandbox vulnerability. On the iPhone app sandboxing is done by iOS, not in the SIM. Does the reporter just not understand, or is there another layer I'm not aware of?
From what I could gather, the sandboxing was actually referring to the SIM card itself. It was hard to tell through the layman-ified description, but it sounded like he used some sort of buffer overflow to break out of the sandbox and access other parts of the SIM's memory which he shouldn't have been able to.
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#17Karsten Nohl: also the real deal. Here, for us, are the nut grafs: In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographi…
At one point he says that he thinks it will take the black hats six months or so to figure out the exploit, but then, in the passage you have quoted, he gives what sound (to my non expert ear) like fairly massive clues. Is it possible he has revealed too much?
Well, he's talking about it at Black Hat, right? Black Hat talks are usually full-disclosure.
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#18Hurray for Java applets. But seriously, there is a sunny side to this story: a user could load her own programs onto her SIM. She could gretaly extend the functionality of her phone... with programs that she trusts. Maybe even ones she wrote herself. Imagine... an open platform. Oh gosh, that would be terrible, wouldn't it? Otherwise this story highlights the concept of "minimum viable product" not in the startup wor…
How would you extend the functionality? Programming in JavaCard is really not fun (my opinion) and the space and processing power are really limited. The biggest use of it is verifying information (like pins or certificates), but what else would you do that your phone can't?
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#19What I'm curious about is what Nohl meant when he said that it would take six months from the time of his presentation at Black Hat for crackers to develop working exploits based on his findings. And if he is (as the article suggests) working with the phone companies, why not simply wait until they've implemented their patches (if they in fact need them)?
If indeed it is as simple to force a sim to run these malicious applets as using some sort of rainbow-table-powered replay attack, what would be the challenge? Or perhaps he was referring to the more lucrative aspect of breaking out of the sim sandbox...
Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones
#20What are the implications?
Can't stand Forbes and their over the top ads, tldr would be appreciated.