Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

forbes.com

Post reply on HN
Print view View original

31–40 of 97 posts

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#31

Post by Genmutant »

jingo wrote: post #30
Genmutant wrote: post #18

Earlier quoted context omitted.

How would you extend the functionality? Programming in JavaCard is really not fun (my opinion) and the space and processing power are really limited. The biggest use of it is verifying information (like pins or certificates), but what else would you do that your phone can't?

Consider that some might not program for "fun". They might do it out of necessity: to "scratch itches". Limitation breeds creativity. This is true in general, but certainly in computers. Ever heard of demoscene? By comparison to the constraints we had to work with in the 80's, the power of today's handheld computers (one usage of which is as a "phone") is hardly a limitation. But I guess it would depend on what you a…

But you can already upload your software to phones. You don't need the simcard for that.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#32

Post by tptacek »

hondje wrote: post #28
tptacek wrote: post #17

Earlier quoted context omitted.

Well, he's talking about it at Black Hat, right? Black Hat talks are usually full-disclosure.

Its all about full disclosure for ethical reasons. Can't say that about them white hats.

I don't know what this comment means. Could you, or someone else, explain it? Who are the "white hats"? Why do they have different perspectives on full disclosure than other people? Who are those other people?

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#33

Post by muyuu »

straight_talk_2 wrote: post #22
muyuu wrote: post #20

What are the implications? Can't stand Forbes and their over the top ads, tldr would be appreciated.

Why don't you get an ad blocker - e.g. Ad Muncher is a great one.

I prefer to allow sites to monetise their visits within reason. If they go insane like Forbes then I just avoid them.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#34

Post by muyuu »

Figs wrote: post #29
muyuu wrote: post #20

What are the implications? Can't stand Forbes and their over the top ads, tldr would be appreciated.

Here's the primary bit the article says about implications: "The two-part flaw, based on an old security standard and badly configured code, could allow hackers to remotely infect a SIM with a virus that sends premium text messages (draining a mobile phone bill), surreptitiously re-direct and record calls, and —with the right combination of bugs —carry out payment system fraud."

Any SIM? Remotely how? through a call or a message?

Just trying to figure out the scope of this problem. Journos seem to care more about sensation than facts.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#35

Post by RKearney »

straight_talk_2 wrote: post #22
muyuu wrote: post #20

What are the implications? Can't stand Forbes and their over the top ads, tldr would be appreciated.

Why don't you get an ad blocker - e.g. Ad Muncher is a great one.

Why should we be forced to download third party applications/plugins in order to read a news post without any unnecessary interruptions?

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#36

Post by gioele »

A beautiful, although not really accurate, explanation of a buffer overflow:

> The way this works is somewhat complex, but Nohl’s virus essentially gave the infected Java software a command it could not understand or complete – eg. asking for the 12th item in a 10-item list, leading the software to forgo basic security checks and granting the virus full memory access, or “root,” in cyber security parlance.

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#37

Post by nqzero »

vaguely related question ... is it safe to insert an arbitrary sim card in a phone ?

i want to try out some of the gsm mvnos in the states (eg airvoice, ptel and h2o). an at&t or comcast or microsoft has a reputation that's worth billions, so i "trust" them to only be semi-evil and at least semi-responsible. i don't know much of these mvno companies, but assume they're living on the margins and don't have too much to risk. could they, or an enterprising engineer working for them, mess with the sim card to take something of value from me ?

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#38

Post by maaaats »

RKearney wrote: post #35
straight_talk_2 wrote: post #22

Earlier quoted context omitted.

Why don't you get an ad blocker - e.g. Ad Muncher is a great one.

Why should we be forced to download third party applications/plugins in order to read a news post without any unnecessary interruptions?

No one is forcing you, just don't visit the site, then..

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#39

Post by RunningDroid »

tptacek wrote: post #32
hondje wrote: post #28

Earlier quoted context omitted.

Its all about full disclosure for ethical reasons. Can't say that about them white hats.

I don't know what this comment means. Could you, or someone else, explain it? Who are the "white hats"? Why do they have different perspectives on full disclosure than other people? Who are those other people?

I think hondje's comment was intended to be sarcastic, for the rest see

https://en.wikipedia.org/wiki/White_hat_(computer_security)

Re: SIM Cards Have Finally Been Hacked, and the Flaw Could Affect Millions of Phones

#40

Post by jingo »

Genmutant wrote: post #31
jingo wrote: post #30

Earlier quoted context omitted.

Consider that some might not program for "fun". They might do it out of necessity: to "scratch itches". Limitation breeds creativity. This is true in general, but certainly in computers. Ever heard of demoscene? By comparison to the constraints we had to work with in the 80's, the power of today's handheld computers (one usage of which is as a "phone") is hardly a limitation. But I guess it would depend on what you a…

But you can already upload your software to phones. You don't need the simcard for that.

I thought we were talking about SIM cards.

Can I upload software to my SIM card? No.

Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.).

Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card?

The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone.

This is like buying a computer that has a special card slot owned by a single company or a consortium of companies that produce special cards only for their own use. The user is effectively denied access to the slot.

Post reply on HN